joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4711ed
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ea0
push ebx
push esi
push edi
push ebx
push edi
add esp, 4
or ebx, 0x16de5
add ebx, 0x137db
call fcn.00471219
add byte [esi], dh
aas
dec esi
dec ebx
cmp al, byte [esi + 0x3a]
cmp eax, 0x4c4834f
add esp, 4

Function at 0x471219
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x61e3
pop ebx
push eax
sub eax, 0x7101
pop eax
mov dword [ebp - 0x77c], 0
call 0x47123a
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x77c], eax
push esi
and esi, 0x3497
pop esi
push esi
push edx
add esp, 4
sub esi, 0x87c2
call 0x471266
add byte [ecx + eax*2 + 0x3a], cl
aas
inc esi
dec edx
add esp, 4
pop esi
push edx
xor edx, 0xa6a5
xor edx, 0x7bb4
pop edx
push esi
push edx

Function at 0x471266
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x61e3
pop ebx
push eax
sub eax, 0x7101
pop eax
mov dword [ebp - 0x77c], 0
call 0x47123a
mov eax, 0x13379797
pop eax
mov dword [ebp - 0x77c], eax
push esi
and esi, 0x3497
pop esi
push esi
push edx
add esp, 4
sub esi, 0x87c2
call 0x471266
add byte [ecx + eax*2 + 0x3a], cl
aas
inc esi
dec edx
add esp, 4
pop esi
push edx
xor edx, 0xa6a5
xor edx, 0x7bb4
pop edx
push esi
push edx

Function at 0x4712a6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add esi, 0x14dc6
pop esi
push eax
push eax
add esp, 4
add al, 0x81
loopne 0x47127a
inc esi
add byte [eax], al
add al, 0x81
loopne 0x47127a
inc esi
add byte [eax], al
add eax, 0xdf2d
pop eax
push esi
call 0x4712a6
add byte [ebx], bh
cmp eax, 0x41353442
dec eax
dec esi
cmp eax, 0x5e04c483
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x10
mov byte [ebp - 0xbe1], 0x10
mov byte [ebp - 0xbe0], 0x10
mov byte [ebp - 0xbdf], 0x10
mov byte [ebp - 0xbde], 0x5a
push ecx
add ecx, 0x61e7
or ecx, 0xd1bd
pop ecx
push esi
call 0x4712f7
add byte [esi], dh
dec eax
cmp dword [edi + 0x38], eax
xor eax, 0x4c48333
and esi, 0x3aff
pop esi
push ebx
push esi
add esp, 4
add ebx, 0x172ce
into
jb 0x47130c
invalid

Function at 0x4712f7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add esi, 0x14dc6
pop esi
push eax
push eax
add esp, 4
add al, 0x81
loopne 0x47127a
inc esi
add byte [eax], al
add al, 0x81
loopne 0x47127a
inc esi
add byte [eax], al
add eax, 0xdf2d
pop eax
push esi
call 0x4712a6
add byte [ebx], bh
cmp eax, 0x41353442
dec eax
dec esi
cmp eax, 0x5e04c483
mov byte [ebp - 0xbe4], 0x52
mov byte [ebp - 0xbe3], 0xb9
mov byte [ebp - 0xbe2], 0x10
mov byte [ebp - 0xbe1], 0x10
mov byte [ebp - 0xbe0], 0x10
mov byte [ebp - 0xbdf], 0x10
mov byte [ebp - 0xbde], 0x5a
push ecx
add ecx, 0x61e7
or ecx, 0xd1bd
pop ecx
push esi
call 0x4712f7
add byte [esi], dh
dec eax
cmp dword [edi + 0x38], eax
xor eax, 0x4c48333
and esi, 0x3aff
pop esi
push ebx
push esi
add esp, 4
add ebx, 0x172ce
into
jb 0x47130c
invalid
Function at 0x471308
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
into
jb 0x47130c
add byte [ebx - 0x3a], bl
test dword [esp + esi*8], esp
invalid
pop ebx
mov byte [ebp - 0xbdc], 0x52
mov byte [ebp - 0xbdb], 0xb9
mov byte [ebp - 0xbda], 0x20
mov byte [ebp - 0xbd9], 0x20
mov byte [ebp - 0xbd8], 0x20
mov byte [ebp - 0xbd7], 0x20
mov byte [ebp - 0xbd6], 0x5a
push edx
push ebx
add esp, 4
add edx, 0x117c3
jmp 0x471352
and edx, 0xc69e
pop edx
push ecx
call 0x471366
add byte [ebx + edi + 0x37], al
inc edi
dec esi
dec eax
add esp, 4
and ecx, 0x8ab4
pop ecx
mov dword [ebp - 0x1e48], 0xe
push esi
and esi, 0x525e
add esi, 0xcc97
pop esi
push esi
push edx
add esp, 4
sub esi, 0x8814
sub esi, 0x171fb
sub esi, 0x14af
pop esi
push ecx
push eax
add esp, 4
sub ecx, 0x421f
pop ecx
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0xbe4]
mov dword [ebp - 0x15d8], edx
push ecx
push eax
add esp, 4
and ecx, 0xf41
jmp 0x4713d2
and ecx, 0x10e79

Function at 0x471366
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
into
jb 0x47130c
add byte [ebx - 0x3a], bl
test dword [esp + esi*8], esp
invalid
pop ebx
mov byte [ebp - 0xbdc], 0x52
mov byte [ebp - 0xbdb], 0xb9
mov byte [ebp - 0xbda], 0x20
mov byte [ebp - 0xbd9], 0x20
mov byte [ebp - 0xbd8], 0x20
mov byte [ebp - 0xbd7], 0x20
mov byte [ebp - 0xbd6], 0x5a
push edx
push ebx
add esp, 4
add edx, 0x117c3
jmp 0x471352
and edx, 0xc69e
pop edx
push ecx
call 0x471366
add byte [ebx + edi + 0x37], al
inc edi
dec esi
dec eax
add esp, 4
and ecx, 0x8ab4
pop ecx
mov dword [ebp - 0x1e48], 0xe
push esi
and esi, 0x525e
add esi, 0xcc97
pop esi
push esi
push edx
add esp, 4
sub esi, 0x8814
sub esi, 0x171fb
sub esi, 0x14af
pop esi
push ecx
push eax
add esp, 4
sub ecx, 0x421f
pop ecx
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0xbe4]
mov dword [ebp - 0x15d8], edx
push ecx
push eax
add esp, 4
and ecx, 0xf41
jmp 0x4713d2
and ecx, 0x10e79
Function at 0x47164a
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub edx, 0x16e1c
pop edx
push eax
xor eax, 0x8f0a
add eax, 0x799d
or eax, 0x16a07
pop eax
mov ecx, dword [ebp - 0xcbc]
sub ecx, 1
mov dword [ebp - 0xcbc], ecx
mov edx, dword [ebp - 0xaec]
add edx, 1
mov dword [ebp - 0xaec], edx
mov eax, dword [ebp - 0xae8]
add eax, 1
mov dword [ebp - 0xae8], eax
jmp 0x471575
Function at 0x471840
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x4f8]
add ecx, 1
mov dword [ebp - 0x4f8], ecx
push edx
jmp 0x471847
pop edx
push edi
push esi
add esp, 4
xor edi, 0x5656
call 0x471862
add byte [edi + 0x3d], al
inc esp
dec ebp
dec edx
cmp al, byte [eax + 0x3f]
inc ebx
add esp, 4
pop edi
mov edx, dword [ebp - 0x4f8]
sub edx, dword [ebp - 0x77c]
cmp edx, 0xffffffff
jb 0x4718ae
push ebx
add ebx, 0x5207
and ebx, 0x10d5f
and ebx, 0xfa97
pop ebx
push edi
push eax
add esp, 4
call 0x47189f
add byte [eax + 0x4b], dl
cmp byte [ecx + 0x35], cl
inc eax
cmp byte [ebx], bh
cmp byte [ebx - 0x107efb3c], al
inc eax
clc
add byte [eax], al
pop edi
jmp 0x471adc
mov dword [ebp - 0xcc4], 7
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xae4], eax
push edi
jmp 0x4718cc
and edi, 0xb70b
pop edi
push ebx
or ebx, 0x17f2b
pop ebx
push ecx
call 0x4718ec
add byte [0x3b434c4b], bh
push eax
xor al, 0x4b
dec eax
dec edi
add esp, 4
xor ecx, 0x14a2d
pop ecx
mov ecx, dword [ebp - 0x15e4]
mov dword [ebp - 0xae0], ecx
mov dword [ebp - 0xcc8], 0
mov edx, dword [ebp - 0x4f8]
cmp edx, dword [ebp - 0x15e4]
jne 0x47195d
push ecx
and ecx, 0xe9ad
xor ecx, 0x91d3
xchg ecx, eax
add byte [eax], al
call 0x471934
add byte [esi], dh
aas
dec ecx
cmp cl, byte [ebp + 0x3d]
cmp eax, 0x8104c483
leave
and eax, 0x590000e4
push ecx
or ecx, 0xb3cc
and ecx, 0x6c0
pop ecx
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0x15ec], eax
jmp 0x471a8e
cmp dword [ebp - 0xcc4], 0
jle 0x471a82
push ebx
push edx
add esp, 4
sub ebx, 0x160e7
pop ebx
push ebx
push ebx
add esp, 4
sub ebx, 0xad01
invalid
jecxz 0x4719ef
Function at 0x471862
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x4f8]
add ecx, 1
mov dword [ebp - 0x4f8], ecx
push edx
jmp 0x471847
pop edx
push edi
push esi
add esp, 4
xor edi, 0x5656
call 0x471862
add byte [edi + 0x3d], al
inc esp
dec ebp
dec edx
cmp al, byte [eax + 0x3f]
inc ebx
add esp, 4
pop edi
mov edx, dword [ebp - 0x4f8]
sub edx, dword [ebp - 0x77c]
cmp edx, 0xffffffff
jb 0x4718ae
push ebx
add ebx, 0x5207
and ebx, 0x10d5f
and ebx, 0xfa97
pop ebx
push edi
push eax
add esp, 4
call 0x47189f
add byte [eax + 0x4b], dl
cmp byte [ecx + 0x35], cl
inc eax
cmp byte [ebx], bh
cmp byte [ebx - 0x107efb3c], al
inc eax
clc
add byte [eax], al
pop edi
jmp 0x471adc
mov dword [ebp - 0xcc4], 7
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xae4], eax
push edi
jmp 0x4718cc
and edi, 0xb70b
pop edi
push ebx
or ebx, 0x17f2b
pop ebx
push ecx
call 0x4718ec
add byte [0x3b434c4b], bh
push eax
xor al, 0x4b
dec eax
dec edi
add esp, 4
xor ecx, 0x14a2d
pop ecx
mov ecx, dword [ebp - 0x15e4]
mov dword [ebp - 0xae0], ecx
mov dword [ebp - 0xcc8], 0
mov edx, dword [ebp - 0x4f8]
cmp edx, dword [ebp - 0x15e4]
jne 0x47195d
push ecx
and ecx, 0xe9ad
xor ecx, 0x91d3
xchg ecx, eax
add byte [eax], al
call 0x471934
add byte [esi], dh
aas
dec ecx
cmp cl, byte [ebp + 0x3d]
cmp eax, 0x8104c483
leave
and eax, 0x590000e4
push ecx
or ecx, 0xb3cc
and ecx, 0x6c0
pop ecx
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0x15ec], eax
jmp 0x471a8e
cmp dword [ebp - 0xcc4], 0
jle 0x471a82
push ebx
push edx
add esp, 4
sub ebx, 0x160e7
pop ebx
push ebx
push ebx
add esp, 4
sub ebx, 0xad01
invalid
jecxz 0x4719ef
Function at 0x47189f
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x4f8]
add ecx, 1
mov dword [ebp - 0x4f8], ecx
push edx
jmp 0x471847
pop edx
push edi
push esi
add esp, 4
xor edi, 0x5656
call 0x471862
add byte [edi + 0x3d], al
inc esp
dec ebp
dec edx
cmp al, byte [eax + 0x3f]
inc ebx
add esp, 4
pop edi
mov edx, dword [ebp - 0x4f8]
sub edx, dword [ebp - 0x77c]
cmp edx, 0xffffffff
jb 0x4718ae
push ebx
add ebx, 0x5207
and ebx, 0x10d5f
and ebx, 0xfa97
pop ebx
push edi
push eax
add esp, 4
call 0x47189f
add byte [eax + 0x4b], dl
cmp byte [ecx + 0x35], cl
inc eax
cmp byte [ebx], bh
cmp byte [ebx - 0x107efb3c], al
inc eax
clc
add byte [eax], al
pop edi
jmp 0x471adc
mov dword [ebp - 0xcc4], 7
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xae4], eax
push edi
jmp 0x4718cc
and edi, 0xb70b
pop edi
push ebx
or ebx, 0x17f2b
pop ebx
push ecx
call 0x4718ec
add byte [0x3b434c4b], bh
push eax
xor al, 0x4b
dec eax
dec edi
add esp, 4
xor ecx, 0x14a2d
pop ecx
mov ecx, dword [ebp - 0x15e4]
mov dword [ebp - 0xae0], ecx
mov dword [ebp - 0xcc8], 0
mov edx, dword [ebp - 0x4f8]
cmp edx, dword [ebp - 0x15e4]
jne 0x47195d
push ecx
and ecx, 0xe9ad
xor ecx, 0x91d3
xchg ecx, eax
add byte [eax], al
call 0x471934
add byte [esi], dh
aas
dec ecx
cmp cl, byte [ebp + 0x3d]
cmp eax, 0x8104c483
leave
and eax, 0x590000e4
push ecx
or ecx, 0xb3cc
and ecx, 0x6c0
pop ecx
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0x15ec], eax
jmp 0x471a8e
cmp dword [ebp - 0xcc4], 0
jle 0x471a82
push ebx
push edx
add esp, 4
sub ebx, 0x160e7
pop ebx
push ebx
push ebx
add esp, 4
sub ebx, 0xad01
invalid
jecxz 0x4719ef
Function at 0x4718ec
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x4f8]
add ecx, 1
mov dword [ebp - 0x4f8], ecx
push edx
jmp 0x471847
pop edx
push edi
push esi
add esp, 4
xor edi, 0x5656
call 0x471862
add byte [edi + 0x3d], al
inc esp
dec ebp
dec edx
cmp al, byte [eax + 0x3f]
inc ebx
add esp, 4
pop edi
mov edx, dword [ebp - 0x4f8]
sub edx, dword [ebp - 0x77c]
cmp edx, 0xffffffff
jb 0x4718ae
push ebx
add ebx, 0x5207
and ebx, 0x10d5f
and ebx, 0xfa97
pop ebx
push edi
push eax
add esp, 4
call 0x47189f
add byte [eax + 0x4b], dl
cmp byte [ecx + 0x35], cl
inc eax
cmp byte [ebx], bh
cmp byte [ebx - 0x107efb3c], al
inc eax
clc
add byte [eax], al
pop edi
jmp 0x471adc
mov dword [ebp - 0xcc4], 7
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xae4], eax
push edi
jmp 0x4718cc
and edi, 0xb70b
pop edi
push ebx
or ebx, 0x17f2b
pop ebx
push ecx
call 0x4718ec
add byte [0x3b434c4b], bh
push eax
xor al, 0x4b
dec eax
dec edi
add esp, 4
xor ecx, 0x14a2d
pop ecx
mov ecx, dword [ebp - 0x15e4]
mov dword [ebp - 0xae0], ecx
mov dword [ebp - 0xcc8], 0
mov edx, dword [ebp - 0x4f8]
cmp edx, dword [ebp - 0x15e4]
jne 0x47195d
push ecx
and ecx, 0xe9ad
xor ecx, 0x91d3
xchg ecx, eax
add byte [eax], al
call 0x471934
add byte [esi], dh
aas
dec ecx
cmp cl, byte [ebp + 0x3d]
cmp eax, 0x8104c483
leave
and eax, 0x590000e4
push ecx
or ecx, 0xb3cc
and ecx, 0x6c0
pop ecx
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0x15ec], eax
jmp 0x471a8e
cmp dword [ebp - 0xcc4], 0
jle 0x471a82
push ebx
push edx
add esp, 4
sub ebx, 0x160e7
pop ebx
push ebx
push ebx
add esp, 4
sub ebx, 0xad01
invalid
jecxz 0x4719ef
Function at 0x471924
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x4f8]
add ecx, 1
mov dword [ebp - 0x4f8], ecx
push edx
jmp 0x471847
pop edx
push edi
push esi
add esp, 4
xor edi, 0x5656
call 0x471862
add byte [edi + 0x3d], al
inc esp
dec ebp
dec edx
cmp al, byte [eax + 0x3f]
inc ebx
add esp, 4
pop edi
mov edx, dword [ebp - 0x4f8]
sub edx, dword [ebp - 0x77c]
cmp edx, 0xffffffff
jb 0x4718ae
push ebx
add ebx, 0x5207
and ebx, 0x10d5f
and ebx, 0xfa97
pop ebx
push edi
push eax
add esp, 4
call 0x47189f
add byte [eax + 0x4b], dl
cmp byte [ecx + 0x35], cl
inc eax
cmp byte [ebx], bh
cmp byte [ebx - 0x107efb3c], al
inc eax
clc
add byte [eax], al
pop edi
jmp 0x471adc
mov dword [ebp - 0xcc4], 7
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xae4], eax
push edi
jmp 0x4718cc
and edi, 0xb70b
pop edi
push ebx
or ebx, 0x17f2b
pop ebx
push ecx
call 0x4718ec
add byte [0x3b434c4b], bh
push eax
xor al, 0x4b
dec eax
dec edi
add esp, 4
xor ecx, 0x14a2d
pop ecx
mov ecx, dword [ebp - 0x15e4]
mov dword [ebp - 0xae0], ecx
mov dword [ebp - 0xcc8], 0
mov edx, dword [ebp - 0x4f8]
cmp edx, dword [ebp - 0x15e4]
jne 0x47195d
push ecx
and ecx, 0xe9ad
xor ecx, 0x91d3
xchg ecx, eax
add byte [eax], al
call 0x471934
add byte [esi], dh
aas
dec ecx
cmp cl, byte [ebp + 0x3d]
cmp eax, 0x8104c483
leave
and eax, 0x590000e4
push ecx
or ecx, 0xb3cc
and ecx, 0x6c0
pop ecx
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0x15ec], eax
jmp 0x471a8e
cmp dword [ebp - 0xcc4], 0
jle 0x471a82
push ebx
push edx
add esp, 4
sub ebx, 0x160e7
pop ebx
push ebx
push ebx
add esp, 4
sub ebx, 0xad01
invalid
jecxz 0x4719ef
Function at 0x471934
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [ebp - 0x4f8]
add ecx, 1
mov dword [ebp - 0x4f8], ecx
push edx
jmp 0x471847
pop edx
push edi
push esi
add esp, 4
xor edi, 0x5656
call 0x471862
add byte [edi + 0x3d], al
inc esp
dec ebp
dec edx
cmp al, byte [eax + 0x3f]
inc ebx
add esp, 4
pop edi
mov edx, dword [ebp - 0x4f8]
sub edx, dword [ebp - 0x77c]
cmp edx, 0xffffffff
jb 0x4718ae
push ebx
add ebx, 0x5207
and ebx, 0x10d5f
and ebx, 0xfa97
pop ebx
push edi
push eax
add esp, 4
call 0x47189f
add byte [eax + 0x4b], dl
cmp byte [ecx + 0x35], cl
inc eax
cmp byte [ebx], bh
cmp byte [ebx - 0x107efb3c], al
inc eax
clc
add byte [eax], al
pop edi
jmp 0x471adc
mov dword [ebp - 0xcc4], 7
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0xae4], eax
push edi
jmp 0x4718cc
and edi, 0xb70b
pop edi
push ebx
or ebx, 0x17f2b
pop ebx
push ecx
call 0x4718ec
add byte [0x3b434c4b], bh
push eax
xor al, 0x4b
dec eax
dec edi
add esp, 4
xor ecx, 0x14a2d
pop ecx
mov ecx, dword [ebp - 0x15e4]
mov dword [ebp - 0xae0], ecx
mov dword [ebp - 0xcc8], 0
mov edx, dword [ebp - 0x4f8]
cmp edx, dword [ebp - 0x15e4]
jne 0x47195d
push ecx
and ecx, 0xe9ad
xor ecx, 0x91d3
xchg ecx, eax
add byte [eax], al
call 0x471934
add byte [esi], dh
aas
dec ecx
cmp cl, byte [ebp + 0x3d]
cmp eax, 0x8104c483
leave
and eax, 0x590000e4
push ecx
or ecx, 0xb3cc
and ecx, 0x6c0
pop ecx
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0x15ec], eax
jmp 0x471a8e
cmp dword [ebp - 0xcc4], 0
jle 0x471a82
push ebx
push edx
add esp, 4
sub ebx, 0x160e7
pop ebx
push ebx
push ebx
add esp, 4
sub ebx, 0xad01
invalid
jecxz 0x4719ef

Function at 0x471af0
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or eax, 0x139f4
and eax, 0x4b94
or eax, 0x18f3
pop eax
push ebx
sub ebx, 0x25a2
pop ebx
mov dword [ebp - 0xad8], 0
Function at 0x47242c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x47243f
add byte [esi + eax*2], dh
inc esi
inc edi
dec edi
dec edx
cmp eax, dword [ebp - 0x7d]
les eax, [ebx + ebx*2]
mov ecx, dword [ebp - 0x500]
mov edx, dword [ecx]
mov dword [ebp - 0x500], edx
mov eax, dword [ebp - 0x500]
cmp eax, dword [ebp - 0xce0]
je 0x47246f
mov ecx, dword [ebp - 0x500]
cmp dword [ecx + 0x30], 0
jne 0x47223a
mov dword [ebp - 0x780], 0

Function at 0x47243f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x47243f
add byte [esi + eax*2], dh
inc esi
inc edi
dec edi
dec edx
cmp eax, dword [ebp - 0x7d]
les eax, [ebx + ebx*2]
mov ecx, dword [ebp - 0x500]
mov edx, dword [ecx]
mov dword [ebp - 0x500], edx
mov eax, dword [ebp - 0x500]
cmp eax, dword [ebp - 0xce0]
je 0x47246f
mov ecx, dword [ebp - 0x500]
cmp dword [ecx + 0x30], 0
jne 0x47223a
mov dword [ebp - 0x780], 0
Function at 0x472660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x358]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x78c], eax
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x1d2c]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x1d30]
mov edx, dword [ebp - 0x358]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x1d34], edx
mov dword [ebp - 0x160], 0
jmp 0x4726af
mov eax, dword [ebp - 0x160]
add eax, 1
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x78c]
add ecx, dword [ebp - 0x160]
movsx edx, byte [ecx]
test edx, edx
je 0x472761
mov eax, dword [ebp - 0x160]
movsx ecx, byte [ebp + eax - 0x8b4]
test ecx, ecx
je 0x472761
push edx
push ebx
add esp, 4
call 0x4726f1
add byte [0x47344535], dh
dec ebx
inc ecx
xor al, 0x4e
inc ebp
add esp, 4
jmp 0x4726fd
pop edx
push esi
xor esi, 0xd268
pop esi
push ebx
xor ebx, 0x165a5
pop ebx
mov edx, dword [ebp - 0x78c]
add edx, dword [ebp - 0x160]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x160]
movsx edx, byte [ebp + ecx - 0x8b4]
cmp eax, edx
je 0x472753
mov eax, dword [ebp - 0x78c]
add eax, dword [ebp - 0x160]
movsx ecx, byte [eax]
xor ecx, 0x20
mov edx, dword [ebp - 0x160]
movsx eax, byte [ebp + edx - 0x8b4]
cmp ecx, eax
jne 0x47275a
jmp 0x4726a0
jmp 0x472761
push esi
and esi, 0xf947
pop esi
push eax
or eax, 0xee25
pop eax
push eax
jmp 0x47277a
pop eax
push eax
push ebx
add esp, 4
xor eax, 0x6c4e
add eax, 0x837d
sub eax, 0x16901
pop eax
mov ecx, dword [ebp - 0x78c]
add ecx, dword [ebp - 0x160]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x160]
movsx ecx, byte [ebp + eax - 0x8b4]
cmp edx, ecx
jne 0x4727c0
mov dword [ebp - 0xce4], 0
jmp 0x47282f
push ebx
add ebx, 0x112a
pop ebx
Function at 0x4726f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x358]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x78c], eax
mov ecx, dword [ebp - 0x788]
mov edx, dword [ebp - 0x1d2c]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x1d30]
mov edx, dword [ebp - 0x358]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x1d34], edx
mov dword [ebp - 0x160], 0
jmp 0x4726af
mov eax, dword [ebp - 0x160]
add eax, 1
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x78c]
add ecx, dword [ebp - 0x160]
movsx edx, byte [ecx]
test edx, edx
je 0x472761
mov eax, dword [ebp - 0x160]
movsx ecx, byte [ebp + eax - 0x8b4]
test ecx, ecx
je 0x472761
push edx
push ebx
add esp, 4
call 0x4726f1
add byte [0x47344535], dh
dec ebx
inc ecx
xor al, 0x4e
inc ebp
add esp, 4
jmp 0x4726fd
pop edx
push esi
xor esi, 0xd268
pop esi
push ebx
xor ebx, 0x165a5
pop ebx
mov edx, dword [ebp - 0x78c]
add edx, dword [ebp - 0x160]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x160]
movsx edx, byte [ebp + ecx - 0x8b4]
cmp eax, edx
je 0x472753
mov eax, dword [ebp - 0x78c]
add eax, dword [ebp - 0x160]
movsx ecx, byte [eax]
xor ecx, 0x20
mov edx, dword [ebp - 0x160]
movsx eax, byte [ebp + edx - 0x8b4]
cmp ecx, eax
jne 0x47275a
jmp 0x4726a0
jmp 0x472761
push esi
and esi, 0xf947
pop esi
push eax
or eax, 0xee25
pop eax
push eax
jmp 0x47277a
pop eax
push eax
push ebx
add esp, 4
xor eax, 0x6c4e
add eax, 0x837d
sub eax, 0x16901
pop eax
mov ecx, dword [ebp - 0x78c]
add ecx, dword [ebp - 0x160]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x160]
movsx ecx, byte [ebp + eax - 0x8b4]
cmp edx, ecx
jne 0x4727c0
mov dword [ebp - 0xce4], 0
jmp 0x47282f
push ebx
add ebx, 0x112a
pop ebx
Function at 0x473f9e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 4
xor ebx, 0x101ef
or ebx, 0xa7d7
pop ebx
push edx
add edx, 0x166b5
call fcn.00473f9e
add byte [0x393a3749], bh
inc eax
inc ebp
inc ecx
add esp, 4
add esp, 4
add esp, 4
sub edx, 0x4e14
pop edx
lea edx, [ebp - 0x16c0]
mov dword [ebp - 0xd18], edx
mov eax, dword [ebp - 0x514]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xd14], ecx
xor edx, edx
mov word [ebp - 0x1d4], dx
xor eax, eax
mov word [ebp - 0x34], ax
push ecx
push edi
add esp, 4
add ecx, 0xedd4
call 0x473fed
add byte [ebp + 0x4d], al
aas
xor al, 0x48
aaa
aas
cmp eax, dword [ebx + 0x35]
add esp, 4
pop ecx
push edi
call 0x474000
add byte [esi + 0x37], cl
inc ecx
dec ebx
dec ebx
inc ecx
dec ecx
dec ecx
add esp, 4
pop edi
mov ecx, dword [ebp - 0xd14]
mov dx, word [ecx]
mov word [ebp - 0x10ae], dx
mov eax, dword [ebp - 0xd14]
add eax, 2
mov dword [ebp - 0xd14], eax
mov cx, word [ebp - 0x10ae]
mov word [ebp - 0x1d4], cx
mov edx, dword [ebp - 0xd18]
mov ax, word [edx]
mov word [ebp - 0x10b0], ax
mov ecx, dword [ebp - 0xd18]
add ecx, 2
mov dword [ebp - 0xd18], ecx
mov dx, word [ebp - 0x10b0]
mov word [ebp - 0x34], dx
push esi
push ecx
add esp, 4
sub esi, 0x52b3
sub esi, 0x11460
and esi, 0x1e30
pop esi
push ebx
sub ebx, 0xc0e8
jmp 0x47407f
jmp 0x474086
or ebx, 0x5a71
pop ebx
movzx eax, word [ebp - 0x34]
test eax, eax
jne 0x4740aa
movzx ecx, word [ebp - 0x1d4]
movzx edx, word [ebp - 0x34]
sub ecx, edx
mov dword [ebp - 0x165c], ecx
jmp 0x474104
movzx eax, word [ebp - 0x1d4]
movzx ecx, word [ebp - 0x34]
cmp eax, ecx
je 0x473fd2
movzx edx, word [ebp - 0x1d4]
xor edx, 0x20
movzx eax, word [ebp - 0x34]
cmp edx, eax
je 0x473fd2
movzx ecx, word [ebp - 0x1d4]
movzx edx, word [ebp - 0x34]
cmp ecx, edx
jge 0x4740ee
mov dword [ebp - 0x1658], 0xffffffff
jmp 0x4740f8
mov dword [ebp - 0x1658], 1
mov eax, dword [ebp - 0x1658]
mov dword [ebp - 0x165c], eax
cmp dword [ebp - 0x165c], 0
jne 0x47414d
push edi
push ebx
add esp, 4
jmp 0x47411b
xor edi, 0x10a4e
call 0x47412d
add byte [ebp + 0x49], cl
xor edi, dword [ecx]
inc edx
inc ebp
add esp, 4
sub edi, 0x15765
pop edi
push ecx
sub ecx, 0x10ac4
pop ecx
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2c0], ecx
jmp 0x4741b5
push edx
push edi
add esp, 4
sub edx, 0x4be5
sub edx, 0xb75c
sub edx, 0x6776
call 0x474170
add byte [ebx], dh
cmp byte [esi + 0x4b], al
cmp byte [0x5a04c483], bh
push ebx
push eax
add esp, 4
jmp 0x47417e
pop ebx
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xd1c]
je 0x4741ab
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x473f76
mov dword [ebp - 0x2c0], 0