joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f497b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 7]
push dword [esp + 5]
not edi
not edi
sub esp, 0x1c
inc di
jmp 0x6f4980
mov di, si
jmp 0x6f4962
pop dword [esp + 0x27]
xchg ah, dh
mov byte [esp + 0x13], ah
mov eax, esi
xchg word [esp + 0x23], di
and edi, ecx
jmp 0x6f49c8
cmc
push dword [esp + 0x2e]
xchg dh, al
pop word [esp + 2]
mov edx, 0xc66c8e74
xchg byte [esp + 0x16], dh
jmp 0x6f49b1

Function at 0x6f515c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [eax + 0xa1]
inc edx
rdtsc
cld
cmc
jmp 0x6f516d
bswap edx
clc
xchg byte [esp + 0x11], al
pop ax
stc
lea eax, [ebx + ebx]
jmp 0x6f522d
not edi
push dword [esp + 6]
mov edx, ecx
and edi, ecx
mov dh, byte [esp + 0xf]
setbe ah
lea esp, [esp + 0xd]
bsr ax, bp
jmp 0x6f51a8
pop dword [esp + 8]
bsf dx, ax
lea edi, [esi*4]
xor eax, esi
mov ax, cx
xchg edi, eax
jmp 0x6f51bf
mov dx, si
pop di
cmp edi, ecx
xchg byte [esp + 4], al
mov dword [esp + 5], ecx
push dword [esp + 6]
jmp 0x6f51ee

Function at 0x6f5896
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
pop dword [esp + 0xa]
pop word [esp + 0x24]
push esp
jmp 0x6f5850
Function at 0x41cd26
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.0048b5e5
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0048b5e5
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
push 0x10
call fcn.0048b5e5
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x48f740
call fcn.0048b5f1
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
je 0x41cde6
mov eax, 0
jmp 0x41cf84
cmp dword [ebp + 0xc], 0
jne 0x41ce1c
mov dword [ebp - 0x1c], esp
mov eax, 0xd
call fcn.0048b5df
cmp dword [ebp - 0x1c], esp
je 0x41ce19
push 0xa0
push 0x401d0af
push 6
call fcn.0048b5d9
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x41ce44
mov eax, 0x647fcb
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x41ce3e
push ebx
call fcn.0048b5eb
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x3d
call fcn.0048b5df
cmp dword [ebp - 0x1c], esp
je 0x41ce79
push 0x104
push 0x401d0af
push 6
call fcn.0048b5d9
add esp, 0xc
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x5f7574
mov eax, 0x3e
call fcn.0048b5df
cmp dword [ebp - 0x1c], esp
je 0x41ceaf
push 0x12e
push 0x401d0af
push 6
call fcn.0048b5d9
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 2
mov dword [ebp - 0x1c], esp
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x3f
call fcn.0048b5df
cmp dword [ebp - 0x1c], esp
je 0x41cf4d
push 0x22c
push 0x401d0af
push 6
call fcn.0048b5d9
add esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 8]
mov eax, 3
call fcn.0048b5df
cmp dword [ebp - 0x1c], esp
je 0x41cf7c
push 0x270
push 0x401d0af
push 6
call fcn.0048b5d9
add esp, 0xc
mov eax, dword [ebp - 0x14]
jmp 0x41cf84
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0048b5eb
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0048b5eb
add esp, 4
mov ebx, dword [ebp - 0x18]
push ebx
call fcn.0048b5eb
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42a4e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x42a4fe
mov eax, 0x5f75ab
push eax
push 1
mov ebx, 0x48bc90
call fcn.0048b5f1
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42a528
mov eax, 0
jmp 0x42a59c
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x42a589
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x42a572
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x42a561
xor ecx, eax
xor edx, ebx
dec edi
jne 0x42a552
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x446da0
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x446fed
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x446eea
cmp byte [edx + edi], 0xd
jne 0x446eea
cmp byte [edx + edi + 1], 0xa
je 0x446f23
mov al, byte [edx + edi]
cmp al, 0xa
je 0x446f23
cmp al, 0x3d
jne 0x446eff
inc ecx
cmp ecx, 2
ja 0x446ffb
cmp al, 0x7f
ja 0x446ffb
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x446ffb
cmp al, 0x40
jae 0x446f22
test ecx, ecx
jne 0x446ffb
inc esi
inc edx
cmp edx, ebx
jb 0x446ed4
test esi, esi
je 0x446fed
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x44700c
cmp dword [ecx], eax
jb 0x44700c
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x446fdc
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x446fd8
cmp al, 0xa
je 0x446fd8
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x446fd8
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x446fc3
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x446fd0
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x446fd8
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x446f74
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x47c89d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x47c8c0
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x47c8c0
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x47c8ca
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x47c90c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x47c96e
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x47c969
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x47c954
test dl, dl
je 0x47c950
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x47c954
add ecx, 2
add eax, 2
test dl, dl
jne 0x47c934
xor eax, eax
jmp 0x47c959
sbb eax, eax
or eax, 1
test eax, eax
je 0x47c97a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x47c921
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x47c9ff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x47ca22
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x47ca22
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x47ca2c
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x47ca6e
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x47cad0
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x47cacb
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x47cab6
test dl, dl
je 0x47cab2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x47cab6
add ecx, 2
add eax, 2
test dl, dl
jne 0x47ca96
xor eax, eax
jmp 0x47cabb
sbb eax, eax
or eax, 1
test eax, eax
je 0x47cadc
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x47ca83
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x47cb6e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x47cb91
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x47cb91
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x47cb9b
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x47cbdd
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x47cc3f
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x47cc3a
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x47cc25
test dl, dl
je 0x47cc21
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x47cc25
add ecx, 2
add eax, 2
test dl, dl
jne 0x47cc05
xor eax, eax
jmp 0x47cc2a
sbb eax, eax
or eax, 1
test eax, eax
je 0x47cc4b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x47cbf2
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x47ccd8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x47ccfb
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x47ccfb
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x47cd05
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x47cd47
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x47cda9
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x47cda4
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x47cd8f
test dl, dl
je 0x47cd8b
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x47cd8f
add ecx, 2
add eax, 2
test dl, dl
jne 0x47cd6f
xor eax, eax
jmp 0x47cd94
sbb eax, eax
or eax, 1
test eax, eax
je 0x47cdb5
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x47cd5c
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x47ce4e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x47ce71
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x47ce71
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x47ce7b
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x47cebd
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x47cf1f
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x47cf1a
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x47cf05
test dl, dl
je 0x47cf01
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x47cf05
add ecx, 2
add eax, 2
test dl, dl
jne 0x47cee5
xor eax, eax
jmp 0x47cf0a
sbb eax, eax
or eax, 1
test eax, eax
je 0x47cf2b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x47ced2
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x47cfbf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x47cfe2
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x47cfe2
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x47cfec
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x47d02e
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x47d090
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x47d08b
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x47d076
test dl, dl
je 0x47d072
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x47d076
add ecx, 2
add eax, 2
test dl, dl
jne 0x47d056
xor eax, eax
jmp 0x47d07b
sbb eax, eax
or eax, 1
test eax, eax
je 0x47d09c
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x47d043
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x47d12e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x47d151
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x47d151
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x47d15b
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x47d19d
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x47d1ff
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x47d1fa
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x47d1e5
test dl, dl
je 0x47d1e1
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x47d1e5
add ecx, 2
add eax, 2
test dl, dl
jne 0x47d1c5
xor eax, eax
jmp 0x47d1ea
sbb eax, eax
or eax, 1
test eax, eax
je 0x47d20b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x47d1b2
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x47d29d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x47d2c0
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x47d2c0
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x47d2ca
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x47d30c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x47d36e
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x47d369
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x47d354
test dl, dl
je 0x47d350
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x47d354
add ecx, 2
add eax, 2
test dl, dl
jne 0x47d334
xor eax, eax
jmp 0x47d359
sbb eax, eax
or eax, 1
test eax, eax
je 0x47d37a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x47d321
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8