joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427410
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42752c
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x4274a5
cmp cl, 2
je 0x42744d
cmp cl, 3
jne 0x427515
mov byte [eax + 8], 1
jmp 0x427511
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042c050
nop
lea eax, [0xa27fd8]
mov dword [esp], eax
call fcn.00408f90
nop
mov eax, dword [0xa27fa4]
sub eax, dword [0xa27f88]
mov dword [0xa27fa4], eax
mov eax, dword [0xa27f94]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xa27f94], ecx
nop
lea eax, [0xa27fd8]
mov dword [esp], eax
call fcn.00409190
jmp 0x427511
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00413f60
nop
lea eax, [0xa27fd8]
mov dword [esp], eax
call fcn.00408f90
nop
mov eax, dword [0xa27f7c]
sub eax, dword [0xa27f60]
mov dword [0xa27f7c], eax
mov eax, dword [0xa27f6c]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0xa27f6c], ecx
nop
nop
lea eax, [0xa27fd8]
mov dword [esp], eax
call fcn.00409190
add esp, 0x14
ret
lea eax, [0x6bb194]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00433dc0
nop
call fcn.0045e260
jmp fcn.00427410
Function at 0x42c9d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42caa2
sub esp, 0x30
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42ca0d
lea eax, [0x6b910b]
mov dword [esp], eax
mov dword [esp + 4], 0xb
call fcn.004383d0
movzx ecx, byte [esp + 0x40]
mov dword [esp + 8], 0
mov edx, dword [esp + 0x38]
test edx, edx
jne 0x42ca21
test cl, cl
jmp 0x42ca8f
mov ebx, dword fs:[0x14]
mov ebx, dword [ebx]
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045f767
lea ecx, [0x42cab0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x24], ecx
movzx ecx, byte [esp + 0x40]
mov byte [esp + 0x28], cl
lea edx, [esp + 8]
mov dword [esp + 0x2c], edx
lea edx, [esp + 0xc]
mov dword [esp], edx
call fcn.0045e150
movzx ecx, byte [esp + 0x40]
test cl, cl
je 0x42ca96
call fcn.00438500
mov eax, dword [esp + 8]
mov dword [esp + 0x44], eax
add esp, 0x30
ret
call fcn.0045e260
jmp fcn.0042c9d0
Function at 0x42e360
Capabilities:
Hash data using murmur3

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 0xc]
jbe 0x42e593
sub esp, 0x2c
mov eax, dword [esp + 0x30]
lea ecx, [eax + 0x980]
mov edx, dword [eax + 0x978]
mov dword [eax + 0x978], 0
sub edx, ecx
shr edx, 2
mov dword [esp + 0x24], edx
movzx ecx, byte [0xa4399a]
test cl, cl
jne 0x42e3ad
xor ecx, ecx
xor ebx, ebx
jmp 0x42e3e9
xor ecx, ecx
jmp 0x42e3d3
mov dword [esp + 0x28], ecx
mov edx, dword [eax + ecx*4 + 0x980]
mov dword [esp], edx
call fcn.0041c9f0
mov eax, dword [esp + 0x28]
lea ecx, [eax + 1]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
cmp ecx, edx
jl 0x42e3b1
add eax, 0x978
mov dword [esp], eax
call fcn.0042e250
add esp, 0x2c
ret
inc ecx
cmp ecx, edx
jge 0x42e55a
mov ebp, dword [eax + ecx*4 + 0x980]
cmp ebp, 0x1000
jb 0x42e3e8
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp], ebp
mov dword [esp + 4], 0
mov dword [esp + 8], 0
call fcn.00410b60
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
test ecx, ecx
jne 0x42e442
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42e3e8
mov dword [esp + 0x20], ecx
mov ebx, dword [eax + 0x2c]
test byte [ebx], al
nop
mov ebp, edx
shr edx, 3
movzx esi, byte [ebx + edx]
and ebp, 7
mov ecx, ebp
mov edi, 1
shl edi, cl
add edx, ebx
xchg esi, eax
xchg edi, ebx
test bl, al
xchg edi, ebx
xchg esi, eax
je 0x42e482
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42e3e8
mov dword [esp + 0x18], eax
nop
mov dword [esp], edx
xchg edi, eax
mov byte [esp + 4], al
xchg edi, eax
call fcn.004021d0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0xc]
mov edx, dword [0xa23abc]
mov ebx, ecx
shr ecx, 0x16
mov ecx, dword [edx + ecx*4]
test byte [ecx], al
test byte [edx], al
nop
nop
mov edx, ebx
shr ebx, 0x10
and ebx, 0x3f
movzx ebp, byte [ecx + ebx + 0x21840]
lea ecx, [ecx + ebx + 0x21840]
nop
shr edx, 0xd
and edx, 7
mov ebx, ecx
mov ecx, edx
mov esi, 1
shl esi, cl
xchg ebp, eax
xchg esi, ebx
test bl, al
xchg esi, ebx
xchg ebp, eax
jne 0x42e4f5
mov dword [esp], ebx
xchg esi, eax
mov byte [esp + 4], al
xchg esi, eax
call fcn.004021d0
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 0x3a]
test cl, 1
je 0x42e535
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx + 0x964]
mov ebp, dword [ecx + 0x968]
mov eax, dword [eax + 0x40]
add edx, eax
adc ebp, 0
mov dword [ecx + 0x964], edx
mov dword [ecx + 0x968], ebp
mov eax, ecx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x1c]
jmp 0x42e3e8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x30]
mov dword [edx + eax*4 + 0x980], ecx
lea ebx, [eax + 1]
mov eax, edx
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
jmp 0x42e3e8
lea ecx, [eax + 0x95c]
mov dword [esp], ecx
lea ecx, [eax + 0x980]
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0x200
call fcn.00424040
mov eax, dword [esp + 0x30]
add eax, 0x978
mov dword [esp], eax
call fcn.0042e250
add esp, 0x2c
ret
call fcn.0045cc10
jmp fcn.0042e360
Function at 0x44e260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x44e396
sub esp, 0xc
mov eax, dword [esp + 0x10]
movzx edx, byte [eax]
test edx, edx
jne 0x44e2ae
movzx ebx, byte [esp + 0x24]
test bl, bl
jne 0x44e2ae
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov byte [esp + 0x34], 0
add esp, 0xc
ret
test edx, 0x80
je 0x44e2c1
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x44e376
mov ecx, 1
mov ebx, edx
and edx, 1
neg edx
shr ebx, 1
xor edx, ebx
mov ebx, dword [esp + 0x20]
add dword [ebx], edx
mov edx, dword [esp + 0x18]
sub edx, ecx
mov ebx, edx
neg edx
sar edx, 0x1f
and edx, ecx
mov ebp, dword [esp + 0x14]
sub ebp, ecx
lea esi, [eax + edx]
movzx eax, byte [eax + edx]
test eax, 0x80
je 0x44e306
mov dword [esp + 8], ebp
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x44e33f
mov ecx, 1
mov edx, dword [esp + 0x1c]
add dword [edx], eax
sub ebx, ecx
mov eax, ebx
neg ebx
sar ebx, 0x1f
and ebx, ecx
lea edx, [esi + ebx]
mov dword [esp + 0x28], edx
sub ebp, ecx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], eax
mov byte [esp + 0x34], 1
add esp, 0xc
ret
lea edx, [ecx + 7]
mov ecx, ebp
mov ebp, dword [esp + 8]
mov dword [esp + 4], ecx
movzx edi, byte [eax + esi]
xchg edi, eax
mov byte [esp + 3], al
xchg edi, eax
inc eax
and edi, 0x7f
mov ecx, edx
shl edi, cl
mov ebp, dword [esp + 4]
or ebp, edi
movzx edi, byte [esp + 3]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x44e336
mov ecx, eax
mov eax, ebp
mov ebp, dword [esp + 8]
jmp 0x44e30b
lea ebx, [ecx + 7]
mov ecx, esi
movzx ebp, byte [ecx + eax]
lea esi, [ecx + 1]
mov edi, ebp
and ebp, 0x7f
mov ecx, ebx
shl ebp, cl
or edx, ebp
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x44e371
mov ecx, esi
jmp 0x44e2c6
call fcn.0045e260
jmp fcn.0044e260
Function at 0x452310
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x452410
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 0
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0x94], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00452b80
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x679ca0]
mov dword [esp], ecx
call fcn.0040af90
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax], ecx
lea ecx, [0xa28070]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
mov dword [esp + 0xc], 1
call fcn.00451c20
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00451200
add esp, 0x28
ret
call fcn.0045e260
jmp fcn.00452310
Function at 0x455800
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45589f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.0045f767
lea ecx, [0x4558b0]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.0045e150
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.0045e260
jmp fcn.00455800
Function at 0x45f520
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xa43fa0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45dceb
je 0x45dd3e
cmp ebx, 0x20
jbe 0x45dd44
cmp ebx, 0x40
jbe 0x45dd8a
jmp 0x45de2b
test ebx, ebx
je 0x45dd34
add eax, 0x10
test ax, 0xff0
je 0x45dd20
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x897560]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x897760]
jmp 0x45dd08
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45dd08
pxor xmm1, xmmword [0xa43fb0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xa43fb0]
pxor xmm2, xmmword [0xa43fc0]
pxor xmm3, xmmword [0xa43fd0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xa43fb0]
pxor xmm2, xmmword [0xa43fc0]
pxor xmm3, xmmword [0xa43fd0]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45de8a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0xa43999], 0
je 0x45f53a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45dcb0
jmp fcn.004079e0
Function at 0x45f540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x402a1e
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004079e0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.0045e260
jmp 0x4029e0
cmp byte [0xa43999], 0
je 0x45f55b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x45dcb0
jmp 0x4029e0
Function at 0x47b7d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x47b95d
sub esp, 0x50
lea edi, [esp + 0x64]
xor eax, eax
call fcn.0045f76b
mov ecx, dword [esp + 0x58]
cmp ecx, 0x19
je 0x47b801
xor edx, edx
jmp 0x47b82c
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x6bf901]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x19
call fcn.00402870
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x47b837
mov edx, 1
jmp 0x47b86b
cmp ecx, 0x23
je 0x47b840
xor edx, edx
jmp 0x47b86b
mov eax, dword [esp + 0x54]
mov dword [esp], eax
lea ecx, [0x6c4a14]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x23
call fcn.00402870
movzx eax, byte [esp + 0xc]
mov ecx, dword [esp + 0x58]
mov edx, eax
xor eax, eax
test dl, dl
je 0x47b8c5
lea edi, [esp + 0x3c]
call fcn.0045f76b
mov ecx, dword [0xa16f10]
lea edx, [0x895fa0]
mov dword [esp], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 4], edx
mov ebx, dword [esp + 0x60]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
call fcn.00486540
movzx ecx, byte [esp + 0x24]
mov byte [esp + 0x37], cl
lea edi, [esp + 0x3c]
lea esi, [esp + 0x10]
call fcn.0045fc4e
movzx ecx, byte [esp + 0x37]
test cl, cl
jne 0x47b93c
xor eax, eax
mov ecx, dword [esp + 0x58]
lea edi, [esp + 0x3c]
call fcn.0045f76b
mov ecx, dword [0xa16f14]
mov edx, dword [0xa16f10]
mov ebx, dword [esp + 0x54]
mov dword [esp], ebx
mov ebx, dword [esp + 0x58]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x5c]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0x60]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call fcn.0047b970
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x30]
lea edi, [esp + 0x3c]
lea esi, [esp + 0x18]
call fcn.0045fc4e
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.0045fc4e
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
add esp, 0x50
ret
lea edi, [esp + 0x64]
lea esi, [esp + 0x3c]
call fcn.0045fc4e
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
add esp, 0x50
ret
call fcn.0045e260
jmp fcn.0047b7d0
Function at 0x4b1e60
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b2020
sub esp, 0x14
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 1]
mov edx, ecx
shl ecx, 8
shr edx, 0x18
movzx ebx, byte [eax]
add ebx, ecx
adc edx, 0
movzx ecx, byte [eax + 2]
mov ebp, ecx
shl ecx, 0x10
shr ebp, 0x10
add ecx, ebx
adc edx, ebp
movzx ebx, byte [eax + 3]
mov ebp, ebx
shl ebx, 0x18
shr ebp, 8
add ebx, ecx
adc edx, ebp
movzx ecx, byte [eax + 4]
add ebx, 0
adc ecx, edx
movzx edx, byte [eax + 5]
shl edx, 8
add ebx, 0
adc edx, ecx
movzx ecx, byte [eax + 6]
shl ecx, 0x10
add ebx, 0
adc ecx, edx
movzx edx, byte [eax + 7]
shl edx, 0x18
add ebx, 0
adc edx, ecx
movzx ecx, byte [eax + 9]
mov ebp, ecx
shl ecx, 8
shr ebp, 0x18
movzx esi, byte [eax + 8]
add esi, ecx
adc ebp, 0
movzx ecx, byte [eax + 0xa]
mov edi, ecx
shl ecx, 0x10
shr edi, 0x10
add ecx, esi
adc ebp, edi
movzx esi, byte [eax + 0xb]
mov edi, esi
shl esi, 0x18
shr edi, 8
add esi, ecx
adc ebp, edi
movzx ecx, byte [eax + 0xc]
add esi, 0
adc ecx, ebp
movzx ebp, byte [eax + 0xd]
shl ebp, 8
add esi, 0
adc ebp, ecx
movzx ecx, byte [eax + 0xe]
shl ecx, 0x10
add esi, 0
adc ecx, ebp
movzx ebp, byte [eax + 0xf]
shl ebp, 0x18
add esi, 0
mov dword [esp + 4], esi
adc ebp, ecx
mov dword [esp + 0x10], ebp
movzx ecx, byte [eax + 0x11]
mov edi, ecx
shl ecx, 8
shr edi, 0x18
movzx ebp, byte [eax + 0x10]
add ebp, ecx
adc edi, 0
movzx ecx, byte [eax + 0x12]
mov dword [esp + 0xc], ecx
shl ecx, 0x10
mov esi, dword [esp + 0xc]
shr esi, 0x10
add ecx, ebp
adc edi, esi
movzx ebp, byte [eax + 0x13]
mov esi, ebp
shl ebp, 0x18
shr esi, 8
add ebp, ecx
adc edi, esi
movzx ecx, byte [eax + 0x14]
add ebp, 0
adc ecx, edi
movzx esi, byte [eax + 0x15]
shl esi, 8
add ebp, 0
adc esi, ecx
movzx ecx, byte [eax + 0x16]
shl ecx, 0x10
add ebp, 0
adc ecx, esi
movzx esi, byte [eax + 0x17]
shl esi, 0x18
add ebp, 0
mov dword [esp], ebp
adc esi, ecx
mov dword [esp + 8], esi
movzx ecx, byte [eax + 0x19]
mov edi, ecx
shl ecx, 8
shr edi, 0x18
movzx esi, byte [eax + 0x18]
add esi, ecx
adc edi, 0
movzx ecx, byte [eax + 0x1a]
mov dword [esp + 0xc], ecx
shl ecx, 0x10
mov ebp, dword [esp + 0xc]
shr ebp, 0x10
add ecx, esi
adc edi, ebp
movzx eax, byte [eax + 0x1b]
mov ebp, eax
shr eax, 8
shl ebp, 0x18
add ebp, ecx
adc edi, eax
mov eax, dword [esp + 0x18]
mov dword [eax], ebx
mov dword [eax + 4], edx
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ebp
mov dword [eax + 0x1c], edi
add esp, 0x14
ret
call fcn.0045e260
jmp fcn.004b1e60
Function at 0x4b8af0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b8cdd
sub esp, 0x14
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax + 1]
mov edx, ecx
shl ecx, 8
shr edx, 0x18
movzx ebx, byte [eax]
add ebx, ecx
adc edx, 0
movzx ecx, byte [eax + 2]
mov ebp, ecx
shl ecx, 0x10
shr ebp, 0x10
add ecx, ebx
adc edx, ebp
movzx ebx, byte [eax + 3]
mov ebp, ebx
shl ebx, 0x18
shr ebp, 8
add ebx, ecx
adc edx, ebp
movzx ecx, byte [eax + 4]
add ebx, 0
adc ecx, edx
movzx edx, byte [eax + 5]
shl edx, 8
add ebx, 0
adc edx, ecx
movzx ecx, byte [eax + 6]
shl ecx, 0x10
add ebx, 0
adc ecx, edx
movzx edx, byte [eax + 7]
shl edx, 0x18
add ebx, 0
adc edx, ecx
movzx ecx, byte [eax + 9]
mov ebp, ecx
shl ecx, 8
shr ebp, 0x18
movzx esi, byte [eax + 8]
add esi, ecx
adc ebp, 0
movzx ecx, byte [eax + 0xa]
mov edi, ecx
shl ecx, 0x10
shr edi, 0x10
add ecx, esi
adc ebp, edi
movzx esi, byte [eax + 0xb]
mov edi, esi
shl esi, 0x18
shr edi, 8
add esi, ecx
adc ebp, edi
movzx ecx, byte [eax + 0xc]
add esi, 0
adc ecx, ebp
movzx ebp, byte [eax + 0xd]
shl ebp, 8
add esi, 0
adc ebp, ecx
movzx ecx, byte [eax + 0xe]
shl ecx, 0x10
add esi, 0
adc ecx, ebp
movzx ebp, byte [eax + 0xf]
shl ebp, 0x18
add esi, 0
mov dword [esp + 4], esi
adc ebp, ecx
mov dword [esp + 0x10], ebp
movzx ecx, byte [eax + 0x11]
mov edi, ecx
shl ecx, 8
shr edi, 0x18
movzx ebp, byte [eax + 0x10]
add ebp, ecx
adc edi, 0
movzx ecx, byte [eax + 0x12]
mov dword [esp + 0xc], ecx
shl ecx, 0x10
mov esi, dword [esp + 0xc]
shr esi, 0x10
add ecx, ebp
adc edi, esi
movzx ebp, byte [eax + 0x13]
mov esi, ebp
shl ebp, 0x18
shr esi, 8
add ebp, ecx
adc edi, esi
movzx ecx, byte [eax + 0x14]
add ebp, 0
adc ecx, edi
movzx esi, byte [eax + 0x15]
shl esi, 8
add ebp, 0
adc esi, ecx
movzx ecx, byte [eax + 0x16]
shl ecx, 0x10
add ebp, 0
adc ecx, esi
movzx esi, byte [eax + 0x17]
shl esi, 0x18
add ebp, 0
mov dword [esp], ebp
adc esi, ecx
mov dword [esp + 8], esi
movzx ecx, byte [eax + 0x19]
mov edi, ecx
shl ecx, 8
shr edi, 0x18
movzx esi, byte [eax + 0x18]
add esi, ecx
adc edi, 0
movzx ecx, byte [eax + 0x1a]
mov dword [esp + 0xc], ecx
shl ecx, 0x10
mov ebp, dword [esp + 0xc]
shr ebp, 0x10
add ecx, esi
adc edi, ebp
movzx ebp, byte [eax + 0x1b]
mov esi, ebp
shl ebp, 0x18
shr esi, 8
add ebp, ecx
adc edi, esi
movzx ecx, byte [eax + 0x1c]
add ebp, 0
adc ecx, edi
movzx esi, byte [eax + 0x1d]
shl esi, 8
add ebp, 0
adc esi, ecx
movzx ecx, byte [eax + 0x1e]
shl ecx, 0x10
add ebp, 0
adc ecx, esi
movzx eax, byte [eax + 0x1f]
shl eax, 0x18
add ebp, 0
adc eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], edx
mov edx, dword [esp + 4]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x10]
mov dword [ecx + 0xc], edx
mov edx, dword [esp]
mov dword [ecx + 0x10], edx
mov edx, dword [esp + 8]
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x1c], eax
add esp, 0x14
ret
call fcn.0045e260
jmp fcn.004b8af0
Function at 0x4fe570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4fe74c
add esp, 0xffffff80
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x84]
call fcn.0045fc1c
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.004fdb60
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x58]
xor eax, eax
call fcn.0045f766
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x4fe622
mov edx, dword [esp + 0x10]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x4fe6f8
mov dword [esp + 0x10], ecx
imul edx, ecx, 0x33
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
mov dword [esp + 0x1c], edx
and edx, 0xfffffff8
sub ebx, edx
cmp ebx, 0x20
sbb edx, edx
lea esi, [ebx - 0x20]
mov dword [esp + 0x18], esi
cmp esi, 0x20
sbb edi, edi
xchg esi, ebx
neg ebx
xchg esi, ebx
cmp esi, 0x20
sbb eax, eax
mov dword [esp + 0x14], eax
lea ebp, [esp + ecx*8 + 0x58]
mov eax, dword [ebp]
mov dword [esp + 0xc], eax
mov ebp, dword [ebp + 4]
mov ecx, ebx
shl eax, cl
and eax, edx
mov dword [esp + 8], eax
mov byte [esp + 0x20], al
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
shl eax, cl
and eax, edi
mov ecx, esi
mov esi, dword [esp + 0xc]
shr esi, cl
mov edi, dword [esp + 0x14]
and esi, edi
mov ecx, ebx
shl ebp, cl
and ebp, edx
or ebp, esi
or eax, ebp
mov edx, dword [esp + 8]
mov ebx, edx
shr edx, 8
mov ebp, eax
shl eax, 0x18
or eax, edx
mov byte [esp + 0x21], al
mov eax, ebx
shr ebx, 0x10
mov edx, ebp
shl ebp, 0x10
or ebp, ebx
xchg ebp, eax
mov byte [esp + 0x22], al
xchg ebp, eax
mov ebx, edx
shl edx, 8
shr eax, 0x18
or edx, eax
mov byte [esp + 0x23], dl
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x4fe72d
test byte [eax], al
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x94], 0x20
sub esp, 0xffffff80
ret
test byte [eax], al
movzx esi, byte [eax + edx]
or esi, ebx
xchg esi, ebx
mov byte [eax + edx], bl
xchg esi, ebx
inc ecx
mov edx, ebp
cmp ecx, 8
jge 0x4fe61b
movzx ebx, byte [esp + ecx + 0x28]
mov ebp, edx
sar edx, 3
add edx, ecx
cmp edx, 0x20
jl 0x4fe71b
jmp 0x4fe61b
call fcn.0045e260
jmp fcn.004fe570