joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58bc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58bd72
sub esp, 0x28
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov byte [esp + 8], 0x30
call fcn.00544870
movzx eax, byte [esp + 0xc]
test al, al
jne 0x58bc8a
lea eax, [0x687ca0]
mov dword [esp], eax
call fcn.0040af90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x27
lea ecx, [0x6c69bb]
mov dword [eax], ecx
lea ecx, [0x895704]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x58bd5e
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x1b], 0
lea eax, [esp + 0x2c]
mov dword [esp], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x1b]
mov dword [esp + 8], ecx
mov byte [esp + 0xc], 1
call fcn.00544f50
movzx eax, byte [esp + 0x10]
test al, al
je 0x58bd2b
mov edx, dword [esp + 0x38]
mov eax, dword [edx]
movzx ecx, byte [esp + 0x1b]
xor ecx, 0xffffff80
movzx ecx, cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test eax, eax
je 0x58bc8a
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
add esp, 0x28
ret
lea eax, [0x687ca0]
mov dword [esp], eax
call fcn.0040af90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x26
lea ecx, [0x6c6467]
mov dword [eax], ecx
lea ecx, [0x895704]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
add esp, 0x28
ret
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
add esp, 0x28
ret
call fcn.0045e260
jmp fcn.0058bc20
Function at 0x596cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x596eff
sub esp, 0x6c
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0
lea edi, [esp + 0x40]
xor eax, eax
call fcn.0045f765
lea ecx, [0x596f10]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x80]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x94]
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x58], ecx
lea edx, [esp + 0x28]
mov dword [esp + 0x5c], edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x60], edx
mov edx, dword [esp + 0x84]
mov dword [esp + 0x64], edx
lea ebx, [esp + 0x88]
mov dword [esp + 0x68], ebx
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], ecx
call fcn.005891e0
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x18], edx
xor eax, eax
jmp 0x596df5
mov dword [esp + 0x14], eax
mov ebx, dword [ecx + eax*4]
mov ebp, dword [esp + 0x40]
mov dword [esp], 2
mov dword [esp + 4], ebx
lea edx, [esp + 0x40]
call ebp
mov eax, dword [esp + 0x14]
inc eax
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
cmp eax, edx
jl 0x596dcc
mov eax, dword [esp + 0x84]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
call fcn.005891e0
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
xor edx, edx
jmp 0x596e52
mov dword [esp + 0x14], edx
mov ecx, dword [eax + edx*4]
mov ebx, dword [esp + 0x40]
mov dword [esp], 1
mov dword [esp + 4], ecx
lea edx, [esp + 0x40]
call ebx
mov eax, dword [esp + 0x14]
lea edx, [eax + 1]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
jl 0x596e27
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x596e77
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov eax, dword [esp + 0x8c]
test eax, eax
jne 0x596efb
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x596efb
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [0x69c420]
mov dword [esp], eax
lea eax, [esp + 0x30]
mov dword [esp + 4], eax
call fcn.00408750
mov eax, dword [esp + 8]
lea ecx, [0x895bdc]
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
add esp, 0x6c
ret
call fcn.0045e260
jmp fcn.00596cd0
Function at 0x5a2710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5a27d6
sub esp, 8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5a2761
mov ecx, dword [esp + 0xc]
movzx edx, byte [ecx + eax - 1]
movzx ebx, dl
mov ebp, ebx
sub ebx, eax
cmp eax, 0x100
jge 0x5a274c
mov esi, eax
jmp 0x5a2753
mov esi, eax
mov eax, 0x100
mov dword [esp + 4], ebp
mov dword [esp], eax
sar ebx, 0x1f
xor edi, edi
jmp 0x5a27a9
mov dword [esp + 0x18], 0
mov byte [esp + 0x1c], 0
add esp, 8
ret
lea eax, [edi + 1]
sub ebp, edi
xchg ebp, ebx
not ebx
xchg ebp, ebx
sar ebp, 0x1f
sub esi, edi
movzx esi, byte [esi + ecx - 1]
mov edi, ebp
and ebp, edx
and esi, edi
xor ebp, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
and ebx, ebp
mov ebp, dword [esp]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 4]
mov ebp, edi
mov edi, eax
mov eax, dword [esp]
cmp eax, edi
jg 0x5a2772
mov eax, ebx
shl ebx, 4
and eax, ebx
mov ecx, eax
shl eax, 2
and eax, ecx
mov ecx, eax
shl eax, 1
and eax, ecx
sar al, 7
and edx, eax
movzx ecx, dl
inc ecx
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], al
add esp, 8
ret
call fcn.0045e260
jmp fcn.005a2710
Function at 0x5c7760
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x5c7869
sub esp, 0x84
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.0045f758
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x30], 0xc3d2e1f0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov ecx, dword [esp + 0x88]
xor eax, eax
jmp 0x5c7812
mov dword [esp + 0x1c], eax
mov dword [esp + 0x80], ecx
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
lea ebp, [esp + 0x20]
mov dword [esp], ebp
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.00587a00
mov eax, dword [esp + 0x80]
lea ecx, [eax + 0xc]
mov eax, dword [esp + 0x1c]
inc eax
mov edx, dword [esp + 0x8c]
cmp edx, eax
jg 0x5c77d8
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.00587bb0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], edx
add esp, 0x84
ret
call fcn.0045e260
jmp fcn.005c7760
Function at 0x5c7880
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 4]
cmp eax, dword [ecx + 8]
jbe 0x5c7a29
sub esp, 0x84
lea eax, [0x67e920]
mov dword [esp], eax
mov dword [esp + 4], 0x24
mov dword [esp + 8], 0x24
call fcn.00447740
mov eax, dword [esp + 0xc]
mov dword [esp + 0x80], eax
nop
lea edi, [esp + 0x20]
xor eax, eax
call fcn.0045f759
nop
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x5c794d
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x7c], eax
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ebx, dword [eax + 8]
lea ebp, [esp + 0x20]
mov dword [esp], ebp
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
call fcn.005866e0
mov eax, dword [esp + 0x7c]
add eax, 0xc
mov ecx, dword [esp + 0x1c]
inc ecx
mov edx, dword [esp + 0x8c]
cmp edx, ecx
jg 0x5c7919
lea eax, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call fcn.00586890
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x24
jl 0x5c798e
mov ecx, 0x24
mov edx, dword [esp + 0x80]
cmp eax, edx
je 0x5c79a9
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0045fe60
mov eax, dword [esp + 0x88]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 8], eax
call fcn.005c7760
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
cmp ecx, 0x14
jl 0x5c79e0
mov ecx, 0x14
mov edx, dword [esp + 0x80]
lea ebx, [edx + 0x10]
cmp eax, ebx
je 0x5c7a05
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0045fe60
mov edx, dword [esp + 0x80]
mov dword [esp + 0x94], edx
mov dword [esp + 0x98], 0x24
mov dword [esp + 0x9c], 0x24
add esp, 0x84
ret
call fcn.0045e260
jmp fcn.005c7880
Function at 0x5c9e20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5ca000
sub esp, 0x40
lea eax, [0x67e920]
mov dword [esp], eax
mov dword [esp + 4], 0
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x68]
lea ebx, [edx + ecx]
mov dword [esp + 0x34], ebx
mov dword [esp + 8], ebx
call fcn.00447740
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x34]
cmp ecx, edx
ja 0x5c9e76
mov ebx, ecx
jmp 0x5c9ea6
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
lea eax, [0x67e920]
mov dword [esp + 0x10], eax
call fcn.00447800
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edx, ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], eax
mov dword [esp], eax
mov ebp, dword [esp + 0x58]
mov dword [esp + 4], ebp
mov dword [esp + 8], ebx
call fcn.0045fe60
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x68]
lea edx, [ecx + eax]
mov ebx, dword [esp + 0x34]
cmp ebx, edx
jb 0x5c9edf
mov ebp, dword [esp + 0x38]
jmp 0x5c9f19
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
lea eax, [0x67e920]
mov dword [esp + 0x10], eax
call fcn.00447800
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov ebp, eax
mov ebx, ecx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
add eax, ebp
mov dword [esp], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.0045fe60
lea eax, [0x67e920]
mov dword [esp], eax
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
call fcn.00447740
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
movzx ecx, word [esp + 0x44]
mov word [esp], cx
mov ecx, dword [esp + 0x48]
mov dword [esp + 4], ecx
call fcn.005c9d60
mov edx, dword [esp + 8]
mov eax, dword [edx]
mov ecx, dword [str.master_secret]
mov ebx, dword [0xa175ac]
mov ebp, dword [0xa175b0]
mov esi, dword [esp + 0x3c]
mov dword [esp], esi
mov dword [esp + 4], 0x30
mov dword [esp + 8], 0x30
mov edi, dword [esp + 0x4c]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x54]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], ecx
call eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x30
mov dword [esp + 0x78], 0x30
add esp, 0x40
ret
call fcn.0045e260
jmp fcn.005c9e20
Function at 0x5caa50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5cabfa
sub esp, 0x48
movzx eax, word [esp + 0x78]
cmp ax, 0x303
jb 0x5caa7e
movzx ecx, byte [esp + 0x80]
jmp 0x5caa8b
movzx ecx, byte [esp + 0x80]
cmp cl, 0xe4
jne 0x5caac3
mov edx, dword [esp + 0x6c]
test edx, edx
je 0x5cabe1
cmp cl, 0xe4
je 0x5caaa2
cmp ax, 0x303
jmp 0x5caac7
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x48
ret
cmp ax, 0x303
jae 0x5cab55
cmp cl, 0xe3
jne 0x5cab1f
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [eax + 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea edi, [esp]
lea esi, [esp + 0x4c]
call fcn.0045fbfe
call fcn.005ca730
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
mov eax, dword [esp + 0x84]
mov dword [esp], eax
call fcn.0049bcd0
mov eax, dword [esp + 4]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
mov edx, dword [eax + 0x20]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], esi
call edx
mov eax, dword [esp + 0x40]
mov eax, dword [eax + 0x1c]
mov ecx, dword [esp + 0x44]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], edx
add esp, 0x48
ret
lea eax, [0x67e720]
mov dword [esp], eax
lea eax, [0x895000]
mov dword [esp + 4], eax
call fcn.00433690
nop
call fcn.0045e260
jmp fcn.005caa50
Function at 0x5e8fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5e921a
sub esp, 0x44
mov eax, dword [esp + 0x50]
test eax, eax
je 0x5e91d1
mov ecx, dword [esp + 0x4c]
movzx edx, byte [ecx]
mov byte [esp + 0x2f], dl
mov byte [esp], 7
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0xc], eax
call fcn.005e8c50
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
test eax, eax
jne 0x5e9194
mov dword [esp + 0x38], edx
mov eax, dword [esp + 0x48]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x5e90e1
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], edi
sar eax, 0x1f
cmp ebp, eax
seta dl
mov edi, dword [esp + 0x34]
cmp ebx, edi
xchg edi, ebx
seta bl
xchg edi, ebx
cmp ebp, eax
sete al
and eax, edi
or eax, edx
test al, al
jne 0x5e9094
mov edx, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
jmp 0x5e90e1
mov eax, dword [0xa1d998]
mov ecx, dword [0xa1d99c]
mov byte [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
add esp, 0x44
ret
mov eax, esi
sar esi, 0x1f
cmp ebp, esi
sete dl
cmp eax, ebx
setb bl
cmp ebp, esi
xchg ebp, ebx
seta bl
xchg ebp, ebx
and ebx, edx
or ebx, ebp
test bl, bl
je 0x5e9146
mov edx, dword [0xa1d9a0]
mov ebx, dword [0xa1d9a4]
mov byte [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ebx
add esp, 0x44
ret
movzx edx, byte [esp + 0x2f]
test dl, 0x80
setne dl
mov byte [esp + 0x58], dl
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], edi
mov edx, dword [esp + 0x38]
mov dword [esp + 0x64], edx
sub edx, edi
mov ebx, edx
neg edx
sar edx, 0x1f
and edx, edi
add ecx, edx
mov dword [esp + 0x68], ecx
sub eax, edi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
add esp, 0x44
ret
mov byte [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], edx
mov eax, dword [esp + 0x40]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x78], eax
add esp, 0x44
ret
mov ecx, dword [0xa1d9a0]
mov edx, dword [0xa1d9a4]
mov byte [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x44
ret
call fcn.0045e260
jmp fcn.005e8fd0
Function at 0x5fbd10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x5fbf22
sub esp, 0x6c
mov eax, dword [esp + 0x80]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
test ecx, ecx
jne 0x5fbd3d
xor eax, eax
jmp 0x5fbd5c
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], eax
add esp, 0x6c
ret
mov eax, ebx
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x7c]
test ecx, ecx
setne cl
mov edx, dword [esp + 0x78]
test edx, edx
setne dl
or edx, ecx
test dl, dl
je 0x5fbde0
call fcn.00480f00
lea edi, [esp + 0x58]
lea esi, [esp]
call fcn.0045fc4e
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x34], ecx
lea edi, [esp]
lea esi, [esp + 0x58]
call fcn.0045fc4e
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
call fcn.004803d0
lea edi, [esp + 0x44]
lea esi, [esp + 0x1c]
call fcn.0045fc4e
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov eax, dword [eax + 0x28]
mov dword [esp], ecx
lea edi, [esp + 4]
lea esi, [esp + 0x44]
call fcn.0045fc4e
call eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov ecx, dword [ecx + 0x2c]
mov dword [esp], edx
mov edx, dword [esp + 0x8c]
sub edx, eax
mov ebp, edx
neg edx
sar edx, 0x1f
and edx, eax
mov esi, dword [esp + 0x84]
add edx, esi
mov dword [esp + 4], edx
mov edx, dword [esp + 0x88]
sub edx, eax
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebp
call ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x3c], edx
mov ebx, dword [esp + 0x38]
add ebx, eax
mov dword [esp + 0x38], ebx
mov ebp, dword [esp + 0x88]
cmp ebp, ebx
jle 0x5fbe8b
test eax, eax
jg 0x5fbe51
xor eax, eax
jmp 0x5fbe8d
mov eax, dword [0xa1d818]
mov ebx, dword [0xa1d81c]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00464e40
movzx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x88]
jmp 0x5fbe8d
xor eax, eax
test al, al
jne 0x5fbd5a
mov ebp, dword [esp + 0x7c]
test ebp, ebp
xchg ebp, ebx
setne bl
xchg ebp, ebx
mov esi, dword [esp + 0x78]
test esi, esi
xchg esi, ebx
setne bl
xchg esi, ebx
or esi, ebp
xchg esi, eax
test al, al
xchg esi, eax
je 0x5fbee6
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov ecx, dword [ecx + 0x28]
mov dword [esp + 0x30], ecx
mov dword [esp], edx
lea edi, [esp + 4]
xor eax, eax
call fcn.0045f76b
mov ecx, dword [esp + 0x30]
call ecx
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x80]
mov dword [ebp], ecx
mov esi, dword [0xa43e50]
test esi, esi
jne 0x5fbeff
mov dword [ebp + 4], edx
jmp 0x5fbf09
lea edi, [ebp + 4]
mov eax, edx
call fcn.0045f670
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], edx
add esp, 0x6c
ret
call fcn.0045e260
jmp fcn.005fbd10
Function at 0x608ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x609073
sub esp, 0x64
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
test ecx, ecx
jne 0x608f14
nop
mov eax, dword [0xa1c3bc]
lea ecx, [0x896948]
mov ecx, dword [ecx + 0x1c]
mov dword [esp], eax
lea eax, [0x682040]
mov dword [esp + 4], eax
lea eax, [0xa43ac4]
mov dword [esp + 8], eax
call ecx
mov eax, dword [esp + 0x10]
lea ecx, [0x68ba20]
cmp dword [esp + 0xc], ecx
je 0x608f42
xor eax, eax
test eax, eax
je 0x60906f
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x60906f
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x3c]
xor eax, eax
call fcn.0045f76b
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
movzx edx, byte [esp + 0x70]
mov byte [esp + 0x44], dl
lea ebx, [ecx + 0x34]
mov dword [esp + 0x24], ebx
mov dword [esp], ebx
call fcn.00466530
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx + 0x64]
test edx, edx
je 0x608f9d
mov eax, dword [edx]
jmp 0x608f9f
xor eax, eax
test eax, eax
sete al
movzx edx, byte [esp + 0x70]
and edx, eax
mov byte [esp + 0x45], dl
test dl, dl
je 0x609048
lea esi, [ecx + 0x7c]
mov dword [esp + 0x20], esi
lea edi, [esp + 0x28]
call fcn.0045fc4e
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
test ecx, 0x80000000
je 0x608ffb
shl ecx, 1
mov edx, eax
shr eax, 0x1f
or ecx, eax
mov eax, edx
shl edx, 1
mov ebx, ecx
shl ecx, 1
shr edx, 0x1f
or ecx, edx
shr ebx, 0x1f
add ecx, 0xd7b17f80
adc ebx, 0xd
jmp 0x609003
mov ecx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
test ecx, ecx
sete cl
test ebx, ebx
sete dl
and edx, ecx
test dl, dl
je 0x60901a
test eax, 0x3fffffff
je 0x609048
lea edi, [esp + 0x50]
mov esi, dword [esp + 0x20]
call fcn.0045fc4e
lea edi, [esp]
lea esi, [esp + 0x50]
call fcn.0045fc4e
call fcn.00480880
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.004668b0
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [edx]
lea edi, [esp]
lea esi, [esp + 0x3c]
call fcn.0045fc4e
call eax
add esp, 0x64
ret
add esp, 0x64
ret
call fcn.0045e260
jmp fcn.00608ee0
Function at 0x644f00
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x644f4c
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 8]
xor ebp, ebp
jmp 0x644f31
movzx esi, byte [ebx + ebp]
inc ebp
xor ecx, esi
imul ecx, ecx, 0x1000193
cmp edx, ebp
jg 0x644f24
mov dword [eax], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
ret
call fcn.0045e260
jmp fcn.00644f00