joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489201
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x48923e
cmp dword [ebp + 0x14], edi
je 0x48923e
cmp ecx, edi
jne 0x489245
call fcn.00490e80
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00489900
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x489259
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x48927a
cmp ebx, 0xffffffff
je 0x489269
push ebx
push edi
push ecx
call fcn.0048b400
add esp, 0xc
cmp esi, edi
je 0x489226
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x489226
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x489296
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x48929d
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x48938e
test word [esi + 0xc], 0x10c
je 0x4892f1
mov eax, dword [esi + 4]
test eax, eax
je 0x4892f1
jl 0x4893ef
cmp ebx, eax
mov edi, ebx
jb 0x4892c2
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x489396
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0048b47a
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x489386
cmp ebx, dword [ebp - 0xc]
jb 0x48935e
cmp dword [ebp - 0xc], 0
je 0x48931b
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x489310
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x489317
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x489326
mov eax, SysReAllocString
cmp ebx, eax
ja 0x489326
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4893c2
push eax
push dword [ebp - 8]
push esi
call fcn.0048d570
pop ecx
push eax
call fcn.004964fa
add esp, 0xc
test eax, eax
je 0x489401
cmp eax, 0xffffffff
je 0x4893ef
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x489386
push esi
call fcn.00495e19
cmp eax, 0xffffffff
pop ecx
je 0x4893f3
cmp dword [ebp - 4], 0
je 0x4893c2
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4892a5
mov eax, dword [ebp + 0x14]
jmp 0x489240
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4893ad
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0048b400
add esp, 0xc
call fcn.00490e80
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x489236
cmp dword [ebp + 0xc], 0xffffffff
je 0x4893d8
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0048b400
add esp, 0xc
call fcn.00490e80
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x489236
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x489240
or dword [esi + 0xc], 0x10
jmp 0x4893f3
Function at 0x48e673
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x48e6a0
call fcn.00490e93
mov dword [eax], esi
call fcn.00490e80
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00489900
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x48e67c
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48e6cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00490ea6
pop ecx
call fcn.00490e80
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x48e6f6
test al, 1
je 0x48e6f6
test byte [esp + 0xc], 2
je 0x48e6f6
call fcn.00490e93
mov dword [eax], 5
call fcn.00490e80
mov dword [eax], 0xd
jmp 0x48e6c6
xor eax, eax
pop esi
ret

Function at 0x48fe65
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d315c]
jne 0x48fe6f
repz ret
jmp fcn.0049efdd

Function at 0x4999b5
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4d3ee8]
je 0x4999d0
inc edi
cmp edi, 0x17
jb 0x4999c1
cmp edi, 0x17
jae 0x499b50
push ebp
push 3
call fcn.004a31bf
cmp eax, 1
pop ecx
je 0x499b1c
push 3
call fcn.004a31bf
test eax, eax
pop ecx
jne 0x499a04
cmp dword [0x4d3158], 1
je 0x499b1c
cmp ebx, 0xfc
je 0x499b4f
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4d82f0
push ebp
call fcn.0048e841
add esp, 0xc
test eax, eax
je 0x499a3a
push esi
push esi
push esi
push esi
push esi
call fcn.00489804
add esp, 0x14
push 0x104
mov esi, 0x4d8309
push esi
push 0
mov byte [0x4d840d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x499a7e
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0048e841
add esp, 0xc
test eax, eax
je 0x499a7e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00489804
add esp, 0x14
push esi
call fcn.004889c0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x499ac3
push esi
call fcn.004889c0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4d8604
push 0x4b1964
sub ecx, eax
push ecx
push eax
call fcn.004a04ed
add esp, 0x14
test eax, eax
je 0x499ac3
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00489804
add esp, 0x14
jmp 0x499ac5
xor esi, esi
push 0x4b1960
push ebx
push ebp
call fcn.004a0852
add esp, 0xc
test eax, eax
je 0x499ae5
push esi
push esi
push esi
push esi
push esi
call fcn.00489804
add esp, 0x14
push dword [edi*8 + 0x4d3eec]
push ebx
push ebp
call fcn.004a0852
add esp, 0xc
test eax, eax
je 0x499b07
push esi
push esi
push esi
push esi
push esi
call fcn.00489804
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004a3002
add esp, 0xc
jmp 0x499b4f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x499b4f
cmp ebp, 0xffffffff
je 0x499b4f
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4d3eec]
push dword [esi]
call fcn.004889c0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4a3002
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0049398d
xor ebx, ebx
cmp dword [0x4d8c48], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4a30d8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4a31b8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4a31b8
push eax
call fcn.0049391f
mov dword [esp], 0x4b1c8c
push edi
mov dword [0x4d8c48], eax
call esi
push eax
call fcn.0049391f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4d8c4c], eax
call esi
push eax
call fcn.0049391f
mov dword [0x4d8c50], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0048f9a4
test eax, eax
pop ecx
pop ecx
je 0x4a30a6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00489804
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4a30d8
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0049391f
cmp eax, ebx
pop ecx
mov dword [0x4d8c58], eax
je 0x4a30d8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0049391f
pop ecx
mov dword [0x4d8c54], eax
mov eax, dword [0x4d8c54]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4a315d
cmp dword [0x4d8c58], ecx
je 0x4a315d
push eax
call fcn.00493996
push dword [0x4d8c58]
mov esi, eax
call fcn.00493996
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4a315d
cmp edi, ebx
je 0x4a315d
call esi
cmp eax, ebx
je 0x4a312a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4a312a
test byte [ebp - 0x18], 1
jne 0x4a315d
lea eax, [ebp - 0x10]
push eax
call fcn.0048f9db
test eax, eax
pop ecx
je 0x4a3145
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00489804
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4a3154
or dword [ebp + 0x10], 0x200000
jmp 0x4a3198
or dword [ebp + 0x10], 0x40000
jmp 0x4a3198
mov eax, dword [0x4d8c4c]
cmp eax, dword [ebp - 8]
je 0x4a3198
push eax
call fcn.00493996
cmp eax, ebx
pop ecx
je 0x4a3198
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4a3198
mov eax, dword [0x4d8c50]
cmp eax, dword [ebp - 8]
je 0x4a3198
push eax
call fcn.00493996
cmp eax, ebx
pop ecx
je 0x4a3198
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d8c48]
call fcn.00493996
cmp eax, ebx
pop ecx
je 0x4a31b8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4a31ba
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4045a1
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4045bf
mov eax, 0x4c5d28
push eax
push 1
mov ebx, 0x424d00
call fcn.00424719
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4045e9
mov eax, 0
jmp 0x40465d
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x40464a
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x404633
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x404622
xor ecx, eax
xor edx, ebx
dec edi
jne 0x404613
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x4148c9
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x4148eb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
mov dword [ebp - 4], 0
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, ioctlsocket
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, cl
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
imul esi, esi, 0x666
mov dword [ebp - 4], esi
nop
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
mov eax, dword [ebp - 4]
jmp 0x414a11
mov esp, ebp
pop ebp
ret
Function at 0x416d2b
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x416f78
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x416e75
cmp byte [edx + edi], 0xd
jne 0x416e75
cmp byte [edx + edi + 1], 0xa
je 0x416eae
mov al, byte [edx + edi]
cmp al, 0xa
je 0x416eae
cmp al, 0x3d
jne 0x416e8a
inc ecx
cmp ecx, 2
ja 0x416f86
cmp al, 0x7f
ja 0x416f86
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x416f86
cmp al, 0x40
jae 0x416ead
test ecx, ecx
jne 0x416f86
inc esi
inc edx
cmp edx, ebx
jb 0x416e5f
test esi, esi
je 0x416f78
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x416f97
cmp dword [ecx], eax
jb 0x416f97
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x416f67
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x416f63
cmp al, 0xa
je 0x416f63
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x416f63
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x416f4e
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x416f5b
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x416f63
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x416eff
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x419669
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x41968c
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x41968c
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x419696
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4196d8
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x41973a
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x419735
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419720
test dl, dl
je 0x41971c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419720
add ecx, 2
add eax, 2
test dl, dl
jne 0x419700
xor eax, eax
jmp 0x419725
sbb eax, eax
or eax, 1
test eax, eax
je 0x419746
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4196ed
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4197cb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4197ee
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4197ee
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4197f8
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x41983a
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x41989c
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x419897
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419882
test dl, dl
je 0x41987e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419882
add ecx, 2
add eax, 2
test dl, dl
jne 0x419862
xor eax, eax
jmp 0x419887
sbb eax, eax
or eax, 1
test eax, eax
je 0x4198a8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x41984f
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x41993a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x41995d
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x41995d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x419967
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4199a9
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x419a0b
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x419a06
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4199f1
test dl, dl
je 0x4199ed
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4199f1
add ecx, 2
add eax, 2
test dl, dl
jne 0x4199d1
xor eax, eax
jmp 0x4199f6
sbb eax, eax
or eax, 1
test eax, eax
je 0x419a17
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4199be
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x419aa4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x419ac7
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x419ac7
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x419ad1
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x419b13
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x419b75
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x419b70
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419b5b
test dl, dl
je 0x419b57
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419b5b
add ecx, 2
add eax, 2
test dl, dl
jne 0x419b3b
xor eax, eax
jmp 0x419b60
sbb eax, eax
or eax, 1
test eax, eax
je 0x419b81
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x419b28
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x419c1a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x419c3d
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x419c3d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x419c47
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x419c89
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x419ceb
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x419ce6
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419cd1
test dl, dl
je 0x419ccd
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419cd1
add ecx, 2
add eax, 2
test dl, dl
jne 0x419cb1
xor eax, eax
jmp 0x419cd6
sbb eax, eax
or eax, 1
test eax, eax
je 0x419cf7
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x419c9e
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x419d8b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x419dae
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x419dae
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x419db8
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x419dfa
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x419e5c
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x419e57
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x419e42
test dl, dl
je 0x419e3e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x419e42
add ecx, 2
add eax, 2
test dl, dl
jne 0x419e22
xor eax, eax
jmp 0x419e47
sbb eax, eax
or eax, 1
test eax, eax
je 0x419e68
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x419e0f
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8