Function at 0x100047f0
Capabilities:
Terminate process

Disassembly:
movzx eax, byte [ebp + 1]
add edi, ecx
mov dword [esp + 0x10], edi
lea esi, [esi + edi + 2]
lea ecx, [edx + 1]
mov dword [esp + 0x1c], ecx
xor edi, edi
jmp 0x1000481f
inc edi
cmp edi, dword [esp + 0xc]
mov edx, dword [esp]
je 0x100049df
mov ecx, dword [esp + 4]
mov ecx, dword [ecx + edi*4]
cmp byte [edx + ecx], al
jne 0x10004811
add ecx, dword [esp + 0x1c]
xor edx, edx
mov ah, al
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test ah, ah
je 0x10004852
mov ah, byte [ecx + edx]
cmp ah, byte [esi + edx]
lea edx, [edx + 1]
je 0x10004841
jmp 0x10004811
movsx ecx, byte [ebp]
movzx eax, byte [ebp + ecx + 1]
add ebp, ecx
mov esi, dword [esp + 0x10]
add esi, ecx
mov edx, dword [esp]
mov ecx, dword [esp + 8]
mov dword [esp + 0x10], ebx
mov ebx, dword [edx + ecx + 0x1c]
add ebx, edx
mov ecx, dword [edx + ecx + 0x24]
add ecx, edx
mov dword [esp + 0x24], ecx
movzx ecx, word [ecx + edi*2]
mov dword [esp + 0x28], ebx
mov ecx, dword [ebx + ecx*4]
mov ebx, dword [esp + 0x10]
add ecx, edx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x18]
lea edi, [ecx + esi + 2]
xor ecx, ecx
jmp 0x100048af

Function at 0x100048e0
Capabilities:
Terminate process

Disassembly:
inc ecx
cmp ecx, dword [esp + 0xc]
mov edx, dword [esp]
je 0x100049df
mov esi, dword [esp + 4]
mov esi, dword [esi + ecx*4]
cmp byte [edx + esi], al
jne 0x100048a1
add esi, dword [esp + 0x1c]
xor edx, edx
mov ah, al
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test ah, ah
je 0x100048e2
mov ah, byte [esi + edx]
cmp ah, byte [edi + edx]
lea edx, [edx + 1]
je 0x100048d1
jmp 0x100048a1
mov eax, dword [esp + 0x24]
movzx eax, word [eax + ecx*2]
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx + eax*4]
mov dword [esp + 4], eax
movsx edi, byte [ebp]
lea eax, [ebp + edi + 1]
push eax
call dword [esp + 0xc]
test eax, eax
je 0x100049df
mov esi, eax
add ebp, edi
mov eax, dword [esp]
add eax, dword [esp + 4]
mov edx, eax
movsx eax, byte [ebp]
lea edi, [ebp + eax]
add edi, dword [0x101646d8]
mov ecx, dword [ebp + eax + 4]
mov dword [esp + 4], ecx
mov ecx, dword [ebp + eax + 8]
mov dword [esp + 0xc], ecx
mov eax, dword [esi + 0x3c]
add esi, dword [esi + eax + 0x2c]
mov dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
push dword [0x101646c4]
push ecx
push esi
mov ebp, edx
call edx
mov ecx, esi
mov dword [esp], edi
mov edx, edi
mov edi, dword [esp + 0xc]
push edi
call fcn.100045a1
add esp, 4
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push edi
push esi
call ebp
mov eax, dword [str.caftan.html]
cmp byte [eax], 0
je 0x100049b2
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [str.caftan.html]
movsx eax, byte [eax + ecx]
mov word [ebx + ecx*2], ax
lea eax, [ecx + 1]
mov edx, dword [str.caftan.html]
cmp byte [edx + ecx + 1], 0
mov ecx, eax
jne 0x10004991
jmp 0x100049b4
xor eax, eax
add esi, dword [esp + 4]
mov ecx, dword [esp]
add ecx, edi
mov word [ebx + eax*2], 0
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ecx
mov byte [esp + 0x34], 1
lea eax, [esp + 0x2c]
push eax
call esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]