joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5feba8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x7664f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
push eax
push ecx
push edi
mov ecx, esi
call fcn.00437b00
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x188], eax
lea eax, [esp + 0x3c]
push eax
mov dword [esi + 0x68], edx
push str.INPUT_TASK
mov dword [esi + 0x6c], ecx
mov edx, 0x2e
push 0xb
mov ecx, esi
mov dword [esi], vtable.kcTaskTop.0
mov word [esi + 0x80], dx
mov dword [esi + 0x184], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0xb
mov dword [esp + 0x2c], str.INPUT_TASK
call fcn.00435cf0
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x40]
mov dword [esp + 0x20], eax
mov dword [esp + 0x40], eax
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x20], ecx
push eax
mov ecx, esi
mov dword [esp + 0x20], 2
call fcn.00436f20
mov ecx, dword [esp + 0x40]
call fcn.0052fd70
lea ecx, [esp + 0x3c]
push ecx
push str.SOUND_TASK
push 0xd
mov ecx, esi
mov dword [esi + 0x78], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0xd
mov dword [esp + 0x2c], str.SOUND_TASK
call fcn.00435cf0
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], 2
call fcn.00436f20
mov ecx, dword [esp + 0x40]
call fcn.0052fd70
mov dword [esi + 0x7c], eax
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 0x14
Function at 0x438519
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
add eax, 0xfffffe39
push esi
mov esi, ecx
cmp eax, 6
ja case.default.0x438525
jmp dword [eax*4 + 0x438628]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x80], ecx
call fcn.004af4d0
push esi
push 0
push 0x438420
mov dword [esi + 0x84], eax
call fcn.0055d673
add esp, 0xc
mov dword [esi + 0x70], eax
mov eax, dword [esi + 0x74]
push 0xffffffffffffffff
push eax
call dword [0x607154]
xor eax, eax
pop esi
ret 0x18
cmp dword [esp + 0x14], 0
je 0x43857f
mov ecx, dword [esi + 0x6c]
push 5
push ecx
call dword [0x607360]
xor eax, eax
pop esi
ret 0x18
mov edx, dword [esi + 0x6c]
push 0
push edx
call dword [0x607360]
xor eax, eax
pop esi
ret 0x18
lea eax, [esp + 0x14]
push eax
push 0
push 0x40e
mov ecx, dword [esi + 0x6c]
push ecx
call dword [0x607370]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov dword [edx], eax
xor eax, eax
pop esi
ret 0x18
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x40b
jmp 0x438605
mov eax, dword [esi + 0x6c]
lea edx, [esp + 0x14]
push edx
push 0
push 0x40c
push eax
call dword [0x607370]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword [ecx], edx
xor eax, eax
pop esi
ret 0x18
lea eax, [esp + 0x14]
push eax
push 0
push 0x40f
jmp 0x43859d
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x410
mov edx, dword [esi + 0x6c]
push edx
call dword [0x607370]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
xor eax, eax
pop esi
ret 0x18
mov eax, 1
pop esi
ret 0x18

Function at 0x43a799
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
add eax, 0xfffffe65
push esi
mov esi, ecx
cmp eax, 3
ja case.default.0x43a7a5
jmp dword [eax*4 + 0x43a83c]
push esi
push 0
push 0x43a6d0
call fcn.0055d673
add esp, 0xc
mov dword [esi + 0x70], eax
mov eax, dword [esi + 0x80]
push 0xffffffffffffffff
push eax
call dword [0x607154]
mov ecx, dword [esi + 0x80]
push ecx
call dword [0x60715c]
xor eax, eax
pop esi
ret 0x18
cmp dword [esp + 0x14], 0
je 0x43a7fa
mov edx, dword [esi + 0x6c]
push 5
push edx
call dword [0x607360]
xor eax, eax
pop esi
ret 0x18
mov eax, dword [esi + 0x6c]
push 0
push eax
call dword [0x607360]
xor eax, eax
pop esi
ret 0x18
mov ecx, dword [esi + 0x6c]
push 0
push 0
push 0x40a
push ecx
call dword [0x607374]
xor eax, eax
pop esi
ret 0x18
mov edx, dword [esp + 0x14]
mov dword [esi + 0x74], edx
xor eax, eax
pop esi
ret 0x18
mov eax, 1
pop esi
ret 0x18
Function at 0x448909
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub eax, 0x132
push esi
mov esi, ecx
je 0x448947
sub eax, 1
je 0x44891c
mov eax, 1
pop esi
ret 0x18
cmp dword [esp + 0x14], 0
je 0x448935
mov eax, dword [esi + 0x6c]
push 5
push eax
call dword [0x607360]
xor eax, eax
pop esi
ret 0x18
mov ecx, dword [esi + 0x6c]
push 0
push ecx
call dword [0x607360]
xor eax, eax
pop esi
ret 0x18
push esi
push 0
push 0x448830
call fcn.0055d673
mov edx, dword [esi + 0x7c]
add esp, 0xc
push 0xffffffffffffffff
push edx
mov dword [esi + 0x70], eax
call dword [0x607154]
xor eax, eax
pop esi
ret 0x18

Function at 0x448e5f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x1068
call fcn.0055d730
mov eax, dword [0x7664f8]
xor eax, esp
mov dword [esp + 0x1064], eax
mov eax, dword [esp + 0x106c]
push esi
mov esi, ecx
cmp dword [esi + 0x84], 0
mov dword [esp + 8], esi
je 0x448f47
push ebx
push ebp
push edi
push 0x481
push eax
call dword [0x607328]
mov ebx, dword [0x607370]
push 0
push 0
mov edi, eax
push 0x1009
push edi
call ebx
mov ecx, dword [esi + 0x84]
call fcn.00510f30
mov ebp, eax
xor esi, esi
test ebp, ebp
jle 0x448f44
lea ecx, [ecx]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x78]
push ecx
mov ecx, dword [edx + 0x84]
push esi
call fcn.00510f60
test eax, eax
je 0x448f44
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x58]
push 0x656dc8
push ecx
mov dword [esp + 0x24], 1
call fcn.0055c6b1
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0
push 0x1007
lea edx, [esp + 0x60]
push edi
mov dword [esp + 0x3c], edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0
call ebx
lea edx, [esp + 0x18]
push edx
push 0
mov eax, 1
push 0x1006
lea ecx, [esp + 0x80]
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], eax
call ebx
inc esi
cmp esi, ebp
jl 0x448eb0
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1068]
pop esi
xor ecx, esp
call fcn.0055c6a2
add esp, 0x1068
ret 4

Function at 0x456460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ff6c8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x7664f8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov ebx, dword [esp + 0x24]
push ebx
call fcn.00455540
mov dword [esp + 0x1c], 0
test ebx, ebx
je 0x4564a5
lea edi, [ebx + 0x28]
jmp 0x4564a7
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4564bf
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::xpressive::regex_error.1.0
mov dword [esi + 0x28], vtable.boost::xpressive::regex_error.0
mov eax, dword [ebx + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x459d10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ffb48
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x7664f8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00451e90
add esp, 8
mov esi, dword [esp + 0x38]
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.004567b0
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0044dd50
mov eax, dword [esp + 0x34]
lea edx, [esi + 0xc]
push edx
push esi
push eax
call fcn.00456c40
add esp, 0xc
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret

Function at 0x46bd2c
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
push ebp
push esi
add eax, 0xfffffed4
push edi
mov esi, ecx
cmp eax, 5
ja case.default.0x46bd17
jmp dword [eax*4 + 0x46beb4]
push ebx
mov ebx, dword [esi]
lea eax, [esp + 0x20]
push eax
push 0
lea edi, [esi + 0x78]
push edi
push 0
push 0xa5
call fcn.004b4470
mov ecx, eax
call fcn.0052fd70
mov ebp, dword [esp + 0x28]
mov edx, dword [ebx + 0x10]
push eax
push ebp
mov ecx, esi
call edx
mov ecx, dword [edi]
pop ebx
test ecx, ecx
je 0x46bea1
call fcn.004f5680
xor ecx, ecx
mov dword [esi + 0x190], eax
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0055a9ff
mov edi, dword [esi]
add esp, 4
mov dword [esi + 0x194], eax
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esi + 0x80]
push ecx
lea edx, [esi + 0x7c]
push edx
push 0xa4
mov ecx, esi
call fcn.004b4470
mov ecx, eax
call fcn.0052fd70
push eax
mov eax, dword [edi + 0x10]
push ebp
mov ecx, esi
call eax
push esi
push 0
push 0x46bc40
call fcn.0055d673
mov ecx, dword [esi + 0x22c]
add esp, 0xc
push 0xffffffffffffffff
push ecx
mov dword [esi + 0x74], eax
call dword [0x607154]
mov edx, dword [esi + 0x22c]
push edx
call dword [0x60715c]
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x18
cmp dword [esp + 0x1c], 0
je 0x46be20
mov eax, dword [esi + 0x70]
push 5
push eax
call dword [0x607360]
cmp dword [esi + 0x78], 0
je 0x46bea1
mov ecx, dword [esi + 0x70]
push 0xc
push 0
push 0x40a
push ecx
call dword [0x607374]
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x18
mov edx, dword [esi + 0x70]
push 0
push edx
call dword [0x607360]
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x18
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x70]
push eax
push 0
push 0x40d
push ecx
call dword [0x607370]
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x18
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 0x70]
push edx
push 0
push 0x40e
push eax
call dword [0x607370]
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x18
mov ecx, dword [esi + 0x70]
push 0
push 0
push 0x40f
push ecx
call dword [0x607370]
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x18
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 0x70]
push edx
push 0
push 0x410
push eax
call dword [0x607370]
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x18
pop edi
pop esi
mov eax, 1
pop ebp
ret 0x18
Function at 0x475560
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x224
mov eax, dword [0x7664f8]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x4bc]
push edi
test eax, eax
jne 0x47558f
mov ecx, dword [esi + 0x80]
call fcn.004ab9f0
mov ecx, dword [esi + 0x4c4]
mov ebx, dword [esp + 0x238]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x4c0]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
xor ecx, ecx
lea ebp, [esi + 0xb8]
mov edx, dword [ebp]
cmp ebx, edx
jae 0x4755c6
xor edx, edx
mov word [esp + ecx*2 + 0x30], dx
jmp 0x4755ec
mov edi, dword [esi + 0x70]
lea eax, [edx + edi]
cmp ebx, eax
jbe 0x4755dc
mov edx, 0x100
mov word [esp + ecx*2 + 0x30], dx
jmp 0x4755ec
mov eax, ebx
sub eax, edx
shl eax, 8
xor edx, edx
div edi
mov word [esp + ecx*2 + 0x30], ax
inc ecx
add ebp, 4
cmp ecx, 0x100
jb 0x4755b6
mov ecx, dword [esi + 0x74]
call fcn.0052e4b0
mov ecx, dword [esp + 0x10]
mov ebx, eax
mov dword [esp + 0x1c], ebx
call fcn.005590d0
mov ecx, dword [esi + 0xa0]
mov dword [esp + 0x28], eax
call fcn.005590d0
mov ecx, dword [esi + 0x74]
mov edi, eax
mov dword [esp + 0x20], edi
call fcn.0052e4a0
mov ecx, dword [esp + 0x10]
mov ebp, eax
call fcn.004b4470
mov ecx, dword [esi + 0xa0]
mov dword [esp + 0x10], eax
call fcn.004b4470
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x2c], eax
call fcn.0052e4c0
mov edx, dword [esi + 0x7c]
add edx, dword [esi + 0x9c]
mov ecx, dword [esi + 0x78]
add ecx, dword [esi + 0x98]
imul edx, ebx
imul eax, ecx
mov ecx, dword [esi + 0x74]
add edx, ebp
lea ebp, [edx + eax]
mov dword [esp + 0x18], ebp
call fcn.0052e4c0
imul eax, dword [esi + 0x98]
mov ecx, dword [esi + 0x9c]
imul ecx, edi
add ecx, dword [esp + 0x2c]
cmp dword [esi + 0x94], 0
lea edi, [ecx + eax]
mov eax, dword [esp + 0x14]
je 0x47570c
test eax, eax
jbe 0x475775
mov dword [esp + 0x14], eax
jmp 0x4756b0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
test edx, edx
jbe 0x4756f5
mov esi, ebp
lea eax, [edi + 3]
sub esi, edi
mov dword [esp + 0x18], edx
jmp 0x4756d0
movzx edx, byte [ecx]
movzx ebx, byte [esi + eax]
movzx edx, word [esp + edx*2 + 0x30]
imul edx, ebx
sar edx, 8
mov byte [eax], dl
add ecx, 4
add eax, 4
sub dword [esp + 0x18], 1
jne 0x4756d0
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
add edi, dword [esp + 0x20]
add ebp, ebx
sub dword [esp + 0x14], 1
jne 0x4756b0
jmp 0x475775
test eax, eax
jbe 0x475775
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
test ecx, ecx
jbe 0x47575c
lea eax, [edi + 3]
sub ebp, edi
jmp 0x475730
movzx edx, byte [esi]
movzx ebx, byte [eax + ebp]
movzx edx, word [esp + edx*2 + 0x30]
imul edx, ebx
sar edx, 8
or bl, 0xff
sub bl, dl
mov byte [eax], bl
add esi, 4
add eax, 4
sub ecx, 1
jne 0x475730
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
add edi, dword [esp + 0x20]
add ebp, ebx
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], ebp
jne 0x475714
mov ecx, dword [esp + 0x230]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0055c6a2
add esp, 0x224
ret 4
Function at 0x475576
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x224
mov eax, dword [0x7664f8]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x4bc]
push edi
test eax, eax
jne 0x47558f
mov ecx, dword [esi + 0x80]
call fcn.004ab9f0
mov ecx, dword [esi + 0x4c4]
mov ebx, dword [esp + 0x238]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x4c0]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
xor ecx, ecx
lea ebp, [esi + 0xb8]
mov edx, dword [ebp]
cmp ebx, edx
jae 0x4755c6
xor edx, edx
mov word [esp + ecx*2 + 0x30], dx
jmp 0x4755ec
mov edi, dword [esi + 0x70]
lea eax, [edx + edi]
cmp ebx, eax
jbe 0x4755dc
mov edx, 0x100
mov word [esp + ecx*2 + 0x30], dx
jmp 0x4755ec
mov eax, ebx
sub eax, edx
shl eax, 8
xor edx, edx
div edi
mov word [esp + ecx*2 + 0x30], ax
inc ecx
add ebp, 4
cmp ecx, 0x100
jb 0x4755b6
mov ecx, dword [esi + 0x74]
call fcn.0052e4b0
mov ecx, dword [esp + 0x10]
mov ebx, eax
mov dword [esp + 0x1c], ebx
call fcn.005590d0
mov ecx, dword [esi + 0xa0]
mov dword [esp + 0x28], eax
call fcn.005590d0
mov ecx, dword [esi + 0x74]
mov edi, eax
mov dword [esp + 0x20], edi
call fcn.0052e4a0
mov ecx, dword [esp + 0x10]
mov ebp, eax
call fcn.004b4470
mov ecx, dword [esi + 0xa0]
mov dword [esp + 0x10], eax
call fcn.004b4470
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x2c], eax
call fcn.0052e4c0
mov edx, dword [esi + 0x7c]
add edx, dword [esi + 0x9c]
mov ecx, dword [esi + 0x78]
add ecx, dword [esi + 0x98]
imul edx, ebx
imul eax, ecx
mov ecx, dword [esi + 0x74]
add edx, ebp
lea ebp, [edx + eax]
mov dword [esp + 0x18], ebp
call fcn.0052e4c0
imul eax, dword [esi + 0x98]
mov ecx, dword [esi + 0x9c]
imul ecx, edi
add ecx, dword [esp + 0x2c]
cmp dword [esi + 0x94], 0
lea edi, [ecx + eax]
mov eax, dword [esp + 0x14]
je 0x47570c
test eax, eax
jbe 0x475775
mov dword [esp + 0x14], eax
jmp 0x4756b0
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
test edx, edx
jbe 0x4756f5
mov esi, ebp
lea eax, [edi + 3]
sub esi, edi
mov dword [esp + 0x18], edx
jmp 0x4756d0
movzx edx, byte [ecx]
movzx ebx, byte [esi + eax]
movzx edx, word [esp + edx*2 + 0x30]
imul edx, ebx
sar edx, 8
mov byte [eax], dl
add ecx, 4
add eax, 4
sub dword [esp + 0x18], 1
jne 0x4756d0
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
add edi, dword [esp + 0x20]
add ebp, ebx
sub dword [esp + 0x14], 1
jne 0x4756b0
jmp 0x475775
test eax, eax
jbe 0x475775
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
test ecx, ecx
jbe 0x47575c
lea eax, [edi + 3]
sub ebp, edi
jmp 0x475730
movzx edx, byte [esi]
movzx ebx, byte [eax + ebp]
movzx edx, word [esp + edx*2 + 0x30]
imul edx, ebx
sar edx, 8
or bl, 0xff
sub bl, dl
mov byte [eax], bl
add esi, 4
add eax, 4
sub ecx, 1
jne 0x475730
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
add edi, dword [esp + 0x20]
add ebp, ebx
sub dword [esp + 0x14], 1
mov dword [esp + 0x18], ebp
jne 0x475714
mov ecx, dword [esp + 0x230]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0055c6a2
add esp, 0x224
ret 4
Function at 0x476bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xbc]
test edi, edi
jne 0x476c10
mov ecx, dword [esi + 0x88]
call fcn.004ab9f0
mov edi, eax
mov ecx, dword [esi + 0x6c]
mov eax, dword [esp + 0x38]
cmp ecx, eax
ja 0x476c1d
mov eax, ecx
shl eax, 8
cdq
idiv ecx
mov ebx, dword [esi + 0xc4]
mov ecx, 0x100
sub ecx, eax
mov eax, dword [esi + 0xc0]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0x70]
mov dword [esp + 0x28], eax
call fcn.0052e4b0
mov ecx, dword [esi + 0x7c]
mov dword [esp + 0x18], eax
call fcn.0052e4b0
mov ecx, edi
mov dword [esp + 0x1c], eax
call fcn.005590d0
mov ecx, dword [esi + 0xa4]
mov dword [esp + 0x30], eax
call fcn.005590d0
mov ecx, dword [esi + 0x70]
mov dword [esp + 0x20], eax
call fcn.0052e4a0
mov ecx, dword [esi + 0x7c]
mov ebp, eax
call fcn.0052e4a0
mov ecx, edi
mov dword [esp + 0x24], eax
call fcn.004b4470
mov ecx, dword [esi + 0xa4]
mov dword [esp + 0x10], eax
call fcn.004b4470
mov ecx, dword [esi + 0x70]
mov dword [esp + 0x38], eax
call fcn.0052e4c0
mov edx, dword [esi + 0x78]
add edx, dword [esi + 0xa0]
mov ecx, dword [esi + 0x74]
add ecx, dword [esi + 0x9c]
imul edx, dword [esp + 0x18]
imul eax, ecx
mov ecx, dword [esi + 0x7c]
add edx, ebp
lea ebp, [edx + eax]
call fcn.0052e4c0
mov edx, dword [esi + 0x84]
add edx, dword [esi + 0xa0]
mov ecx, dword [esi + 0x80]
add ecx, dword [esi + 0x9c]
imul edx, dword [esp + 0x1c]
add edx, dword [esp + 0x24]
imul eax, ecx
mov ecx, dword [esi + 0x70]
lea edi, [edx + eax]
call fcn.0052e4c0
imul eax, dword [esi + 0x9c]
mov ecx, dword [esi + 0xa0]
imul ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x38]
push 0
add ecx, eax
mov dword [esp + 0x3c], ecx
mov ecx, dword [0x7cebe4]
call fcn.004ef650
test ebx, ebx
jbe 0x476d8d
mov dword [esp + 0x24], ebx
nop
mov ebx, dword [esp + 0x28]
test ebx, ebx
jbe 0x476d6e
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
mov esi, ebp
sub edx, edi
sub esi, edi
mov eax, edi
sub ecx, edi
mov dword [esp + 0x14], ebx
mov edi, edi
movzx ebx, byte [edx + eax]
cmp ebx, dword [esp + 0x2c]
jl 0x476d5e
mov ebx, dword [eax]
jmp 0x476d61
mov ebx, dword [esi + eax]
mov dword [ecx + eax], ebx
add eax, 4
sub dword [esp + 0x14], 1
jne 0x476d50
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
add ebp, dword [esp + 0x18]
add edi, dword [esp + 0x1c]
add dword [esp + 0x10], edx
add dword [esp + 0x38], eax
sub dword [esp + 0x24], 1
jne 0x476d30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x476bf5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xbc]
test edi, edi
jne 0x476c10
mov ecx, dword [esi + 0x88]
call fcn.004ab9f0
mov edi, eax
mov ecx, dword [esi + 0x6c]
mov eax, dword [esp + 0x38]
cmp ecx, eax
ja 0x476c1d
mov eax, ecx
shl eax, 8
cdq
idiv ecx
mov ebx, dword [esi + 0xc4]
mov ecx, 0x100
sub ecx, eax
mov eax, dword [esi + 0xc0]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0x70]
mov dword [esp + 0x28], eax
call fcn.0052e4b0
mov ecx, dword [esi + 0x7c]
mov dword [esp + 0x18], eax
call fcn.0052e4b0
mov ecx, edi
mov dword [esp + 0x1c], eax
call fcn.005590d0
mov ecx, dword [esi + 0xa4]
mov dword [esp + 0x30], eax
call fcn.005590d0
mov ecx, dword [esi + 0x70]
mov dword [esp + 0x20], eax
call fcn.0052e4a0
mov ecx, dword [esi + 0x7c]
mov ebp, eax
call fcn.0052e4a0
mov ecx, edi
mov dword [esp + 0x24], eax
call fcn.004b4470
mov ecx, dword [esi + 0xa4]
mov dword [esp + 0x10], eax
call fcn.004b4470
mov ecx, dword [esi + 0x70]
mov dword [esp + 0x38], eax
call fcn.0052e4c0
mov edx, dword [esi + 0x78]
add edx, dword [esi + 0xa0]
mov ecx, dword [esi + 0x74]
add ecx, dword [esi + 0x9c]
imul edx, dword [esp + 0x18]
imul eax, ecx
mov ecx, dword [esi + 0x7c]
add edx, ebp
lea ebp, [edx + eax]
call fcn.0052e4c0
mov edx, dword [esi + 0x84]
add edx, dword [esi + 0xa0]
mov ecx, dword [esi + 0x80]
add ecx, dword [esi + 0x9c]
imul edx, dword [esp + 0x1c]
add edx, dword [esp + 0x24]
imul eax, ecx
mov ecx, dword [esi + 0x70]
lea edi, [edx + eax]
call fcn.0052e4c0
imul eax, dword [esi + 0x9c]
mov ecx, dword [esi + 0xa0]
imul ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x38]
push 0
add ecx, eax
mov dword [esp + 0x3c], ecx
mov ecx, dword [0x7cebe4]
call fcn.004ef650
test ebx, ebx
jbe 0x476d8d
mov dword [esp + 0x24], ebx
nop
mov ebx, dword [esp + 0x28]
test ebx, ebx
jbe 0x476d6e
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
mov esi, ebp
sub edx, edi
sub esi, edi
mov eax, edi
sub ecx, edi
mov dword [esp + 0x14], ebx
mov edi, edi
movzx ebx, byte [edx + eax]
cmp ebx, dword [esp + 0x2c]
jl 0x476d5e
mov ebx, dword [eax]
jmp 0x476d61
mov ebx, dword [esi + eax]
mov dword [ecx + eax], ebx
add eax, 4
sub dword [esp + 0x14], 1
jne 0x476d50
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
add ebp, dword [esp + 0x18]
add edi, dword [esp + 0x1c]
add dword [esp + 0x10], edx
add dword [esp + 0x38], eax
sub dword [esp + 0x24], 1
jne 0x476d30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4