joyce8/EMBER2024-capa huggingface dataset:
Function at 0x577550
Capabilities:
Parse credit card information

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57772e
movzx eax, byte [esp + 4]
cmp al, 0x61
jb 0x57757b
cmp al, 0x7a
ja 0x57757b
mov byte [esp + 0xc], 0
ret
cmp al, 0x41
jb 0x577727
cmp al, 0x5a
setbe cl
test cl, cl
jne 0x577575
cmp al, 0x30
jb 0x577720
cmp al, 0x39
setbe cl
test cl, cl
jne 0x577575
mov ecx, dword [esp + 8]
cmp ecx, 3
jne 0x577712
cmp al, 0x2c
ja 0x5776ef
lea edx, [eax - 0x21]
cmp dl, 1
ja 0x5775c5
mov byte [esp + 0xc], 0
ret
cmp al, 0x24
je 0x5775bf
lea edx, [eax - 0x26]
cmp dl, 6
jbe 0x5775bf
cmp al, 0x2f
ja 0x5776b5
cmp al, 0x26
ja 0x57768d
cmp al, 0x24
jne 0x577682
cmp ecx, 2
jg 0x577646
cmp ecx, 1
je 0x57763b
cmp ecx, 2
jne 0x57761d
cmp al, 0x2f
jne 0x57760b
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x3b
je 0x577601
cmp al, 0x2c
je 0x577601
cmp al, 0x3f
sete al
jmp 0x577606
cmp ecx, 7
jne 0x577635
cmp al, 0x21
jne 0x57762d
mov byte [esp + 0xc], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x577627
mov byte [esp + 0xc], 1
ret
cmp al, 0x3f
sete al
mov byte [esp + 0xc], al
ret
cmp ecx, 5
jne 0x57766c
cmp al, 0x40
jne 0x57765a
mov eax, 1
mov byte [esp + 0xc], al
ret
cmp al, 0x2f
je 0x577650
cmp al, 0x3f
je 0x577650
cmp al, 0x3a
sete al
jmp 0x577655
cmp ecx, 6
je 0x57767c
cmp ecx, 7
jne 0x57761d
mov byte [esp + 0xc], 0
ret
mov byte [esp + 0xc], 1
ret
cmp al, 0x26
je 0x5775ed
jmp 0x57761d
lea edx, [eax - 0x2b]
cmp dl, 1
jbe 0x5775ed
lea edx, [eax - 0x2d]
cmp dl, 1
ja 0x5776a7
mov byte [esp + 0xc], 0
ret
cmp al, 0x2f
je 0x5775ed
jmp 0x57761d
cmp al, 0x3d
ja 0x5776d4
lea edx, [eax - 0x3a]
cmp dl, 1
jbe 0x5775ed
cmp al, 0x3d
je 0x5775ed
jmp 0x57761d
lea edx, [eax - 0x3f]
cmp dl, 1
jbe 0x5775ed
cmp al, 0x5f
je 0x5776a1
cmp al, 0x7e
je 0x5776a1
jmp 0x57761d
lea edx, [eax - 0x3a]
cmp dl, 4
jbe 0x5775bf
cmp al, 0x5b
je 0x5775bf
cmp al, 0x5d
je 0x5775bf
jmp 0x5775d2
cmp ecx, 4
je 0x5775ae
jmp 0x5775d2
xor ecx, ecx
jmp 0x57759d
xor ecx, ecx
jmp 0x57758a
call fcn.0044fc40
jmp fcn.00577550
Function at 0x5f39e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5f3a87
sub esp, 0xc
lea eax, [0x74e420]
mov dword [esp], eax
call fcn.0040a580
mov eax, dword [esp + 4]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.005f3910
mov eax, dword [esp + 8]
xor ecx, ecx
jmp 0x5f3a52
mov esi, ebx
shl ebx, 0xa
lea edi, [eax + ebx]
mov dword [edi + ecx*4], ebp
lea ebx, [esi + 1]
mov edx, ebp
cmp ebx, 8
jge 0x5f3a51
mov ebp, edx
and edx, 0xff
shr ebp, 8
xor ebp, dword [eax + edx*4]
cmp ebx, 8
jb 0x5f3a27
jmp 0x5f3a6e
inc ecx
cmp ecx, 0x100
jge 0x5f3a66
jae 0x5f3a7a
mov edx, dword [eax + ecx*4]
mov ebx, 1
jmp 0x5f3a37
mov dword [esp + 0x14], eax
add esp, 0xc
ret
mov eax, ebx
mov ecx, 8
call fcn.00451500
mov eax, ecx
mov ecx, 0x100
call fcn.00451500
nop
call fcn.0044fc40
jmp fcn.005f39e0
Function at 0x6296f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x629909
sub esp, 0x70
mov ecx, dword [esp + 0x74]
test ecx, ecx
je 0x6298f2
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00451724
lea ecx, [0x793920]
mov dword [esp], ecx
mov edx, dword [esp + 0x74]
mov dword [esp + 4], edx
lea ebx, [esp + 0x40]
mov dword [esp + 8], ebx
call fcn.0040c3c0
xor eax, eax
jmp 0x629763
mov eax, dword [esp + 0x44]
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x40]
mov dword [esp], ecx
call fcn.0040c630
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
add eax, ecx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x40]
test ecx, ecx
jne 0x629742
lea ecx, [0x748600]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], eax
call fcn.0043c700
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx]
lea ebx, [0x793920]
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], 0
call fcn.0040b150
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
lea edi, [esp + 0x40]
xor eax, eax
call fcn.00451724
lea eax, [0x793920]
mov dword [esp], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x40]
mov dword [esp + 8], ecx
call fcn.0040c3c0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x24]
jmp 0x629812
lea eax, [esp + 0x40]
mov dword [esp], eax
call fcn.0040c630
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
sub ecx, eax
mov edx, ecx
neg ecx
shl eax, 3
sar ecx, 0x1f
and eax, ecx
mov ecx, dword [esp + 0x38]
add eax, ecx
mov ecx, edx
mov edx, dword [esp + 0x40]
test edx, edx
je 0x6298e6
mov dword [esp + 0x38], eax
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x44]
mov ebp, dword [ebx + 8]
mov esi, dword [ebx + 4]
mov ebx, dword [ebx]
mov edi, dword [edx + 4]
mov dword [esp + 0x2c], edi
mov edx, dword [edx]
mov dword [esp + 0x30], edx
lea edi, [0x748600]
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebp
call fcn.00410a20
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
cmp edx, ebx
ja 0x629903
mov dword [esp + 0x28], edx
lea eax, [0x793920]
mov dword [esp], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x30]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], edx
call fcn.0040fcb0
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, dword [0xa918d0]
test ecx, ecx
jne 0x6298cb
mov edx, dword [esp + 0x38]
mov dword [edi], edx
mov ecx, dword [esp + 0x24]
cmp eax, ecx
jbe 0x6297e8
jmp 0x6298fe
mov ecx, eax
mov eax, dword [esp + 0x38]
call fcn.00451480
mov ebx, dword [esp + 0x24]
cmp ecx, ebx
mov eax, ecx
mov ecx, ebx
mov edx, dword [esp + 0x38]
jmp 0x6298c3
mov eax, dword [esp + 0x34]
mov dword [esp + 0x78], eax
add esp, 0x70
ret
mov dword [esp + 0x78], 0
add esp, 0x70
ret
call fcn.00451560
call fcn.004515a0
nop
call fcn.0044fc40
jmp fcn.006296f0
Function at 0x65c170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x65c2a5
sub esp, 0x1c
mov eax, dword [esp + 0x24]
test eax, eax
je 0x65c29c
xor ecx, ecx
jmp 0x65c1a1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jge 0x65c293
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx + ecx]
cmp ebx, 0x80
jge 0x65c276
inc ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
lea eax, [0x7af0c4]
mov dword [esp], eax
mov dword [esp + 4], 0x1b
mov dword [esp + 8], ebx
call fcn.004e6670
mov eax, dword [esp + 0xc]
test eax, eax
jge 0x65c199
mov eax, dword [esp + 0x14]
cmp eax, 0xff
ja 0x65c253
movzx ecx, al
lea edx, [0xa461a0]
movzx ecx, byte [edx + ecx]
test cl, 0x60
setne cl
test cl, cl
je 0x65c219
xor eax, eax
test al, al
je 0x65c199
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
cmp eax, 0xff
jg 0x65c234
cmp eax, 0x30
jl 0x65c230
cmp eax, 0x39
setle al
xor eax, 1
jmp 0x65c20c
xor eax, eax
jmp 0x65c22b
mov ecx, dword [0xa7805c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0046dcd0
movzx eax, byte [esp + 8]
lea edx, [0xa461a0]
jmp 0x65c22b
mov ecx, dword [0xa78110]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0046dcd0
movzx ecx, byte [esp + 8]
mov eax, dword [esp + 0x14]
lea edx, [0xa461a0]
jmp 0x65c206
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0044b940
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
jmp 0x65c1be
mov byte [esp + 0x28], 1
add esp, 0x1c
ret
mov byte [esp + 0x28], 0
add esp, 0x1c
ret
call fcn.0044fc40
jmp fcn.0065c170
Function at 0x693700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x69391c
sub esp, 0x5c
mov edx, dword [esp + 0x80]
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x64]
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x6c]
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x54]
jmp 0x693827
lea edx, [ecx + edi*8]
mov ebx, dword [edx + 4]
mov edx, dword [edx]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x18], edx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov ebx, dword [0xa7e690]
mov edx, dword [0xa7e694]
mov eax, dword [0xa7e698]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x40], eax
call fcn.00693b10
mov eax, dword [esp + 0x50]
inc eax
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x80]
mov esi, dword [esp + 0x7c]
mov edi, dword [esp + 0x64]
mov ebp, edi
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x6c]
mov dword [esp + 0x50], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x78], ebx
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x84]
mov edx, dword [esp + 0x80]
mov ebx, dword [esp + 0x7c]
mov edx, dword [esp + 0x88]
lea ebx, [edx - 1]
mov edi, dword [esp + 0x50]
cmp edi, ebx
jge 0x693846
cmp edi, edx
jb 0x69374e
jmp 0x693912
cmp ebx, edx
jae 0x693909
lea ecx, [ecx + edx*8 - 8]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x40], eax
call fcn.00693b10
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], edx
add esp, 0x5c
ret
mov eax, ebx
mov ecx, edx
call fcn.00451500
mov eax, edi
mov ecx, edx
call fcn.00451500
nop
call fcn.0044fc40
jmp fcn.00693700
Function at 0x693930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x693b01
sub esp, 0x6c
lea ecx, [0x832180]
mov edx, dword [esp + 0x70]
mov dword [edx + 0xc], ecx
mov ecx, dword [0xa918d0]
test ecx, ecx
jne 0x693aed
mov eax, dword [esp + 0x80]
mov dword [edx + 0x10], eax
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x50], ecx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x58], eax
mov ebx, dword [edx]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
call fcn.006983d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
movzx ebx, byte [esp + 0x18]
test bl, bl
je 0x693a64
mov ebx, dword [esp + 0x70]
mov dword [esp], ebx
mov ebx, dword [esp + 0x74]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x78]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x7c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x40], eax
call fcn.00694750
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], edx
add esp, 0x6c
ret
mov dword [esp + 0x54], eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x5c], edx
mov eax, dword [esp + 0x58]
mov dword [esp], eax
mov ecx, dword [esp + 0x50]
mov dword [esp + 4], ecx
call fcn.00407e80
mov eax, dword [esp + 8]
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
lea ecx, [0x748600]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x70]
mov dword [esp], eax
lea ecx, [0x7af986]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x1c
lea ecx, [esp + 0x64]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 1
call fcn.0068ffc0
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x5c]
jmp 0x6939a7
lea edi, [edx + 0x10]
mov eax, dword [esp + 0x80]
call fcn.00451480
jmp 0x69396e
call fcn.0044fc40
jmp fcn.00693930
Function at 0x6b1c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6b1db7
sub esp, 0x34
lea eax, [0x73af80]
mov dword [esp], eax
call fcn.0040a580
mov eax, dword [esp + 0x38]
mov ecx, dword [eax + 0x64]
mov edx, dword [esp + 4]
mov dword [esp + 0x24], edx
mov ebx, dword [eax + 0x68]
mov ecx, dword [ecx + 0x10]
mov ebp, dword [eax + 0x74]
mov eax, dword [eax + 0x78]
mov dword [esp], ebx
mov dword [esp + 8], 0x1e
mov dword [esp + 0xc], 0x1e
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
call ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x6b1d9b
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0x1e
mov dword [esp + 0x30], 0x1e
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
cmp ecx, 0x4034b50
mov dword [esp + 0x2c], 0x1a
mov dword [esp + 0x30], 0x1a
lea edx, [eax + 4]
mov dword [esp + 0x28], edx
cmp ecx, 0x4034b50
je 0x6b1d2a
mov eax, dword [0xa7dd18]
mov ecx, dword [0xa7dd1c]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
add esp, 0x34
ret
lea ecx, [eax + 0x1a]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], 4
nop
nop
movzx ecx, word [eax + 0x1a]
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], 2
lea edx, [eax + 0x1c]
mov dword [esp + 0x28], edx
nop
nop
movzx eax, word [eax + 0x1c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x28], edx
lea eax, [ecx + eax + 0x1e]
mov dword [esp + 0x3c], eax
sar eax, 0x1f
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
add esp, 0x34
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
add esp, 0x34
ret
call fcn.0044fc40
jmp fcn.006b1c50
Function at 0x6e0430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6e0576
sub esp, 0x74
mov ecx, dword [esp + 0x78]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x40], ecx
lea edi, [esp + 0x44]
xor eax, eax
call fcn.00451724
lea ecx, [0x74bb40]
mov dword [esp], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x44]
mov dword [esp + 8], ecx
call fcn.0040c3c0
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x6e049d
lea eax, [esp + 0x44]
mov dword [esp], eax
call fcn.0040c630
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov ebx, dword [esp + 0x44]
test ebx, ebx
je 0x6e0526
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
lea esi, [eax + 1]
cmp esi, edx
ja 0x6e04e3
mov dword [esp + 0x34], ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edx
lea edx, [ecx + eax*8 + 4]
mov dword [edx], ebx
mov edx, dword [0xa918d0]
lea ebx, [ecx + eax*8]
test edx, edx
jne 0x6e04d8
mov dword [ebx], ebp
jmp 0x6e0485
mov edi, ebx
mov eax, ebp
call fcn.00451480
jmp 0x6e0485
mov dword [esp + 0x38], ebp
mov dword [esp + 0x28], ebx
lea ebx, [0x748600]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], esi
call fcn.0043c860
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea esi, [eax + 1]
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x38]
jmp 0x6e04b5
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x30], edx
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00407f00
mov eax, dword [esp + 0xc]
lea ecx, [0x831140]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0048c950
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x84], eax
add esp, 0x74
ret
call fcn.0044fc40
jmp fcn.006e0430
Function at 0x6fc350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6fc5b5
sub esp, 0x74
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov ecx, dword [esp + 0x7c]
mov dword [esp + 4], ecx
call fcn.006f6ae0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
test ecx, ecx
jne 0x6fc56d
mov dword [esp + 0x48], eax
mov dword [esp + 0x20], 0xc
lea ecx, [0x7c37c0]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x20]
mov dword [esp], ecx
call fcn.0042a4a0
test eax, eax
jne 0x6fc563
mov edx, dword [esp + 0x48]
mov ebx, dword [edx + 0x20]
xor eax, eax
xor ecx, ecx
jmp 0x6fc406
inc eax
mov edx, ebp
mov dword [esp + 0x1c], ecx
cmp eax, ebx
jge 0x6fc445
mov ebp, dword [edx + 0x1c]
mov esi, edx
mov edx, dword [edx + 0x20]
cmp eax, edx
jae 0x6fc5ad
mov edx, dword [ebp + eax*4]
test byte [edx], al
lea edi, [esp + 0x4c]
mov ebp, esi
mov esi, edx
call fcn.00451bdc
mov ecx, dword [esp + 0x5c]
add ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x1c]
cmp ecx, edx
ja 0x6fc403
mov ecx, edx
jmp 0x6fc403
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
call fcn.005a0700
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
test ebx, ebx
jne 0x6fc52a
mov ebx, dword [esp + 0x1c]
cmp ebx, ecx
ja 0x6fc5a6
sub ecx, ebx
sub eax, ebx
mov ebp, eax
neg eax
sar eax, 0x1f
and ebx, eax
lea eax, [edx + ebx]
test ecx, ecx
jne 0x6fc4f5
lea eax, [0x75a560]
mov dword [esp], eax
call fcn.0040a580
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x15
lea ecx, [0x7ac024]
mov dword [eax], ecx
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
lea ecx, [0x82d500]
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], eax
nop
call fcn.0042abe0
add esp, 0x74
ret
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], ebp
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
nop
call fcn.0042abe0
add esp, 0x74
ret
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebp
nop
call fcn.0042abe0
add esp, 0x74
ret
nop
call fcn.0042abe0
add esp, 0x74
ret
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
nop
call fcn.0042abe0
add esp, 0x74
ret
mov eax, ebx
call fcn.00451570
mov ecx, edx
call fcn.00451500
nop
call fcn.0044fc40
jmp fcn.006fc350
Function at 0x443c10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8a58
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4d0084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx + 8]
mov dword [edx + 8], 0
mov dword [ebp - 0x18], eax
mov dword [edx + 4], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
lea esi, [ecx + 0x14]
mov dword [ebp - 0x30], eax
push 0x34
mov dword [ebp - 0x24], esi
call fcn.00411df0
mov edi, eax
add esp, 8
mov dword [ebp - 0x2c], edi
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0x444f00
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
call fcn.00473ff0
mov dword [edi + 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [edi + 0x30], eax
mov byte [ebx + 8], 1
mov esi, dword [esi + 0x18]
push 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], edi
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
je 0x443d15
push ecx
push edi
mov ecx, esi
call fcn.004461c0
jmp 0x443d59
lea eax, [esi + 0x38]
push eax
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x34], 1
mov ecx, dword [ebp - 0x24]
lea eax, [ebx + 0xc]
push edi
push eax
push ebx
mov byte [ebp - 4], 2
call 0x445500
lea ecx, [esi + 0x18]
mov bl, al
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
test bl, bl
je 0x443d4f
mov ecx, esi
call fcn.00431110
lea eax, [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
call fcn.00444e60
mov dword [ebp - 4], 3
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x443da8
or edi, 0xffffffff
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
cmp eax, 1
jne 0x443da8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], edi
cmp edi, 1
jne 0x443da8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004785e6
mov esp, ebp
pop ebp
ret 8