joyce8/EMBER2024-capa huggingface dataset:
Function at 0x557100
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x100000]
push edi
jmp 0x55711a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x557121
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x557110
mov eax, 1
add ebx, ebx
jne 0x557133
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x557144
jne 0x557163
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x557163
dec eax
add ebx, ebx
jne 0x557150
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x557128
add ebx, ebx
jne 0x55715f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5571b5
xor ecx, ecx
sub eax, 3
jb 0x55717b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5571ea
sar eax, 1
mov ebp, eax
jmp 0x557186
add ebx, ebx
jne 0x557186
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x557154
inc ecx
add ebx, ebx
jne 0x557194
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x557154
add ebx, ebx
jne 0x5571a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x557196
jne 0x5571b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x557196
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5571d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5571c6
jmp 0x557116
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5571d4
add edi, ecx
jmp 0x557116
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5571f2
cmp byte [edi], 0x11
jne 0x5571f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5571f7
lea edi, [esi + 0x150000]
mov eax, dword [edi]
or eax, eax
je 0x55726f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d5b24]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d5ca0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x557224
mov ecx, edi
jns 0x557253
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d5ca4]
or eax, eax
je 0x557269
mov dword [ebx], eax
add ebx, 4
jmp 0x557241
call dword [esi + 0x1d5cb4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5572a0
cmp al, 0xef
ja 0x557293
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x557275
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x557282
mov ebp, dword [esi + 0x1d5ca8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5572d4
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x44f920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x24
mov ecx, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
lea eax, [ebx + 3]
xor edx, edx
div esi
mov eax, ebx
movzx edi, byte [ecx + edx]
xor edx, edx
div esi
movzx eax, byte [ecx + edx]
xor edx, edx
shl eax, 0x18
or edi, eax
lea eax, [ebx + 1]
div esi
movzx eax, byte [ecx + edx]
xor edx, edx
shl eax, 0x10
or edi, eax
lea eax, [ebx + 2]
div esi
movzx eax, byte [ecx + edx]
shl eax, 8
or edi, eax
mov eax, dword [ebp + 0x14]
add eax, ebx
add ebx, 4
xor dword [eax], edi
cmp ebx, 0x48
jne 0x44f933
mov eax, dword [esp + 0x40]
lea esi, [esp + 0x20]
mov ecx, ebp
lea ebx, [esp + 0x1c]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
lea eax, [ebp + 0x14]
mov dword [esp], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.0044f7b0
mov ecx, ebp
sub esp, 0x14
mov eax, dword [esp + 0x40]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], eax
lea eax, [ebp + 4]
mov dword [esp], eax
call fcn.0044f7b0
sub esp, 0x14
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x4502e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sub esp, 0x68
movzx eax, byte [esp + 0x7c]
lea edx, [esp + 0x60]
mov dword [esp + 0x44], esp
mov dword [esp + 0x34], 0x567468
mov dword [esp + 0x38], 0x5bfd86
mov dword [esp + 0x3c], edx
mov byte [esp + 0x18], al
lea eax, [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 0x40], 0x4503bd
call fcn.00567748
lea eax, [esp + 0x5f]
mov ecx, dword [esp + 0x70]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 4], 0
mov dword [esp + 0x20], 0xffffffff
add eax, eax
mov dword [esp], eax
call fcn.00567560
sub esp, 0xc
mov eax, dword [esp + 0x78]
test eax, eax
jne 0x450370
lea eax, [esp + 0x1c]
mov dword [esp], eax
call fcn.00567750
mov eax, dword [esp + 0x70]
add esp, 0x68
pop ebp
ret
movzx edx, byte [esp + 0x18]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x70]
mov eax, dword [edx]
mov ecx, dword [eax - 4]
test ecx, ecx
js 0x45039b
mov ecx, edx
mov dword [esp + 0x20], 1
call fcn.00567568
mov edx, dword [esp + 0x70]
mov eax, dword [edx]
mov edx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x74]
mov dword [esp + 4], edx
call fcn.00450270
jmp 0x450352
Function at 0x457640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
sub esp, 0x64
lea edx, [esp + 0x2c]
mov dword [esp + 0x44], 0x567468
lea eax, [esp + 0x60]
mov dword [esp], edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], 0x5bfe3e
mov dword [esp + 0x50], 0x4577dd
mov dword [esp + 0x54], esp
call fcn.00567748
mov eax, dword [esp + 0x74]
test eax, eax
je 0x45779a
cmp dword [esp + 0x74], 1
jbe 0x4576b0
mov eax, dword [esp + 0x74]
sub eax, 1
test dword [esp + 0x74], eax
jne 0x4576b0
mov ecx, dword [esp + 0x70]
mov edx, dword [ecx + 4]
test edx, edx
je 0x4576c9
mov ecx, dword [esp + 0x70]
mov edx, dword [ecx]
and eax, dword [edx]
mov dword [esp + 0x20], eax
jmp 0x4576d1
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x70]
mov eax, dword [eax + 4]
mov ebx, dword [ebx]
test eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
jne 0x4576f0
mov dword [esp + 0x20], 0
lea ecx, [esp + 0x2c]
mov dword [esp], ecx
call fcn.00567750
mov eax, dword [esp + 0x20]
add esp, 0x64
pop ebx
pop ebp
ret
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [eax + ebx*4 - 4]
test eax, eax
je 0x457770
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], 0
xor eax, eax
sub dword [esp + 0x18], 1
xor edx, edx
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x24], ecx
jbe 0x457726
mov ebx, dword [esp + 0x28]
mov edx, dword [ebx + ecx*4]
mov ecx, dword [esp + 0x74]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.004575f0
mov ebx, dword [esp + 0x18]
test ebx, ebx
jne 0x45770e
test eax, eax
mov dword [esp + 0x20], eax
je 0x4576d1
mov ebx, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
mov ecx, dword [ebx + 0x10]
sub eax, dword [esp + 0x20]
test ecx, ecx
cmovne eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
jmp 0x4576d1
mov edx, dword [esp + 0x24]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
sub eax, 1
je 0x4576c9
mov ebp, dword [edx + eax*4 - 4]
test ebp, ebp
je 0x457780
mov dword [esp + 0x18], eax
jmp 0x457704
mov dword [esp], 8
call fcn.00567530
mov dword [esp + 0x30], 1
mov ecx, eax
mov dword [esp + 0x18], eax
call fcn.0058d640
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x58d740
mov dword [esp + 4], 0x62e0fc
mov dword [esp + 0x30], 0xffffffff
mov dword [esp], eax
call fcn.00567540
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00567548
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp], edx
call fcn.00567758
lea esi, [esi]
lea edi, [edi]
Function at 0x45c160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sub esp, 0x68
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x60]
mov dword [esp], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x34], 0x567468
mov dword [esp + 0x38], 0x5bff36
mov dword [esp + 0x40], 0x45c2a5
mov dword [esp + 0x44], esp
call fcn.00567748
mov eax, dword [esp + 0x18]
cmp dword [eax + 8], 0xff00
jne 0x45c22d
mov edx, dword [esp + 0x70]
mov eax, dword [edx]
mov edx, dword [esp + 0x18]
mov dword [edx + 8], eax
mov edx, dword [esp + 0x70]
mov eax, dword [edx + 4]
mov edx, dword [esp + 0x18]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x70]
mov ecx, edx
add ecx, 0x10
add eax, 8
cmp ecx, eax
je 0x45c21a
mov edx, dword [esp + 0x70]
mov eax, dword [edx + 0xc]
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], eax
call fcn.005769c0
sub esp, 4
mov edx, dword [esp + 0x18]
mov eax, dword [edx + 0x14]
mov edx, dword [esp + 0x70]
cmp dword [edx + 0xc], eax
cmovbe eax, dword [edx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edx + 8]
mov edx, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [edx + 0x10]
mov dword [esp], eax
call fcn.0056d278
lea eax, [esp + 0x1c]
mov dword [esp], eax
call fcn.00567750
add esp, 0x68
pop ebp
ret 4
mov dword [esp], 8
call fcn.00567530
mov dword [esp], str.BER_Decoder:_Only_one_push_back_is_allowed
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x5b]
mov dword [esp + 4], eax
mov dword [esp + 0x20], 1
call fcn.005674b8
push eax
push eax
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x5c]
mov dword [esp + 0x20], 2
mov dword [esp], edx
call fcn.00578f10
push eax
lea ecx, [esp + 0x5c]
call fcn.00567508
mov eax, dword [esp + 0x14]
mov dword [esp + 8], 0x578f60
mov dword [esp + 4], 0x62d5b8
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], eax
call fcn.00567540
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x45c2c5
sub eax, 1
je 0x45c2bc
ud2
lea ecx, [esp + 0x5c]
call fcn.00567508
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00567548
mov edx, dword [esp + 0x18]
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], edx
call fcn.00567758
lea esi, [esi]
lea edi, [edi]
Function at 0x45c2f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [esp + 0x84]
mov dword [esp + 0x74], edi
lea edi, [esp + 0x1c]
lea edx, [esp + 0x60]
mov dword [esp], edi
mov dword [esp + 0x78], ebp
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], esi
mov dword [esp + 0x34], 0x567468
mov dword [esp + 0x38], 0x5bff4a
mov dword [esp + 0x40], 0x45c43a
mov dword [esp + 0x44], esp
call fcn.00567748
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x58]
mov dword [esp], eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x58], ebp
call fcn.00568180
test eax, eax
je 0x45c3c2
movzx edx, byte [eax + 0x10]
movzx esi, byte [eax + 0xc]
movzx ebx, byte [eax + 8]
movzx ecx, byte [eax + 4]
add edx, 1
mov ebp, dword [esp + 0x80]
mov edi, edx
movzx edx, byte [eax]
mov eax, dword [eax + 0x14]
mov byte [ebp + 6], bl
mov byte [ebp + 7], cl
add eax, 0x76c
mov byte [ebp + 8], dl
mov dword [ebp], eax
mov eax, edi
mov byte [ebp + 4], al
lea edi, [esp + 0x1c]
mov eax, esi
mov byte [ebp + 5], al
mov dword [esp], edi
call fcn.00567750
mov eax, dword [esp + 0x80]
mov ebx, dword [esp + 0x6c]
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
mov ebp, dword [esp + 0x78]
add esp, 0x7c
ret
mov dword [esp], 8
call fcn.00567530
mov dword [esp], str.time_t_to_tm_could_not_convert
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x57]
mov dword [esp + 4], eax
mov dword [esp + 0x20], 1
call fcn.005674b8
push ecx
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x5c]
mov dword [esp + 0x20], 2
mov dword [esp], eax
call fcn.0057bba0
push edx
lea ecx, [esp + 0x5c]
call fcn.00567508
mov eax, dword [esp + 0x14]
mov dword [esp + 8], fcn.0057bcb0
mov dword [esp + 4], 0x62d858
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], eax
call fcn.00567540
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x18], edx
je 0x45c45a
sub eax, 1
je 0x45c451
ud2
lea ecx, [esp + 0x5c]
call fcn.00567508
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call fcn.00567548
mov edx, dword [esp + 0x18]
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], edx
call fcn.00567758
lea esi, [esi]

Function at 0x466ad0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov ebx, ecx
sub esp, 8
call fcn.00466a90
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0x6a09e667
mov eax, dword [ebx + 0x2c]
mov dword [eax + 4], 0xbb67ae85
mov eax, dword [ebx + 0x2c]
mov dword [eax + 8], 0x3c6ef372
mov eax, dword [ebx + 0x2c]
mov dword [eax + 0xc], 0xa54ff53a
mov eax, dword [ebx + 0x2c]
mov dword [eax + 0x10], 0x510e527f
mov eax, dword [ebx + 0x2c]
mov dword [eax + 0x14], 0x9b05688c
mov eax, dword [ebx + 0x2c]
mov dword [eax + 0x18], 0x1f83d9ab
mov eax, dword [ebx + 0x2c]
mov dword [eax + 0x1c], 0x5be0cd19
add esp, 8
pop ebx
ret
Function at 0x46a0e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sub esp, 0x68
mov edx, dword [esp + 0x78]
mov dword [esp + 0x34], 0x567468
mov eax, dword [esp + 0x74]
mov dword [esp + 0x38], 0x5c04d6
mov dword [esp + 0x40], 0x46a2e3
mov dword [esp + 0x44], esp
mov dword [esp + 0x18], edx
lea edx, [esp + 0x1c]
mov dword [esp], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x3c], eax
call fcn.00567748
lea eax, [esp + 0x57]
mov dword [esp], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp + 0x20], 0xffffffff
call fcn.005675a0
mov edx, dword [esp + 0x70]
mov dword [edx], eax
mov eax, dword [esp + 0x18]
or eax, dword [esp + 0x14]
jne 0x46a194
jmp 0x46a2c6
mov edx, dword [esp + 0x14]
mov dword [esp + 8], 0xa
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00567768
mov dword [esp + 0x18], edx
or edx, eax
mov dword [esp + 0x14], eax
je 0x46a242
mov edx, dword [esp + 0x14]
mov dword [esp + 8], 0xa
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.00567760
mov dword [esp + 0x20], 1
mov dword [esp], eax
call fcn.0045a7f0
mov edx, dword [esp + 0x70]
movsx eax, al
mov dword [esp + 4], eax
lea eax, [esp + 0x58]
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.005be0d0
mov ecx, dword [esp + 0x70]
lea edx, [esp + 0x58]
mov dword [esp + 0x20], 2
mov dword [esp], edx
call fcn.00567588
sub esp, 4
mov eax, 0xffffffff
mov ecx, dword [esp + 0x58]
lock xadd dword [ecx - 4], eax
test eax, eax
jg 0x46a160
lea eax, [esp + 0x57]
sub ecx, 0xc
mov dword [esp], eax
call fcn.00567500
sub esp, 4
jmp 0x46a160
lea edx, [esp + 0x57]
sub ecx, 0xc
mov dword [esp], edx
call fcn.00567500
sub esp, 4
mov edx, dword [esp + 0x70]
mov eax, dword [edx]
mov edx, dword [esp + 0x7c]
cmp edx, dword [eax - 0xc]
jbe 0x46a2b1
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x5c]
mov dword [esp + 4], 0x5c8e88
mov dword [esp], edx
mov dword [esp + 0x20], 1
mov dword [esp + 8], eax
call fcn.005bde60
mov ecx, dword [esp + 0x70]
lea eax, [esp + 0x5c]
mov dword [esp + 0x20], 3
mov dword [esp], eax
call fcn.00567588
sub esp, 4
mov eax, 0xffffffff
mov ecx, dword [esp + 0x5c]
lock xadd dword [ecx - 4], eax
test eax, eax
jle 0x46a230
mov edx, dword [esp + 0x70]
mov eax, dword [edx]
mov edx, dword [esp + 0x7c]
cmp edx, dword [eax - 0xc]
ja 0x46a251
lea eax, [esp + 0x1c]
mov dword [esp], eax
call fcn.00567750
mov eax, dword [esp + 0x70]
add esp, 0x68
pop ebp
ret
mov ecx, dword [esp + 0x70]
mov dword [esp], 0x5c8e88
mov dword [esp + 0x20], 1
call fcn.00567658
jmp 0x46a23f
Function at 0x4736a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sub esp, 0x78
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x44], 0x567468
mov dword [esp + 0x48], 0x5c0722
mov dword [esp + 0x50], 0x473817
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x54], esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call fcn.00567748
cmp dword [esp + 0x90], 0x47ff
ja 0x473796
movzx eax, byte [esp + 0x20]
mov dword [esp + 4], 5
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
mov byte [esp + 0x68], al
movzx eax, byte [esp + 0x24]
mov byte [esp + 0x69], al
movzx eax, byte [esp + 0x28]
mov byte [esp + 0x6a], al
mov eax, dword [esp + 0x90]
sar eax, 8
mov byte [esp + 0x6b], al
movzx eax, byte [esp + 0x90]
mov byte [esp + 0x6c], al
lea eax, [esp + 0x68]
mov dword [esp], eax
call fcn.005a1520
sub esp, 8
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x8c]
mov dword [esp], eax
call fcn.005a1520
sub esp, 8
lea eax, [esp + 0x2c]
mov dword [esp], eax
call fcn.00567750
add esp, 0x78
pop ebp
ret 0x14
mov dword [esp], 0xc
call fcn.00567530
mov dword [esp], str.Record_Writer:_Record_is_too_big
lea ecx, [esp + 0x68]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x67]
mov dword [esp + 4], eax
mov dword [esp + 0x30], 1
call fcn.005674b8
push ecx
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x68]
mov dword [esp], 0x50
mov dword [esp + 4], eax
mov dword [esp + 0x30], 2
call fcn.00579a50
push edx
push edx
lea ecx, [esp + 0x68]
call fcn.00567508
mov eax, dword [esp + 0x18]
mov dword [esp + 8], 0x579aa0
mov dword [esp + 4], 0x62d660
mov dword [esp + 0x30], 0xffffffff
mov dword [esp], eax
call fcn.00567540
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
test eax, eax
je 0x473837
sub eax, 1
je 0x47382e
ud2
lea ecx, [esp + 0x68]
call fcn.00567508
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00567548
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp], eax
call fcn.00567758
nop
nop
lea esi, [esi]
Function at 0x4b8f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
sub esp, 0x68
movzx edx, byte [esp + 0x78]
mov dword [esp + 0x18], ecx
movzx eax, byte [esp + 0x70]
mov dword [esp + 0x44], 0x567468
mov dword [esp + 0x48], 0x5c256e
mov dword [esp + 0x50], 0x4b9092
mov byte [esp + 0x2b], dl
lea edx, [esp + 0x2c]
mov dword [esp], edx
mov byte [esp + 0x20], al
lea eax, [esp + 0x60]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], esp
call fcn.00567748
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.0048e710
mov eax, dword [esp + 0x18]
cmp byte [esp + 0x20], 0
mov edx, dword [esp + 0x18]
mov dword [eax], 0x6327e8
mov eax, 0
cmovne eax, dword [esp + 0x74]
mov dword [edx + 0x34], 0
mov dword [edx + 0x2c], eax
movzx eax, byte [esp + 0x2b]
mov dword [edx + 0x40], 0
mov dword [edx + 0x3c], 0
mov dword [edx + 0x38], 0
and al, byte [esp + 0x20]
mov byte [edx + 0x30], al
add edx, 0x34
mov dword [esp], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x30], 1
call fcn.0049b590
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [edx + 0x40], eax
mov dword [esp], 0x30
call fcn.005769c0
sub esp, 4
mov eax, dword [esp + 0x18]
mov dword [eax + 0x44], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x48], 0
add eax, 0x44
mov dword [esp], 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 2
call fcn.0049b590
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov dword [edx + 0x50], eax
mov dword [esp], 0x40
call fcn.005769c0
sub esp, 4
mov eax, dword [esp + 0x18]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
call fcn.00567750
add esp, 0x68
pop ebp
ret 0xc
Function at 0x4e3170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
sub esp, 0x94
lea edx, [esp + 0x1c]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x90]
mov dword [esp], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x34], 0x567468
mov dword [esp + 0x38], 0x5c3523
mov dword [esp + 0x40], 0x4e33cd
mov dword [esp + 0x44], esp
call fcn.00567748
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x78]
mov dword [esp + 0x20], 0xffffffff
mov dword [esp], eax
call fcn.004c25b0
sub esp, 4
mov eax, dword [esp + 0xa8]
lea ecx, [esp + 0x78]
mov dword [esp + 0x20], 1
mov dword [esp + 4], eax
mov eax, dword [esp + 0xa4]
mov dword [esp], eax
call fcn.004616d0
sub esp, 8
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4e3370
mov ecx, dword [esp + 0x80]
movzx edx, byte [ecx]
shr dl, 7
test dl, dl
mov byte [esp + 0x1b], dl
je 0x4e3270
sub eax, 1
jmp 0x4e322a
mov ecx, dword [esp + 0x80]
sub eax, 1
add ecx, eax
movzx edx, byte [ecx]
lea ebx, [edx - 1]
test dl, dl
mov byte [ecx], bl
jne 0x4e323c
test eax, eax
jne 0x4e3220
mov eax, dword [esp + 0x84]
xor edx, edx
test eax, eax
je 0x4e33bf
lea esi, [esi]
mov eax, dword [esp + 0x80]
add eax, edx
add edx, 1
not byte [eax]
mov eax, dword [esp + 0x84]
cmp eax, edx
jne 0x4e3250
mov ecx, dword [esp + 0x80]
mov dword [esp], ecx
lea ecx, [esp + 0x64]
mov dword [esp + 8], 0x100
mov dword [esp + 4], eax
mov dword [esp + 0x20], 1
call fcn.004e20c0
sub esp, 0xc
mov ecx, dword [esp + 0xa0]
lea eax, [esp + 0x64]
mov dword [esp + 0x20], 3
mov dword [esp], eax
call fcn.00576d10
sub esp, 4
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0xa0]
test ecx, ecx
mov dword [edx + 0x10], eax
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x64]
je 0x4e32d3
test eax, eax
jne 0x4e3320
cmp byte [esp + 0x1b], 0
jne 0x4e3312
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x80]
test ecx, ecx
je 0x4e32f7
test eax, eax
jne 0x4e3350
lea eax, [esp + 0x1c]
mov dword [esp], eax
call fcn.00567750
mov eax, dword [esp + 0x14]
add esp, 0x94
pop ebx
pop ebp
ret 0xc
mov ecx, dword [esp + 0xa0]
call fcn.00453ec0
jmp 0x4e32da
test edx, edx
je 0x4e32d3
mov ebx, dword [ecx]
shl eax, 2
mov dword [esp], edx
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x20], 1
call eax
sub esp, 8
cmp byte [esp + 0x1b], 0
je 0x4e32da
jmp 0x4e3312
test edx, edx
je 0x4e32f7
mov ebx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [ebx + 4]
mov dword [esp + 0x20], 0xffffffff
call eax
sub esp, 8
jmp 0x4e32f7
mov dword [esp], 0
lea ecx, [esp + 0x50]
mov dword [esp + 4], 0
call fcn.004d9f80
sub esp, 8
mov ecx, dword [esp + 0xa0]
lea edx, [esp + 0x50]
mov dword [esp + 0x20], 2
mov dword [esp], edx
call fcn.0058d860
sub esp, 4
lea ecx, [esp + 0x50]
mov dword [esp + 0x20], 1
call fcn.0058d820
jmp 0x4e32da
mov ecx, dword [esp + 0x80]
xor eax, eax
jmp 0x4e3270