joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100461d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10167f98
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101e0cf8]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov edi, ecx
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x20]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
call fcn.10039430
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x74], 0
call fcn.10043790
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.100ba565
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
test eax, eax
mov dword [esp + 0x58], 0xffffffff
je 0x100462c7
push 0
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.100b9cab
mov eax, dword [edi + 4]
test eax, eax
jbe 0x100462a5
cmp eax, 0xffffffff
jae 0x100462a5
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.100b9ccc
test esi, esi
je 0x100462c7
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x10046308
test edi, edi
je 0x10046301
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x100462ed
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x100462ed
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x100462f6
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x10046301
mov byte [esp + 0x6d], al
jmp 0x10046303
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x1004633e
test esi, esi
je 0x1004633c
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x1004632e
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x1004632e
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10046337
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x1004633e
xor esi, esi
test edi, edi
jne 0x10046348
test esi, esi
je 0x1004634c
jmp 0x10046350
test esi, esi
je 0x10046350
or dword [ebp], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x1004636d
cmp dword [esp + 0x10], 0
jne 0x1004636d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
jmp 0x10046371
or dword [ebp], 2
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.100bc9af
add esp, 0x4c
ret 0x28
Function at 0x100463b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10167fc8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101e0cf8]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov edi, ecx
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x20]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
call fcn.10039430
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x74], 0
call fcn.10043790
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.100ba3b8
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
test eax, eax
mov dword [esp + 0x58], 0xffffffff
je 0x100464a7
push 0
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.100b9cab
mov eax, dword [edi + 4]
test eax, eax
jbe 0x10046485
cmp eax, 0xffffffff
jae 0x10046485
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.100b9ccc
test esi, esi
je 0x100464a7
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x100464e8
test edi, edi
je 0x100464e1
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x100464cd
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x100464cd
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x100464d6
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x100464e1
mov byte [esp + 0x6d], al
jmp 0x100464e3
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x1004651e
test esi, esi
je 0x1004651c
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x1004650e
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x1004650e
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10046517
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x1004651e
xor esi, esi
test edi, edi
jne 0x10046528
test esi, esi
je 0x1004652c
jmp 0x10046530
test esi, esi
je 0x10046530
or dword [ebp], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x1004654d
cmp dword [esp + 0x10], 0
jne 0x1004654d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
jmp 0x10046551
or dword [ebp], 2
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.100bc9af
add esp, 0x4c
ret 0x28
Function at 0x10046590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10167ff8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x101e0cf8]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x84]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x80]
mov edi, ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.10039430
mov esi, dword [esi + 0x10]
push eax
push esi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x3c]
push ecx
push edi
mov dword [esp + 0x70], 0
call fcn.10043790
push eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.100be058
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x4c]
add esp, 0x24
test eax, eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x58], 0xffffffff
je 0x10046678
push 0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.100b9cab
mov eax, dword [edi + 4]
test eax, eax
jbe 0x10046656
cmp eax, 0xffffffff
jae 0x10046656
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x1c]
and esi, edi
call fcn.100b9ccc
test esi, esi
je 0x10046678
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x100466b9
test edi, edi
je 0x100466b2
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x1004669e
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x1004669e
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x100466a7
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x100466b2
mov byte [esp + 0x6d], al
jmp 0x100466b4
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x100466ef
test esi, esi
je 0x100466ed
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x100466df
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x100466df
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x100466e8
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x100466ef
xor esi, esi
test edi, edi
jne 0x100466f9
test esi, esi
je 0x100466fd
jmp 0x10046700
test esi, esi
je 0x10046700
or dword [ebx], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x1004671d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x10046720
or dword [ebx], 2
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100bc9af
add esp, 0x48
ret 0x28
Function at 0x10046760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10168028
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x101e0cf8]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x84]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x80]
mov edi, ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.10039430
mov esi, dword [esi + 0x10]
push eax
push esi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x3c]
push ecx
push edi
mov dword [esp + 0x70], 0
call fcn.10043790
push eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.100be09c
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x4c]
add esp, 0x24
test eax, eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x58], 0xffffffff
je 0x10046848
push 0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.100b9cab
mov eax, dword [edi + 4]
test eax, eax
jbe 0x10046826
cmp eax, 0xffffffff
jae 0x10046826
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x1c]
and esi, edi
call fcn.100b9ccc
test esi, esi
je 0x10046848
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x10046889
test edi, edi
je 0x10046882
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x1004686e
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x1004686e
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10046877
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x10046882
mov byte [esp + 0x6d], al
jmp 0x10046884
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x100468bf
test esi, esi
je 0x100468bd
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x100468af
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x100468af
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x100468b8
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x100468bf
xor esi, esi
test edi, edi
jne 0x100468c9
test esi, esi
je 0x100468cd
jmp 0x100468d0
test esi, esi
je 0x100468d0
or dword [ebx], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x100468ed
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x100468f0
or dword [ebx], 2
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100bc9af
add esp, 0x48
ret 0x28
Function at 0x10046b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10168088
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x101e0cf8]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebp
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
mov ebp, dword [esp + 0x80]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
mov esi, ecx
mov ecx, dword [esp + 0x9c]
push eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], 0
call fcn.10039430
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
mov dword [esp + 0x90], 0
call fcn.10043ce0
add esp, 0x14
push eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.100ba88c
fstp qword [esp + 0x38]
mov edi, dword [esp + 0x30]
add esp, 0x10
test edi, edi
mov dword [esp + 0x78], 0xffffffff
je 0x10046c2e
push 0
lea ecx, [esp + 0x1c]
call fcn.100b9cab
mov eax, dword [edi + 4]
test eax, eax
jbe 0x10046c0c
cmp eax, 0xffffffff
jae 0x10046c0c
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x18]
and esi, edi
call fcn.100b9ccc
test esi, esi
je 0x10046c2e
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x8c], 0
mov edi, dword [esp + 0x88]
jne 0x10046c7b
test edi, edi
je 0x10046c71
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x10046c5a
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x10046c5a
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10046c63
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x10046c71
mov byte [esp + 0x8d], al
jmp 0x10046c73
xor edi, edi
mov byte [esp + 0x8c], 1
cmp byte [esp + 0x98], 0
mov esi, dword [esp + 0x94]
jne 0x10046cb7
test esi, esi
je 0x10046cb5
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x10046ca7
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x10046ca7
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10046cb0
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x10046cb7
xor esi, esi
test edi, edi
jne 0x10046ce0
test esi, esi
je 0x10046ce4
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x30]
cmp dword [esp + 0x24], ecx
je 0x10046ced
cmp dword [esp + 0x14], 0
jne 0x10046ced
fld qword [esp + 0x28]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x10046cf0
test esi, esi
je 0x10046cbf
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x10046cc3
or dword [eax], 2
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x8c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.100bc9af
add esp, 0x6c
ret 0x28
Function at 0x10046d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x101680b8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x101e0cf8]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebp
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
mov ebp, dword [esp + 0x80]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
mov esi, ecx
mov ecx, dword [esp + 0x9c]
push eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], 0
call fcn.10039430
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
mov dword [esp + 0x90], 0
call fcn.10043ce0
add esp, 0x14
push eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.100baa2a
fstp qword [esp + 0x38]
mov edi, dword [esp + 0x30]
add esp, 0x10
test edi, edi
mov dword [esp + 0x78], 0xffffffff
je 0x10046e2e
push 0
lea ecx, [esp + 0x1c]
call fcn.100b9cab
mov eax, dword [edi + 4]
test eax, eax
jbe 0x10046e0c
cmp eax, 0xffffffff
jae 0x10046e0c
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x18]
and esi, edi
call fcn.100b9ccc
test esi, esi
je 0x10046e2e
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x8c], 0
mov edi, dword [esp + 0x88]
jne 0x10046e7b
test edi, edi
je 0x10046e71
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x10046e5a
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x10046e5a
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10046e63
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x10046e71
mov byte [esp + 0x8d], al
jmp 0x10046e73
xor edi, edi
mov byte [esp + 0x8c], 1
cmp byte [esp + 0x98], 0
mov esi, dword [esp + 0x94]
jne 0x10046eb7
test esi, esi
je 0x10046eb5
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x10046ea7
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x10046ea7
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10046eb0
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x10046eb7
xor esi, esi
test edi, edi
jne 0x10046ee0
test esi, esi
je 0x10046ee4
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x30]
cmp dword [esp + 0x24], ecx
je 0x10046eed
cmp dword [esp + 0x14], 0
jne 0x10046eed
fld qword [esp + 0x28]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x10046ef0
test esi, esi
je 0x10046ebf
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x10046ec3
or dword [eax], 2
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x8c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.100bc9af
add esp, 0x6c
ret 0x28
Function at 0x10046f30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x101680e8
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x101e0cf8]
xor eax, esp
mov dword [esp + 0x40], eax
push ebp
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x84]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
mov esi, ecx
mov ecx, dword [esp + 0x80]
push eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 0
call fcn.10039430
push eax
push 0x800
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x40]
push eax
push esi
mov dword [esp + 0x74], 0
call fcn.10043790
mov ebp, eax
mov eax, dword [esp + 0x3c]
add esp, 0x18
test eax, eax
mov dword [esp + 0x5c], 0xffffffff
je 0x10047017
push 0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.100b9cab
mov eax, dword [edi + 4]
test eax, eax
jbe 0x10046ff1
cmp eax, 0xffffffff
jae 0x10046ff1
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x1c]
and esi, edi
call fcn.100b9ccc
test esi, esi
je 0x10047013
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push ebp
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.100ba3b8
mov ebp, dword [esp + 0x7c]
add esp, 0x10
cmp byte [esp + 0x70], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
jne 0x1004707d
test ebp, ebp
je 0x10047076
mov eax, dword [ebp + 0x20]
cmp dword [eax], 0
je 0x10047061
mov ecx, dword [ebp + 0x30]
cmp dword [ecx], 0
jle 0x10047061
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x1004706b
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
mov ecx, ebp
call edx
cmp eax, 0xffffffff
je 0x10047076
mov byte [esp + 0x71], al
jmp 0x10047078
xor ebp, ebp
mov byte [esp + 0x70], 1
cmp byte [esp + 0x7c], 0
mov esi, dword [esp + 0x78]
jne 0x100470b3
test esi, esi
je 0x100470b1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x100470a3
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x100470a3
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x100470ac
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x100470b3
xor esi, esi
test ebp, ebp
jne 0x100470bd
test esi, esi
je 0x100470c1
jmp 0x100470c4
test esi, esi
je 0x100470c4
or dword [edi], 1
lea eax, [esp + 0x30]
cmp dword [esp + 0x2c], eax
je 0x100470e1
cmp dword [esp + 0x18], 0
jne 0x100470e1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov dword [edx], ecx
jmp 0x100470e4
or dword [edi], 2
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x70]
mov dword [eax], ecx
mov dword [eax + 4], ebp
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.100bc9af
add esp, 0x50
ret 0x28
Function at 0x10053be0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10169586
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov al, byte [edi]
mov byte [esi], al
push 0xffffffffffffffff
lea ecx, [esi + 4]
lea eax, [edi + 4]
push 0
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.100034b0
lea ecx, [edi + 0x20]
push ecx
lea ecx, [esi + 0x20]
mov dword [esp + 0x1c], 0
call fcn.10052010
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
mov byte [esp + 0x1c], 1
call fcn.10053820
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x1006ba10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1016bb40
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x101e0cf8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.100e9b80
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
call fcn.1006ab80
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x2c], 1
call fcn.1006b9a0
mov esi, dword [esp + 0x18]
test esi, esi
je 0x1006bac1
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
push eax
push ecx
mov ecx, esi
call edx
test eax, eax
jne 0x1006bac1
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], al
call fcn.1006b490
mov ecx, edi
mov dword [esp + 0x24], 0xffffffff
call fcn.100ea1a0
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
mov ebp, dword [esp + 0x14]
push ebp
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x1006baf7
test esi, esi
je 0x1006bae3
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
test ebp, ebp
je 0x1006baf7
mov ecx, ebp
call fcn.100fa2e0
push ebp
call fcn.100bbe20
add esp, 4
mov ecx, edi
mov dword [esp + 0x24], 0xffffffff
call fcn.100ea1a0
mov eax, reloc.WS2_32.dll_closesocket
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc