joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426a1a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43c4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
push 2
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x426aac
mov ecx, dword [ebp - 0x210]
cmp ecx, 4
jb 0x426aac
shr ecx, 1
push 0xffffffffffffffff
cmp word [ebp + ecx*2 - 0x210], 0x5c
sete al
lea eax, [eax*2 + str.Microsoft_SharedOffice16_]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
lea ecx, [ebp - 0x20c]
mov edx, esi
call fcn.0042695c
jmp 0x426aae
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004282ce
mov esp, ebp
pop ebp
ret

Function at 0x426add
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43c4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
push 2
push esi
push str.SoftwareMicrosoftOffice16.0CommonFilesPaths
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x426b3c
cmp dword [ebp - 0x210], 4
jb 0x426b3c
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.0042695c
jmp 0x426b3e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004282ce
mov esp, ebp
pop ebp
ret
Function at 0x426f07
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x43c4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x208
mov dword [ebp - 0x214], 1
push esi
xor ebx, ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
mov edi, ecx
call sub.VCRUNTIME140.dll_memset
mov edx, 0x4452c0
mov dword [ebp - 0x210], esi
add esp, 0xc
mov ecx, ebx
mov eax, edx
cmp dword [eax], ebx
je 0x426f64
add eax, 0x14
inc ecx
cmp eax, 0x4452e8
jl 0x426f50
jmp 0x4270d1
imul esi, ecx, 0x14
add esi, edx
je 0x4270d1
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4270ba
cmp dword [ebp - 0x214], 1
jne 0x4270ba
cmp word [ebp - 0x20c], bx
je 0x4270ba
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x4270ba
shr eax, 1
mov dword [ebp - 0x210], eax
cmp eax, 0x104
jae 0x426fe5
add eax, eax
cmp eax, 0x208
jae 0x4270e4
xor ecx, ecx
mov word [ebp + eax - 0x20c], cx
jmp 0x426feb
xor eax, eax
mov word [ebp - 6], ax
push ecx
lea ecx, [ebp - 0x20c]
call fcn.00426901
mov dword [esi], eax
test eax, eax
je 0x4270ba
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._GetPerfhostHookVersion_0
push eax
call edi
test eax, eax
jne 0x427016
inc eax
jmp 0x427018
call eax
mov dword [esi + 4], eax
cmp eax, 1
jne 0x42703c
push str._InitPerf_4
push dword [esi]
call edi
push str._PerfCodeMarker_12
push dword [esi]
mov dword [esi + 8], eax
call edi
push str._UnInitPerf_4
jmp 0x427070
cmp eax, 2
jne 0x427051
push str._InitPerf_4
push dword [esi]
call edi
push str._PerfCodeMarker_8
jmp 0x42702e
cmp eax, 3
jne 0x42707a
push str._InitPerf_v3_4
push dword [esi]
call edi
push str._PerfCodeMarker_v3_8
push dword [esi]
mov dword [esi + 8], eax
call edi
push str._UnInitPerf_v3_4
push dword [esi]
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x4270ba
cmp dword [esi + 0x10], ebx
je 0x4270ba
cmp dword [esi + 0xc], ebx
je 0x4270ba
cmp dword [esi + 4], 1
jne 0x42709b
push dword [0x445304]
call eax
jmp 0x4270d1
cmp dword [esi + 4], 2
jne 0x4270ab
push dword [0x445304]
call eax
jmp 0x4270b6
cmp dword [esi + 4], 3
je 0x4270a1
mov eax, 0x80004005
test eax, eax
jns 0x4270d1
cmp dword [esi], ebx
je 0x4270c6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004282ce
mov esp, ebp
pop ebp
ret 4
call fcn.00428a82
int3
Function at 0x42859d
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x438ef0
call fcn.004290e4
push 1
call fcn.00428707
pop ecx
test al, al
jne 0x428454
push 7
call fcn.00428eac
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004286d2
mov byte [ebp - 0x24], al
mov eax, dword [0x43f814]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x42844d
test eax, eax
jne 0x4284be
mov dword [0x43f814], ecx
push 0x42c30c
push 0x42c2f4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4284a1
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x428597
push 0x42c2f0
push 0x42c2c0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x43f814], 2
jmp 0x4284c3
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00428874
pop ecx
call fcn.00428ea0
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4284f3
push esi
call fcn.004287ea
pop ecx
test al, al
je 0x4284f3
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00428e38
call esi
call fcn.00428ea6
mov esi, eax
cmp dword [esi], edi
je 0x428511
push esi
call fcn.004287ea
pop ecx
test al, al
je 0x428511
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.00428fc2
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00428ff5
test al, al
jne 0x42853c
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x428545
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00428891
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x428597
call fcn.00429129
ret
call fcn.004282db
jmp 0x428435

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x426d5f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00426bde
Function at 0x44d522
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x449650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x44d540
push eax
call dword [fcn.00449020]
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
movzx eax, word [ebx + 0x14]
push dword [ebx + 0x88]
lea eax, [eax + ebx + 0x18]
push ebx
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
mov dword [ebp - 0x10], eax
call fcn.0044aaa7
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
je 0x44d604
movzx eax, word [ebx + 6]
and dword [ebp - 0x14], 0
test eax, eax
push esi
push edi
jle 0x44d5af
mov edi, dword [ebp - 0x10]
push 2
pop ecx
lea esi, [ebp - 0xc]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x44d5af
add dword [ebp - 0x10], 0x28
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jl 0x44d594
cmp dword [ebp - 0x14], eax
je 0x44d602
mov eax, dword [ebp - 0x10]
mov edx, dword [ebx + 0x34]
add edx, dword [eax + 0xc]
push 4
pop ecx
mov edi, 0x44af88
mov esi, edx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x44d602
push 4
pop ecx
mov edi, 0x44af88
lea esi, [edx + 0x140]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x44d602
cmp dword [edx + 0x124], eax
je 0x44d5f0
push 0x44d324
jmp 0x44d5f5
push 0x44d50a
push ebx
push dword [ebp - 0x18]
push edx
call fcn.0044d0fb
add esp, 0x10
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0044e5aa
leave
ret

Function at 0x45ec20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
xor ebp, ebp
test esi, esi
je 0x45ec7f
mov eax, dword [esi + 0x3c]
push ebx
push edi
mov edi, dword [eax + esi + 0x78]
add edi, esi
xor ebx, ebx
cmp dword [edi + 0x18], ebx
jbe 0x45ec78
mov edi, edi
mov ecx, dword [edi + 0x20]
lea edx, [ecx + ebx*4]
mov eax, dword [edx + esi]
mov ecx, dword [esp + 0x18]
add eax, esi
push ecx
push eax
call dword [0x1000707c]
test eax, eax
jne 0x45ec70
mov edx, dword [edi + 0x24]
lea eax, [edx + ebx*2]
movzx ecx, word [eax + esi]
mov edx, dword [edi + 0x1c]
lea eax, [edx + ecx*4]
mov ebp, dword [eax + esi]
add ebp, esi
add ebx, 1
cmp ebx, dword [edi + 0x18]
jb 0x45ec40
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
ret
pop esi
mov eax, ebp
pop ebp
ret
Function at 0x460010
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, dword [edi + 0x3c]
add esi, edi
lea eax, [esi + 0x50]
push 0x40
mov dword [esp + 0x20], eax
mov eax, dword [eax]
push 0x1000
push eax
push 0
mov dword [esp + 0x20], esi
call dword [0x10007020]
mov ebp, dword [esi + 0x54]
mov ebx, eax
mov eax, dword [0x100e1010]
test eax, eax
jne 0x460067
push 0x100070f8
push 0x100070ec
call dword [0x1000708c]
push eax
call dword [0x100070a4]
mov dword [0x100e1010], eax
push ebp
push edi
push ebx
call eax
movzx ecx, word [esi + 0x14]
mov ebp, dword [esp + 0x1c]
add esp, 0xc
cmp word [ebp + 6], 0
lea esi, [esi + ecx + 0x18]
mov dword [esp + 0x18], 0
jbe 0x460130
add esi, 0x10
mov edi, dword [esi - 4]
mov eax, dword [0x100e1014]
mov edx, dword [esi]
mov ebp, dword [esi - 8]
add edi, ebx
test eax, eax
mov dword [esp + 0x14], edx
jne 0x4600c4
push 0x10007110
push 0x10007100
call dword [0x1000708c]
push eax
call dword [0x100070a4]
mov dword [0x100e1014], eax
push ebp
push edi
call eax
mov eax, dword [esp + 0x14]
cmp ebp, eax
mov dword [esp + 0x14], ebp
jl 0x4600d8
mov dword [esp + 0x14], eax
mov ebp, dword [esi + 4]
mov eax, dword [0x100e1010]
add ebp, dword [esp + 0x24]
test eax, eax
jne 0x460104
push 0x100070f8
push 0x100070ec
call dword [0x1000708c]
push eax
call dword [0x100070a4]
mov dword [0x100e1010], eax
mov ecx, dword [esp + 0x14]
push ecx
push ebp
push edi
call eax
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
movzx ecx, word [edx + 6]
add eax, 1
add esp, 0xc
add esi, 0x28
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x460091
mov ebp, edx
mov eax, dword [ebp + 0xa4]
mov edi, dword [ebp + 0xa0]
mov esi, ebx
sub esi, dword [ebp + 0x34]
add edi, ebx
test eax, eax
mov dword [esp + 0x18], eax
mov edx, edi
jle 0x46018c
lea ecx, [ecx]
mov eax, dword [edx + 4]
sub eax, 8
shr eax, 1
test eax, eax
lea ecx, [edx + 8]
jle 0x460182
mov dword [esp + 0x24], eax
movzx eax, word [ecx]
test eax, 0xf000
je 0x460178
and eax, 0xfff
add eax, dword [edx]
add eax, ebx
add dword [eax], esi
add ecx, 2
sub dword [esp + 0x24], 1
jne 0x460163
mov edx, ecx
sub ecx, edi
cmp ecx, dword [esp + 0x18]
jl 0x460150
mov edi, dword [ebp + 0x80]
mov eax, dword [edi + ebx + 0xc]
add edi, ebx
test eax, eax
je 0x4601f1
lea esp, [esp]
add eax, ebx
push eax
call dword [0x10007050]
cmp dword [edi + 4], 0
mov ebp, eax
jne 0x4601b6
mov esi, dword [edi + 0x10]
jmp 0x4601b8
mov esi, dword [edi]
add esi, ebx
cmp dword [esi], 0
je 0x4601e3
nop
mov eax, dword [esi]
test eax, eax
jns 0x4601cd
and eax, 0xffff
jmp 0x4601d1
lea eax, [eax + ebx + 2]
push eax
push ebp
call dword [0x100070a4]
mov dword [esi], eax
add esi, 4
cmp dword [esi], 0
jne 0x4601c0
mov eax, dword [edi + 0x20]
add edi, 0x14
test eax, eax
jne 0x4601a0
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
push eax
push ebx
call dword [0x10007094]
push eax
call dword [0x10007098]
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x460222
lea esi, [eax + ebx]
test esi, esi
je 0x460222
push 0
push 1
push ebx
call esi
push 0
push 2
push ebx
call esi
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x463390
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 8], 1
push 0x10007f98
push 0x10007fa8
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100e1224], eax
push 0x10007fbc
push 0x10007fcc
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100e1220], eax
push 0x10007fe0
push 0x10007ff4
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100e121c], eax
push 0x10008008
push 0x10008014
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100e1218], eax
push 0x10008028
push 0x10008038
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100e1258], eax
push 0x10008054
push 0x10008064
call dword [0x1000709c]
push eax
call dword [0x100070a4]
mov dword [0x100e1254], eax
push 0
call dword [0x1000709c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xe], 0x78
mov byte [ebp - 0xd], 0x70
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x6b
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov edx, dword [ebp - 0x14]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x18]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], 0
jmp 0x4634b1
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x20], edx
jge 0x463516
mov eax, dword [ebp - 0x20]
imul eax, eax, 0x28
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
push 8
lea ecx, [ebp - 0x2c]
push ecx
call dword [0x100e1224]
push 8
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x2c]
push eax
call dword [0x100e1220]
push 8
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x10]
push edx
call dword [0x100e121c]
cmp eax, 8
jne 0x463514
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0xc]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
push edx
call fcn.004623f0
mov dword [ebp - 8], eax
jmp 0x463516
jmp 0x4634a8
mov esp, ebp
pop ebp
ret
Function at 0x47f4b0
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], 0x100b081c
lea esi, [edi + 4]
push 0x100
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.00484fa0
mov dword [esi], eax
mov ecx, 0x20
mov dword [esi + 4], ebx
add esp, 8
mov byte [eax], bl
mov eax, 1
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xac], ecx
push 0x100b2e47
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0x10000
mov dword [esp + 0x24], 0x100b2ff8
mov dword [esp + 0x28], 0x20000
mov dword [esp + 0x2c], 0x100b2fe8
mov dword [esp + 0x30], 0x100000
mov dword [esp + 0x34], 0x100b2fdc
mov dword [esp + 0x38], 0x40000
mov dword [esp + 0x3c], 0x100b2fd0
mov dword [esp + 0x40], 0x80000
mov dword [esp + 0x44], 0x100b2fc4
mov dword [esp + 0x48], 0x80000000
mov dword [esp + 0x4c], 0x100b2fb4
mov dword [esp + 0x50], 0x40000000
mov dword [esp + 0x54], 0x100b2fa4
mov dword [esp + 0x58], 0x20000000
mov dword [esp + 0x5c], 0x100b2f94
mov dword [esp + 0x60], 0x10000000
mov dword [esp + 0x64], 0x100b2f88
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x100b2f78
mov dword [esp + 0x70], 0x80
mov dword [esp + 0x74], 0x100b2f60
mov dword [esp + 0x78], 8
mov dword [esp + 0x7c], 0x100b2f50
mov dword [esp + 0x80], 2
mov dword [esp + 0x84], 0x100b2f40
mov dword [esp + 0x88], 0x100
mov dword [esp + 0x8c], 0x100b2f28
mov dword [esp + 0x90], 0x10
mov dword [esp + 0x94], 0x100b2f18
mov dword [esp + 0x98], 4
mov dword [esp + 0x9c], 0x100b2f04
mov dword [esp + 0xa4], 0x100b2ef4
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], 0x100b2ee0
mov dword [esp + 0xb4], 0x100b2ed0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0046a640
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.0046a640
cmp ebp, ebx
je 0x47f66f
push ebp
call fcn.00485000
add esp, 4
xor ebp, ebp
mov eax, dword [esp + ebp*8 + 0x1c]
test dword [esp + 0x120], eax
je 0x47f6a4
not eax
and dword [esp + 0x120], eax
cmp dword [edi + 8], ebx
je 0x47f698
push 0x100b2ecc
mov ecx, esi
call fcn.0046a470
mov eax, dword [esp + ebp*8 + 0x20]
push eax
mov ecx, esi
call fcn.0046a470
add ebp, 1
cmp ebp, 0x13
jb 0x47f671
cmp dword [edi + 8], ebx
jne 0x47f6f3
push 0x100b2ec4
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0046a640
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.0046a640
cmp ebp, ebx
je 0x47f72f
push ebp
call fcn.00485000
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
mov eax, dword [esp + 0x120]
cmp eax, ebx
je 0x47f72f
push eax
lea ecx, [esp + 0x20]
push 0x100b2ebc
push ecx
call dword [0x100b0254]
add esp, 0xc
cmp dword [edi + 8], ebx
je 0x47f723
push 0x100b2ecc
mov ecx, esi
call fcn.0046a470
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.0046a470
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 4
Function at 0x47fc80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x17c
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [edi], 0x100b081c
lea esi, [edi + 4]
push 0x100
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.00484fa0
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
push 0x100b2e47
lea ecx, [esp + 0x14]
mov byte [eax], bl
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x100b326c
mov dword [esp + 0x28], 0x40
mov dword [esp + 0x2c], 0x100b3254
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], 0x100b3240
mov dword [esp + 0x38], 4
mov dword [esp + 0x3c], 0x100b3228
mov dword [esp + 0x40], 0x800
mov dword [esp + 0x44], 0x100b3214
mov dword [esp + 0x48], 8
mov dword [esp + 0x4c], 0x100b31f4
mov dword [esp + 0x50], 0x10
mov dword [esp + 0x54], 0x100b31d8
mov dword [esp + 0x58], 0x20
mov dword [esp + 0x5c], 0x100b31b8
mov dword [esp + 0x60], 0x80
mov dword [esp + 0x64], 0x100b319c
mov dword [esp + 0x68], 0x100
mov dword [esp + 0x6c], 0x100b3180
mov dword [esp + 0x70], 0x200
mov dword [esp + 0x74], 0x100b3168
mov dword [esp + 0x78], 0x1000
mov dword [esp + 0x7c], 0x100b3150
mov dword [esp + 0x80], 0x2000
mov dword [esp + 0x84], 0x100b3138
mov dword [esp + 0x88], 0x4000
mov dword [esp + 0x8c], 0x100b311c
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.0046a640
mov ebp, dword [esp + 0x10]
push ebp
mov ecx, esi
call fcn.0046a640
cmp ebp, ebx
je 0x47fdd7
push ebp
call fcn.00485000
add esp, 4
mov ebx, dword [esp + 0x190]
xor ebp, ebp
mov eax, dword [esp + ebp*8 + 0x1c]
test ebx, eax
je 0x47fe0a
not eax
and ebx, eax
cmp dword [edi + 8], 0
je 0x47fdfe
push 0x100b2ecc
mov ecx, esi
call fcn.0046a470
mov eax, dword [esp + ebp*8 + 0x20]
push eax
mov ecx, esi
call fcn.0046a470
add ebp, 1
cmp ebp, 0xe
jb 0x47fde0
xor ebp, ebp
cmp dword [edi + 8], ebp
jne 0x47fe5b
push 0x100b2ec4
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.0046a640
mov ebx, dword [esp + 0x10]
push ebx
mov ecx, esi
call fcn.0046a640
cmp ebx, ebp
je 0x47fe96
push ebx
call fcn.00485000
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret 4
cmp ebx, ebp
je 0x47fe96
push ebx
lea ecx, [esp + 0x90]
push 0x100b2ebc
push ecx
call dword [0x100b0254]
add esp, 0xc
cmp dword [edi + 8], ebp
je 0x47fe87
push 0x100b2ecc
mov ecx, esi
call fcn.0046a470
lea edx, [esp + 0x8c]
push edx
mov ecx, esi
call fcn.0046a470
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x17c
ret 4
Function at 0x48d120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x10], ebx
je 0x48d24d
mov ecx, dword [edi + 0x3c]
mov esi, dword [ecx + edi + 0x78]
add ecx, edi
add esi, edi
cmp dword [esi + 0x18], ebx
mov dword [esp + 0x18], ecx
jbe 0x48d24d
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi + 0x20]
lea edx, [eax + ebx*4]
mov eax, dword [edx + edi]
add eax, edi
test eax, 0xffff0000
je 0x48d182
test ebp, 0xffff0000
je 0x48d182
push ebp
push eax
call dword [0x100b01ac]
mov ecx, dword [esp + 0x18]
neg eax
sbb eax, eax
add eax, 1
jmp 0x48d18b
xor edx, edx
cmp eax, ebp
sete dl
mov eax, edx
test eax, eax
jne 0x48d1a1
add ebx, 1
cmp ebx, dword [esi + 0x18]
jb 0x48d153
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x24]
lea edx, [eax + ebx*2]
movzx eax, word [edx + edi]
mov edx, dword [esi + 0x1c]
lea eax, [edx + eax*4]
mov ebx, dword [eax + edi]
add ebx, edi
cmp ebx, esi
jb 0x48d249
mov ecx, dword [ecx + 0x7c]
add ecx, esi
cmp ebx, ecx
ja 0x48d249
xor ecx, ecx
cmp byte [ebx], cl
mov eax, ebx
je 0x48d1de
add eax, 1
add ecx, 1
cmp byte [eax], 0
jne 0x48d1d3
lea esi, [ecx + 1]
xor edi, edi
test esi, esi
jbe 0x48d1f2
push esi
call fcn.00485050
add esp, 4
mov edi, eax
push esi
push ebx
push edi
call fcn.00484f30
add esp, 0xc
cmp byte [edi], 0
mov esi, edi
je 0x48d211
cmp byte [esi], 0x2e
je 0x48d222
add esi, 1
cmp byte [esi], 0
jne 0x48d204
push edi
call fcn.00485000
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
push edi
mov byte [esi], 0
call dword [0x100b00d4]
add esi, 1
push esi
push eax
call fcn.0048d120
push edi
mov esi, eax
call fcn.00485000
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4b1910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
mov dx, word [eax]
shr dx, 1
push esi
movzx esi, dx
xor ecx, ecx
test si, si
push edi
mov word [esp + 8], 0x5c
mov word [esp + 0xa], 0x2f
mov word [esp + 0xc], 0x3a
mov word [esp + 0xe], 0x2a
mov word [esp + 0x10], 0x3f
mov word [esp + 0x12], 0x22
mov word [esp + 0x14], 0x3c
mov word [esp + 0x16], 0x3e
mov word [esp + 0x18], 0x7c
jbe 0x4b1997
mov edi, dword [eax + 4]
jmp 0x4b1970
movzx edx, cx
movzx edx, word [edi + edx*2]
xor eax, eax
lea esp, [esp]
cmp dx, word [esp + eax*2 + 8]
je 0x4b19a2
add eax, 1
cmp eax, 9
jb 0x4b1980
add ecx, 1
cmp cx, si
jb 0x4b1970
pop edi
mov eax, 1
pop esi
add esp, 0x14
ret
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret