joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d2b0
Capabilities:
Decompress data using quicklz

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x40d478
sub esp, 0x34
mov eax, dword [esp + 0x38]
cmp eax, 0x7000000
jle 0x40d45d
mov eax, 0x7000000
mov dword [esp + 0x38], eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov edx, dword [ecx + 0x94]
mov ebx, dword [ecx + 0x98]
mov dword [ecx + 0x94], ebx
mov ebp, edx
shl edx, 0x11
xor edx, ebp
mov ebp, ebx
xor ebx, edx
shr edx, 7
xor edx, ebx
mov ebx, ebp
shr ebp, 0x10
xor ebp, edx
mov dword [ecx + 0x98], ebp
lea ecx, [ebp + ebx]
and ecx, 0x3ffffff
inc ecx
mov dword [esp], ecx
call dbg.runtime.uint32tofloat64
movsd xmm0, qword [esp + 4]
movsd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, eax
shr eax, 0x14
and eax, 0x7ff
mov edx, eax
add eax, 0xfffffc01
mov ebx, ecx
shr ecx, 0xf
and ecx, 0x1f
mov ebp, ecx
add ecx, 1
mov esi, dword [esp + 0x24]
shr esi, 0x1b
shl ebx, 5
or esi, ebx
mov ebx, ebp
add ebp, 1
mov ebp, 0
adc ebp, 0
test ebp, ebp
jne 0x40d471
cmp ecx, 0x21
jae 0x40d471
mov dword [esp + 0x10], esi
lea ebp, [0x5c1200]
movsd xmm0, qword [ebp + ebx*8]
movsd qword [esp + 0x14], xmm0
movsd xmm1, qword [ebp + ecx*8]
movsd qword [esp + 0x1c], xmm1
mov dword [esp], eax
add edx, 0xfffffc01
mov eax, 0xffffffff
adc eax, 0
mov dword [esp + 4], eax
call dbg.runtime.int64tofloat64
mov eax, dword [esp + 0x10]
and eax, 0xfffff
movsd xmm0, qword [esp + 8]
movsd qword [esp + 0x2c], xmm0
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.00445c00
movsd xmm0, qword [esp + 0x2c]
movsd xmm1, qword [esp + 0x14]
addsd xmm0, xmm1
movsd xmm2, qword [esp + 0x1c]
subsd xmm2, xmm1
movsd xmm1, qword [esp + 8]
mulsd xmm2, xmm1
movsd xmm1, qword [0x543f38]
mulsd xmm1, xmm2
addsd xmm0, xmm1
movsd xmm1, qword [0x543f90]
subsd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jbe 0x40d438
xorps xmm0, xmm0
mov eax, dword [esp + 0x38]
cvtsi2sd xmm1, eax
movsd xmm2, qword [0x543fc8]
mulsd xmm1, xmm2
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
inc eax
mov dword [esp + 0x3c], eax
add esp, 0x34
ret
test eax, eax
jne 0x40d2dd
mov dword [esp + 0x3c], 0
add esp, 0x34
ret
call dbg.runtime.panicindex
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.fastexprand
Function at 0x4111a0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4113e1
sub esp, 0x24
mov eax, dword [0x5e1240]
test eax, eax
jne 0x4113c9
lea eax, [0x5e1230]
mov dword [esp], eax
call dbg.runtime.lock
mov eax, dword [0x5d065c]
test eax, eax
je 0x4111ed
mov eax, dword [eax + 8]
cmp eax, 0xcc
jne 0x4112b4
mov eax, dword [0x5d0654]
test eax, eax
jne 0x411296
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x5e2518]
mov dword [esp + 8], eax
call dbg.runtime.persistentalloc
mov eax, dword [esp + 0xc]
mov dword [0x5d0654], eax
mov ecx, dword [0x5d0630]
mov dword [eax], ecx
mov eax, dword [0x5d0654]
mov dword [0x5d0630], eax
movzx eax, byte [0x5e1580]
test al, al
jne 0x411296
xor eax, eax
jmp 0x411253
lea ebp, [0x5e1580]
mov byte [ebp + edx], bl
lea eax, [edx + 1]
cmp eax, 0x80
jge 0x411296
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
mov ebx, ecx
sar ecx, 0x1f
sub edx, ecx
lea ecx, [edx + edx*4]
mov edx, ebx
sub ebx, ecx
cmp ebx, 5
jae 0x4113c2
lea ecx, [0x5bd0dc]
movzx ebx, byte [ecx + ebx]
cmp edx, 0x80
jb 0x411246
jmp 0x4113c2
mov eax, dword [0x5d0654]
mov ecx, dword [eax + 4]
mov dword [0x5d0654], ecx
mov ecx, dword [0x5d065c]
mov dword [eax + 4], ecx
mov dword [0x5d065c], eax
mov eax, dword [0x5d065c]
mov ecx, dword [eax + 8]
lea edx, [eax + 8]
cmp ecx, 0xcc
jae 0x4113bb
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ecx
mov dword [esp], edx
mov dword [esp + 4], 1
call dbg.runtime/internal/atomic.Xadd
mov eax, dword [esp + 0x14]
lea eax, [eax + eax*4]
mov ecx, dword [esp + 0x20]
lea edx, [ecx + eax*4 + 0x10]
mov ebx, dword [0x5e13d0]
test ebx, ebx
jne 0x41139a
mov edx, dword [esp + 0x2c]
mov dword [ecx + eax*4 + 0x10], edx
mov edx, dword [esp + 0x30]
mov dword [ecx + eax*4 + 0x18], edx
mov edx, dword [0x5e13d0]
lea ebx, [ecx + eax*4 + 0x1c]
lea ebp, [ecx + eax*4 + 0x20]
lea esi, [ecx + eax*4 + 0x14]
test edx, edx
jne 0x411358
mov edx, dword [esp + 0x34]
mov dword [ecx + eax*4 + 0x1c], edx
mov edx, dword [esp + 0x38]
mov dword [ecx + eax*4 + 0x20], edx
mov edx, dword [esp + 0x28]
mov dword [ecx + eax*4 + 0x14], edx
mov byte [0x5e11c8], 1
lea eax, [0x5e1230]
mov dword [esp], eax
call dbg.runtime.unlock
add esp, 0x24
ret
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], esi
mov dword [esp], ebx
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
mov eax, dword [esp + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
jmp 0x41133f
mov dword [esp + 0x10], eax
mov dword [esp], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], eax
call dbg.runtime.writebarrierptr
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
jmp 0x411309
call dbg.runtime.panicindex
ud2
call dbg.runtime.panicindex
ud2
lea eax, [0x52e3fe]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call dbg.runtime.throw
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.queuefinalizer
Function at 0x41f7a0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x41f8bc
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x41f830
cmp cl, 2
jne 0x41f8a4
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call dbg.runtime.mProf_Free
lea eax, [0x5d5234]
mov dword [esp], eax
call dbg.runtime.lock
lea eax, [0x5d5210]
test byte [eax], al
mov eax, dword [0x5d5228]
mov ecx, dword [0x5d5210]
sub eax, ecx
mov dword [0x5d5228], eax
mov eax, dword [0x5d521c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5d521c], ecx
lea eax, [0x5d5234]
mov dword [esp], eax
call dbg.runtime.unlock
add esp, 0x14
ret
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x1c]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call dbg.runtime.queuefinalizer
lea eax, [0x5d5234]
mov dword [esp], eax
call dbg.runtime.lock
lea eax, [0x5d51ec]
test byte [eax], al
mov eax, dword [0x5d5204]
mov ecx, dword [0x5d51ec]
sub eax, ecx
mov dword [0x5d5204], eax
mov eax, dword [0x5d51f8]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x5d51f8], ecx
lea eax, [0x5d5234]
mov dword [esp], eax
call dbg.runtime.unlock
jmp 0x41f82c
lea eax, [0x52bbc6]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call dbg.runtime.throw
ud2
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.freespecial
Function at 0x43d860
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0x10
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0x1d0]
inc ecx
mov dword [eax + 0x1d0], ecx
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
lea edx, [ecx + 0xc4]
test byte [edx], al
mov edx, eax
mov dword [ecx + 0xc4], eax
lea eax, [edx + 0x88]
test byte [eax], al
mov eax, dword [edx + 0x18]
mov dword [edx + 0x88], eax
mov dword [esp], 0
lea eax, [0x533bc0]
mov dword [esp + 4], eax
call dbg.runtime.deferproc
test eax, eax
jne 0x43d95b
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [esp + 0xc], eax
lea ecx, [eax + 0x21c]
test byte [ecx], al
mov edx, dword [esp + 0x14]
mov dword [eax + 0x21c], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0x220], edx
lea edx, [esp + 0x1c]
mov dword [eax + 0x224], edx
mov edx, dword [0x5d063c]
mov dword [esp], edx
mov dword [esp + 4], ecx
call dbg.runtime.cgocall
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x228]
mov edx, dword [eax + 0x22c]
mov eax, dword [eax + 0x230]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
nop
call dbg.runtime.deferreturn
add esp, 0x10
ret
nop
call dbg.runtime.deferreturn
add esp, 0x10
ret
Function at 0x442a90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x442b2f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0044a997
lea ecx, [0x448820]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call dbg.runtime.systemstack
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.callers
Function at 0x44a2c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x44a300
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x5e1480]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x44a33b
je 0x44a38a
cmp ebx, 0x20
jbe 0x44a390
cmp ebx, 0x40
jbe 0x44a3ce
jmp 0x44a45f
test ebx, ebx
je 0x44a380
add eax, 0x10
test ax, 0xff0
je 0x44a36c
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x5458e0]
aesenc xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x5459e0]
jmp 0x44a358
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x44a358
pxor xmm1, xmmword [0x5e1490]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
aesenc xmm2, xmm0
aesenc xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5e1490]
pxor xmm2, xmmword [0x5e14a0]
pxor xmm3, xmmword [0x5e14b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x5e1490]
pxor xmm2, xmmword [0x5e14a0]
pxor xmm3, xmmword [0x5e14b0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x44a4be
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
Function at 0x44b3e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword fs:[0x14]
mov edx, esp
sub esp, 0x238
mov dword [esp], esp
mov dword [esp + 4], 0x238
call dbg.runtime.memclrNoHeapPointers
lea ecx, [esp + 0x30]
mov dword fs:[0x14], ecx
mov ebx, esp
sub esp, 0xd8
mov dword [ecx], esp
mov dword [ebx], esp
mov dword [esp], esp
mov dword [esp + 4], 0xd8
call dbg.runtime.memclrNoHeapPointers
lea ebx, [esp + 0xd8]
mov dword [esp + 0x18], ebx
lea ecx, [esp - 0x8000]
mov dword [esp], ecx
add ecx, 0xb70
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edx
push eax
push dword [ebp + 0x10]
call dword [ebp + 8]
pop ecx
pop eax
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esp, dword [ecx + 4]
pop dword fs:[0x14]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x44b480
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov eax, esp
mov dword [edx + 4], eax
sub eax, 0x10000
mov dword [edx], eax
add eax, 0xb70
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
lea esi, [ecx + 0x30]
mov dword fs:[0x14], esi
mov dword [edx + 0x18], ecx
mov dword [esi], edx
cld
call dbg.runtime.stackcheck
call dbg.runtime.mstart
ret
Function at 0x4688a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4689c2
sub esp, 0x4c
mov eax, dword [esp + 0x64]
test eax, eax
jle 0x4689bb
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x40], ecx
mov eax, dword [0x5d0758]
mov dword [esp], eax
call dbg.syscall.(*LazyProc).Addr
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov dword [esp], eax
mov dword [esp + 4], 7
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dbg.syscall.Syscall9
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x4689b5
test ecx, ecx
je 0x4689a7
cmp ecx, 0x3e5
jne 0x46897b
mov ecx, dword [0x5ccea4]
mov edx, dword [0x5ccea0]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ecx
lea eax, [0x544ad0]
mov dword [esp], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
call dbg.runtime.convT2I32
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x38]
jmp 0x46896b
lea ecx, [0x543e98]
lea edx, [0x544ad0]
jmp 0x46896b
xor edx, edx
mov ecx, edx
jmp 0x46896b
xor ecx, ecx
jmp 0x4688c9
call dbg.runtime.morestack_noctxt
jmp dbg.syscall.formatMessage
Function at 0x46aca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46ad8f
sub esp, 0x54
mov eax, dword [0x5d0838]
mov dword [esp], eax
call dbg.syscall.(*LazyProc).Addr
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 8
mov eax, dword [esp + 0x58]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0
call dbg.syscall.Syscall9
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x46ad6b
xor eax, eax
mov ecx, eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], eax
add esp, 0x54
ret
mov dword [esp + 0x38], eax
lea eax, [0x544ad0]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call dbg.runtime.convT2I32
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
jmp 0x46ad5f
call dbg.runtime.morestack_noctxt
jmp dbg.syscall.RegEnumKeyEx
Function at 0x46b270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46b37c
sub esp, 0x4c
mov eax, dword [0x5d0890]
mov dword [esp], eax
call dbg.syscall.(*LazyProc).Addr
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 9
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], eax
call dbg.syscall.Syscall9
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
cmp eax, 0xffffffff
jne 0x46b376
test ecx, ecx
je 0x46b368
cmp ecx, 0x3e5
jne 0x46b344
mov eax, dword [0x5ccea0]
mov ecx, dword [0x5ccea4]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x4c
ret
mov dword [esp + 0x38], ecx
lea eax, [0x544ad0]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call dbg.runtime.convT2I32
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
jmp 0x46b338
lea ecx, [0x543e18]
lea eax, [0x544ad0]
jmp 0x46b338
xor ecx, ecx
mov eax, ecx
jmp 0x46b338
call dbg.runtime.morestack_noctxt
jmp dbg.syscall.WSAIoctl
Function at 0x46c4c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x46c5e3
sub esp, 0x58
mov eax, dword [0x5d07fc]
mov dword [esp], eax
call dbg.syscall.(*LazyProc).Addr
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 7
mov eax, dword [esp + 0x54]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dbg.syscall.Syscall9
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
test eax, eax
jne 0x46c5dd
test ecx, ecx
je 0x46c5cf
cmp ecx, 0x3e5
jne 0x46c5ab
mov eax, dword [0x5ccea0]
mov ecx, dword [0x5ccea4]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
add esp, 0x58
ret
mov dword [esp + 0x38], ecx
lea eax, [0x544ad0]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call dbg.runtime.convT2I32
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
jmp 0x46c59f
lea ecx, [0x543e58]
lea eax, [0x544ad0]
jmp 0x46c59f
xor ecx, ecx
mov eax, ecx
jmp 0x46c59f
call dbg.runtime.morestack_noctxt
jmp dbg.syscall.LookupAccountSid
Function at 0x4c7590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c7677
sub esp, 0x50
mov eax, dword [0x5d04fc]
mov dword [esp], eax
call dbg.syscall.(*LazyProc).Addr
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], ecx
mov dword [esp], eax
mov dword [esp + 4], 9
mov eax, dword [esp + 0x54]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
call dbg.syscall.Syscall9
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4c7653
xor eax, eax
mov ecx, eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], eax
add esp, 0x50
ret
mov dword [esp + 0x38], eax
lea eax, [0x544ad0]
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
call dbg.runtime.convT2I32
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
jmp 0x4c7647
call dbg.runtime.morestack_noctxt
jmp dbg.github.com/btcsuite/winsvc/winapi.RegCreateKeyEx