joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47373e
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x111c
call fcn.0059bb50
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x1114], eax
push ebx
push ebp
push esi
mov ebx, ecx
mov esi, edx
push edi
test ebx, ebx
jne 0x473769
xor eax, eax
jmp 0x4738a5
push dword [ebx]
lea edi, [ebx + 0x10]
mov dword [esp + 0x18], edi
call fcn.005abb70
cdq
pop ecx
cmp eax, dword [ebx + 0x1010]
jne 0x473789
cmp edx, dword [ebx + 0x1014]
je 0x473762
cmp esi, 0x20
je 0x47379c
push 0x48
pop ebp
push 0x3c
cmp esi, 0x40
pop eax
cmovne ebp, eax
jmp 0x47379f
push 0x40
pop ebp
push dword [ebx]
push ebp
push 1
push edi
call fcn.005d0dc0
add esp, 0x10
cmp eax, ebp
jl 0x473762
push dword [edi]
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
call esi
push dword [edi + 4]
mov dword [edi], eax
call esi
push dword [edi + 8]
mov dword [edi + 4], eax
call esi
mov dword [edi + 8], eax
push dword [ebx]
call fcn.005abb70
cdq
pop ecx
mov ecx, eax
mov esi, edx
mov eax, dword [edi + 4]
cdq
add eax, ecx
mov dword [edi - 8], eax
mov eax, 0xff8
adc edx, esi
sub eax, ebp
mov dword [edi - 4], edx
cmp dword [edi + 4], eax
jg 0x473762
push dword [ebx]
lea eax, [edi + ebp]
push dword [edi + 4]
push 1
push eax
call fcn.005d0dc0
add esp, 0x10
cmp eax, dword [edi + 4]
jne 0x473762
mov esi, dword [edi + 8]
lea eax, [esp + 0x18]
push eax
call fcn.0048aeb0
pop ecx
test esi, esi
jle 0x47386d
mov edi, 0x1000
push dword [ebx]
cmp esi, edi
mov eax, esi
cmovg eax, edi
push eax
lea eax, [esp + 0x128]
push 1
push eax
call fcn.005d0dc0
mov ebp, eax
add esp, 0x10
test ebp, ebp
jle 0x473869
push ebp
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0048af60
sub esi, ebp
add esp, 0xc
test esi, esi
jg 0x47382b
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xf4]
push eax
call fcn.0048aea0
cmp dword [edi + 8], 0
pop ecx
pop ecx
jle 0x4738a3
lea edx, [esp + 0xf0]
xor ecx, ecx
mov eax, dword [edi + ecx*4 + 0xc]
cmp eax, dword [edx + ecx*4]
jne 0x4738a1
inc ecx
cmp ecx, 0xc
jne 0x473890
jmp 0x4738a3
xor edi, edi
mov eax, edi
mov ecx, dword [esp + 0x1124]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059b3f0
add esp, 0x111c
ret
Function at 0x473bde
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [esp + 0x10], esi
jne 0x473c4a
push ebp
mov ebp, 0x80
push esi
push ebp
test edx, edx
je 0x473bfb
push 5
jmp 0x473bfd
push 3
push esi
push 1
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x473c33
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x473c33
push esi
push ebp
push 1
push esi
push 1
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 2
push edi
call fcn.005ea190
pop ecx
pop ecx
pop ebp
cmp eax, 0xffffffff
je 0x473c87
push str.wbN
jmp 0x473c7b
push esi
push 0x80
push 3
push esi
push 3
push accept
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x473c8e
push esi
push edi
call fcn.005ea190
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x473c87
push 0x7635fc
push eax
call fcn.005e9810
pop ecx
pop ecx
test eax, eax
jne 0x473c90
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x473f3c
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
mov ebx, dword [esp + 0x40]
mov eax, edx
push ebp
push esi
mov ebp, ecx
mov dword [esp + 0xc], eax
push edi
mov edi, dword [esp + 0x50]
test ebp, ebp
jne 0x473f69
xor eax, eax
jmp 0x47404c
cmp ebx, 1
jle 0x473f76
cmp byte [ebx + eax - 1], 0
jne 0x473f76
dec ebx
mov ecx, dword [ebp + 0x100c]
test ecx, ecx
je 0x473fc6
push ebx
push eax
xor edx, edx
call fcn.00470554
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x473fc2
test edi, edi
je 0x47404a
mov eax, dword [esi]
cmp dword [esp + 0x54], eax
jl 0x47404a
mov edx, dword [esp + 0x54]
mov ecx, edi
push eax
lea eax, [esi + 4]
push eax
call section..text
mov eax, dword [esi]
cmp dword [esp + 0x5c], eax
pop ecx
pop ecx
jmp 0x474044
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x1008]
xor edx, edx
push ebx
push eax
call fcn.00470554
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x473f62
test edi, edi
je 0x47404a
mov ebx, dword [esp + 0x54]
cmp ebx, dword [esi]
jl 0x47404a
push 0
push dword [esi + 0x38]
push dword [ebp]
call fcn.005ad120
add esp, 0xc
test eax, eax
jne 0x473f62
push dword [ebp]
push dword [esi]
push 1
push edi
call fcn.005d0dc0
add esp, 0x10
test eax, eax
je 0x473f62
mov edx, dword [esi]
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.0046a73f
lea edx, [esp + 0x14]
xor ecx, ecx
mov eax, dword [edx + ecx*4]
cmp eax, dword [esi + ecx*4 + 4]
jne 0x473f62
inc ecx
cmp ecx, 0xc
jne 0x47402d
mov eax, dword [esi]
cmp ebx, eax
jle 0x47404a
mov byte [eax + edi], 0
mov eax, dword [esi]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059b3f0
add esp, 0x38
ret
Function at 0x4742a6
Capabilities:
Copy file
Delete file

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
test esi, esi
je 0x4743ac
mov eax, dword [esi + 0x101c]
cmp eax, dword [esi + 0x1024]
jb 0x4743ac
ja 0x4742de
mov eax, dword [esi + 0x1018]
cmp eax, dword [esi + 0x1020]
jb 0x4743ac
mov ecx, dword [esi + 4]
or edx, 0xffffffff
push edx
push str..tmp
call fcn.00470b6b
mov ebx, eax
xor eax, eax
push 0
mov ecx, ebx
lea edx, [eax + 1]
call fcn.00473bde
mov ebp, eax
add esp, 0xc
test ebp, ebp
jne 0x474319
inc ebp
push ebp
push ebx
call fcn.005cdee0
pop ecx
pop ecx
mov eax, ebp
jmp 0x4743af
mov ecx, dword [esi + 0x1008]
lea eax, [esp + 0x10]
and dword [esi + 0x1038], edi
mov edx, 0x4740d1
push eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebp
call fcn.004702c5
pop ecx
cmp dword [esi + 0x1038], edi
jne 0x47439c
push dword [esi]
call fcn.005ac520
push ebp
call fcn.005ac520
pop ecx
pop ecx
push 0
push dword [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
pop ebp
test eax, eax
push ebx
cmove edi, ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esi + 4]
xor edx, edx
push 0
call fcn.00473bde
mov dword [esi], eax
pop ecx
test eax, eax
je 0x474398
push eax
call fcn.005abb70
cdq
pop ecx
mov dword [esi + 0x1010], eax
mov dword [esi + 0x1014], edx
jmp 0x47439f
mov edi, ebp
jmp 0x47439f
xor ebp, ebp
inc ebp
push ebp
push ebx
call fcn.005cdee0
pop ecx
pop ecx
mov eax, edi
jmp 0x4743af
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x47657c
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebp, 0x9a1
mov edi, edx
push ebp
push 0x7638f8
push 1
push 0x128
mov ebx, ecx
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
je 0x47664c
push 0x128
push 0
push esi
call fcn.0059de40
and dword [esi + 0x60], 0
xor ecx, ecx
call fcn.0046febf
or dword [esi + 0x6c], 0xffffffff
add ebp, 8
mov dword [esi + 0xc8], eax
xor eax, eax
push ebp
inc eax
mov dword [esi + 0xcc], edi
push 0x76397c
push eax
push 0x58
mov dword [esi + 0x98], eax
call fcn.005ce020
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x47661a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x76399c
push esi
push ebp
xor ecx, ecx
call fcn.0047145c
push ebp
push 0x7639bc
push 0x7639dc
jmp 0x476671
push 0x58
push 0
push edi
call fcn.0059de40
mov eax, dword [esp + 0x20]
add esp, 0xc
mov dword [edi + 0x34], eax
mov edx, edi
mov eax, dword [esp + 0x18]
mov dword [edi + 0x54], ebx
mov dword [edi + 0x38], eax
mov ecx, dword [esi + 0xc8]
call fcn.00470071
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x763918
push esi
push ebp
xor ecx, ecx
call fcn.0047145c
push ebp
push 0x763938
push 0x763958
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x476680
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, edx
test ebx, ebx
jne 0x47668b
xor eax, eax
pop ebx
ret
push ebp
push esi
push edi
mov edi, 0x9bf
xor ebp, ebp
push edi
push 0x763a00
inc ebp
push ebp
push 0x58
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4767b8
push 0x58
xor edi, edi
push edi
push esi
call fcn.0059de40
push 0x9c8
push 0x763a94
push ebp
push 0xc
mov dword [esi + 0x34], ebp
mov dword [esi + 0x14], str.ILibWebClient
mov dword [esi + 8], 0x474670
mov dword [esi], 0x4763e6
mov dword [esi + 0x20], 3
call fcn.005ce020
add esp, 0x1c
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x476725
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x9c9
push esi
push edi
mov edx, 0x763ab4
xor ecx, ecx
call fcn.0047145c
push edi
push 0x763ad4
push 0x763af4
jmp 0x4767dd
push edi
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
xor ecx, ecx
mov dword [esi + 0x40], eax
mov dword [esi + 0xc], ebx
call fcn.0046febf
xor ecx, ecx
mov dword [esi + 0x30], eax
call fcn.0046d68a
xor ecx, ecx
mov dword [esi + 0x28], eax
call fcn.0046d68a
mov edx, esi
mov dword [esi + 0x2c], eax
mov ecx, ebx
call fcn.0046c508
mov ecx, ebx
call fcn.0046c53e
mov dword [esi + 0x38], eax
mov dword [esi + 0x48], edi
push 0
push fcn.00476007
push 0x4761ea
push 0x476053
push fcn.004757d9
mov edx, 0xffff
mov ecx, ebx
call fcn.00467bd3
mov ecx, dword [esi + 0x1c]
add esp, 0x14
mov dword [edi + ecx], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [edi + eax]
test eax, eax
je 0x4767a9
mov dword [eax + 0x1d0], fcn.00476517
add edi, 4
cmp edi, 0xc
jl 0x47676a
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x763a20
push esi
push edi
xor ecx, ecx
call fcn.0047145c
push edi
push 0x763a40
push 0x763a60
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x4774b1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
or esi, 0xffffffff
test edx, edx
je 0x4774d1
movsx eax, byte [ecx]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x69e4c0]
inc ecx
sub edx, 1
jne 0x4774b9
not esi
mov eax, esi
pop esi
ret

Function at 0x477c2e
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, ecx
push esi
push edi
push 2
mov eax, dword [ebp + 0x88]
mov esi, edx
mov dword [esp + 0x28], eax
neg eax
mov dword [esp + 0x1c], ebp
sbb eax, eax
xor ecx, ecx
and eax, 0x1d
xor edi, edi
cmp dword [ebp + 0x70], edi
mov dword [esp + 0x20], eax
pop eax
cmovne eax, ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], eax
call fcn.0046bacc
mov ecx, dword [ebp + 0x78]
mov ebx, eax
push 8
pop eax
cmp ebx, eax
push 0x5cd
cmovg ebx, eax
xor eax, eax
cmp dword [ecx + 0x204], edi
push 0x7644e0
cmovne ebx, eax
mov eax, dword [esp + 0x24]
imul ecx, ebx, 6
add ecx, 0x52
add eax, ecx
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov dword [esp + 0x18], eax
inc ecx
push ecx
push eax
call fcn.005ce020
add esp, 0x10
mov dword [esi], eax
test eax, eax
je 0x477dbe
push dword [esp + 0x20]
xor ecx, ecx
inc ecx
mov word [eax], cx
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, dword [esi]
mov edx, dword [esp + 0x10]
push 0x2a
add edx, 0xfffffffa
mov dword [ecx + 2], eax
lea eax, [ebp + 0x20]
mov ecx, dword [esi]
push eax
add ecx, 6
call section..text
mov eax, dword [ebp + 0x78]
mov ecx, dword [esi]
mov edx, dword [esp + 0x18]
mov al, byte [eax + 0x1a4]
mov byte [ecx + 0x30], al
mov eax, dword [ebp + 0x78]
lea edx, [edx - 0x31]
mov ecx, dword [esi]
add ecx, 0x31
push dword [eax + 0x1a4]
push dword [eax + 0x1a0]
call section..text
mov eax, dword [esi]
add esp, 0x10
mov edx, dword [esp + 0x14]
mov byte [eax + 0x51], bl
push 0x10
pop ebp
test ebx, ebx
jle 0x477d53
lea eax, [edx + 4]
mov edx, eax
mov ecx, dword [esi]
lea edi, [edi + 6]
mov eax, dword [edx]
add edx, ebp
mov dword [edi + ecx + 0x4c], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esi]
mov eax, dword [eax + 0x78]
mov ax, word [eax + 0x36]
mov word [edi + ecx + 0x50], ax
sub ebx, 1
jne 0x477d2b
mov edx, dword [esp + 0x14]
test edx, edx
je 0x477d63
xor eax, eax
inc eax
push eax
push edx
call fcn.005cdee0
pop ecx
pop ecx
cmp dword [esp + 0x24], 0
je 0x477db2
mov edx, dword [esp + 0x18]
mov ecx, ebp
push 0x1c
pop edi
push 0x17
mov eax, dword [edx + 0x78]
pop ebx
push 0x1c
cmp word [eax + 0x1d8], bx
mov eax, dword [esi]
cmove ecx, edi
mov edi, dword [esp + 0x2c]
mov byte [edi + eax], cl
mov eax, dword [edx + 0x78]
mov edx, dword [esp + 0x20]
add eax, 0x1d8
pop ecx
cmp word [eax], bx
lea edx, [edx - 1]
cmove ebp, ecx
mov ecx, dword [esi]
inc ecx
push ebp
push eax
add ecx, edi
call section..text
pop ecx
pop ecx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x5cd
push esi
push edi
mov edx, 0x7644fc
xor ecx, ecx
call fcn.0047145c
push edi
push 0x764518
push 0x764534
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
int3
Function at 0x478efd
Capabilities:
Terminate process

Disassembly:
sub esp, 0x5c
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x6c]
mov ebx, edx
push edi
mov edi, ecx
lea edx, [esp + 0x14]
mov ecx, dword [esp + 0x78]
push esi
call fcn.0047f738
mov ecx, dword [edi + 8]
mov dword [esp], 0x9a1
add ecx, 0xa
push 0x764558
push 1
push ecx
mov dword [esp + 0x20], eax
call fcn.005ce020
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x479067
mov edx, dword [edi + 8]
mov ecx, ebp
push edx
push dword [edi]
add edx, 0xa
call section..text
mov ecx, dword [edi + 8]
push 1
push 0x7645d0
push 0xa
add ecx, ebp
pop edx
call section..text
mov ecx, dword [edi + 8]
lea eax, [edi + 0x21]
push 8
push eax
inc ecx
push 9
add ecx, ebp
pop edx
call section..text
mov eax, dword [edi + 8]
xor edx, edx
push esi
inc edx
mov ecx, ebx
mov byte [eax + ebp + 9], 0
call fcn.0047f5dc
mov ecx, dword [edi + 8]
mov esi, eax
add ecx, 9
mov edx, esi
push ecx
push ebp
push 6
mov ecx, ebx
call fcn.0047f60e
add esp, 0x28
add esi, eax
cmp dword [esp + 0x74], 0
je 0x478fd0
push 0
push 0
push 0x25
mov edx, esi
mov ecx, ebx
call fcn.0047f60e
add esp, 0xc
add esi, eax
cmp dword [edi + 0x6c], 0
lea eax, [edi + 0x4b]
push 8
mov edx, esi
mov ecx, ebx
push eax
jne 0x478fe7
push 0x802a
jmp 0x478fec
push 0x8029
call fcn.0047f60e
add esp, 0xc
add esi, eax
lea eax, [esp + 0x14]
mov edx, esi
mov ecx, ebx
push dword [esp + 0x10]
push eax
push 0x20
call fcn.0047f60e
push dword [edi + 0xc]
add esi, eax
mov ecx, ebx
push dword [edi + 4]
mov edx, esi
call fcn.00477aa1
add esi, eax
mov ecx, ebx
mov edx, esi
call fcn.00477b1a
push 1
push ebp
add esi, eax
call fcn.005cdee0
push dword [edi + 0xc]
lea ecx, [esp + 0x48]
push dword [edi + 4]
push 0x40
pop edx
call section..text
mov eax, dword [edi + 0xc]
add esp, 0x24
cmp eax, 0x40
jae 0x47909f
mov ecx, dword [esp + 0x68]
pop edi
mov byte [esp + eax + 0x24], 0
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059b3f0
add esp, 0x5c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0x9a1
push esi
push edi
mov edx, 0x764574
xor ecx, ecx
call fcn.0047145c
push edi
push 0x764590
push 0x7645ac
call fcn.004010b4
add esp, 0x18
push esi
call fcn.005aae60
call fcn.0059b550
int3
Function at 0x47913e
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
sub esp, 0x38
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x1c], edx
xor ebp, ebp
push edi
mov dword [esp + 0x1c], ebp
cmp dword [esi + 0x64], ebp
jle 0x479304
mov edx, ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov ebx, ebp
mov ecx, dword [esi + 0x78]
cmp dword [ecx + 0x204], ebp
jne 0x479192
mov eax, dword [esi + 0x74]
test eax, eax
js 0x479195
mov eax, dword [ecx + eax*4 + 0x174]
mov eax, dword [eax + 0x44]
cmp word [eax], bp
jne 0x479195
xor ebx, ebx
inc ebx
mov ecx, dword [esi + 0x5c]
lea edi, [esp + 0x28]
xor eax, eax
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
mov word [esp + 0x28], ax
mov ax, word [edx + ecx + 4]
mov word [esp + 0x2a], ax
mov eax, dword [edx + ecx]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x20]
mov byte [esp + 0x38], al
lea eax, [esp + 0x39]
push 0xb
push eax
call fcn.004a39d0
mov edi, 0x9fa
push edi
push 0x7645d4
push 1
push 0x200
call fcn.005ce020
mov ebp, eax
add esp, 0x18
mov dword [esp + 0x24], ebp
test ebp, ebp
je 0x479317
lea eax, [esp + 0x28]
mov edx, ebp
push eax
lea eax, [esp + 0x3c]
mov ecx, esi
push 0
push eax
call fcn.00478efd
add esp, 0xc
add ebp, eax
xor eax, eax
mov edi, ebp
push 8
pop ecx
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, dword [esi + 0x74]
test ecx, ecx
js 0x479245
mov eax, dword [esi + 0x78]
push 0x1c
mov eax, dword [eax + ecx*4 + 0x174]
mov ecx, ebp
push dword [eax + 0x44]
push 0x1c
pop edx
call section..text
pop ecx
pop ecx
xor ebx, ebx
push 2
inc ebx
pop edi
jmp 0x479268
mov ecx, dword [esp + 0x14]
push 2
pop edi
mov word [ebp], di
mov eax, dword [esi + 0x5c]
mov eax, dword [ecx + eax]
mov dword [ebp + 4], eax
mov eax, dword [esi + 0x5c]
mov ax, word [ecx + eax + 4]
mov word [ebp + 2], ax
mov byte [ebp + 0x1c], bl
mov eax, dword [esi + 0x78]
mov dword [ebp + 0x1d], eax
lea eax, [esp + 0x13]
push 1
push eax
call fcn.004a39d0
movsx eax, byte [esp + 0x1b]
mov ecx, dword [esi + 0x78]
mov edx, dword [esp + 0x2c]
push 0x46c2cc
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mov ecx, dword [ecx + 0x24]
push 0x478e8a
divss xmm0, dword [0x69ee98]
mulss xmm0, dword [0x69ee9c]
addss xmm0, dword [0x69ee78]
cvttss2si eax, xmm0
push eax
call fcn.0046f894
xor ebp, ebp
add esp, 0x14
cmp dword [esi + 0x88], ebp
je 0x4792d6
mov edx, dword [esp + 0x14]
inc ebx
cmp ebx, edi
jl 0x479171
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
inc eax
mov dword [esp + 0x18], eax
cmp eax, edi
jl 0x47916f
mov eax, dword [esp + 0x1c]
add edx, 6
inc eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
cmp eax, dword [esi + 0x64]
jl 0x47916b
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059b3f0
add esp, 0x38
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edx, 0x7645f0
push esi
push edi
xor ecx, ecx
call fcn.0047145c
add esp, 0xc
push edi
push 0x76460c
push 0x764628
call fcn.004010b4
add esp, 0xc
push esi
call fcn.005aae60
int3
Function at 0x47934e
Capabilities:
Terminate process

Disassembly:
sub esp, 0x34
mov eax, dword [0x6b0d44]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
push 0xa26
push 0x76464c
push 1
push pe_nt_image_headers32
mov dword [esp + 0x20], edx
mov edi, ecx
call fcn.005ce020
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4794ed
push pe_nt_image_headers32
push 0
push esi
call fcn.0059de40
add esp, 0xc
lea eax, [esi + 0x4b]
push 8
push eax
call fcn.004a39d0
mov eax, dword [edi + 0x208]
mov dword [esi + 0x88], eax
mov dword [esi + 0x78], edi
call fcn.00470e8d
push 0xa2c
push 0x7646c4
push 1
push 0xe0
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], edx
call fcn.005ce020
add esp, 0x18
mov dword [esi + 0x14], eax
test eax, eax
jne 0x47941e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0xa2c
push esi
push edi
mov edx, 0x7646e0
xor ecx, ecx
call fcn.0047145c
add esp, 0xc
push edi
push 0x7646fc
push 0x764718
jmp 0x47951a
and dword [esi + 0x6c], 0
push 0xe0
push 0
push eax
mov dword [esi + 0x70], 1
call fcn.0059de40
add esp, 0xc
mov edx, esi
mov ecx, edi
push 0
push 0
call fcn.00477768
pop ecx
pop ecx
test eax, eax
jns 0x479465
push 1
push dword [esi + 0x14]
call fcn.005cdee0
push 1
push esi
call fcn.005cdee0
add esp, 0x10
xor eax, eax
jmp 0x4794da
lea ecx, [esp + 0x14]
push ecx
lea edx, [edi + 0x10c]
mov ecx, eax
call fcn.00477a3f
pop ecx
push 0x2b
pop edx
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x20]
call section..text
movsx eax, byte [esp + 0x1c]
mov ecx, ebx
push eax
lea eax, [esp + 0x21]
push eax
push 9
pop edx
call section..text
movsx ecx, byte [esp + 0x24]
movsx eax, byte [esp + ecx + 0x25]
push eax
lea eax, [esp + 0x2a]
add eax, ecx
mov ecx, ebp
push eax
push 0x21
pop edx
call section..text
movsx eax, byte [esp + 0x2c]
add esp, 0x18
mov edx, dword [esp + 0x10]
mov ecx, esi
mov byte [eax + ebx], 0
movsx eax, byte [esp + eax + 0x15]
mov byte [eax + ebp], 0
call fcn.00477c2e
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059b3f0
add esp, 0x34
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov esi, 0xfe
mov edi, 0xa26
push esi
push edi
mov edx, 0x764668
xor ecx, ecx
call fcn.0047145c
add esp, 0xc
push edi
push 0x764684
push 0x7646a0
call fcn.004010b4
add esp, 0xc
push esi
call fcn.005aae60
int3
Function at 0x479792
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebp, edx
push esi
push edi
mov esi, dword [ecx + ebp*4 + 0x14c]
mov eax, dword [esi + 0x64]
test eax, eax
jle 0x479846
xor edi, edi
cmp dword [esi + 0x88], edi
je 0x47983f
push 0xad6
imul eax, eax, 0x1c
push 0x76473c
push 1
push eax
call fcn.005ce020
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x47984c
imul eax, dword [esi + 0x64], 0x1c
push eax
push edi
push ebx
call fcn.0059de40
add esp, 0xc
cmp dword [esi + 0x64], edi
jle 0x479817
mov edx, edi
lea ecx, [ebx + 4]
push 2
pop eax
mov word [ecx - 4], ax
inc edi
mov eax, dword [esi + 0x5c]
mov ax, word [eax + edx + 4]
mov word [ecx - 2], ax
mov eax, dword [esi + 0x5c]
mov eax, dword [edx + eax]
lea edx, [edx + 6]
mov dword [ecx], eax
lea ecx, [ecx + 0x1c]
cmp edi, dword [esi + 0x64]
jl 0x4797f0
mov ecx, dword [esi + 0x78]
mov edx, ebx
push ebp
push 0x47973d
push dword [esi + 0x64]
mov ecx, dword [ecx + 0x1b8]
call fcn.0047fa0a
add esp, 0xc
push 1
push ebx
call fcn.005cdee0
pop ecx
pop ecx
jmp 0x479846
mov ecx, esi
call fcn.00479701
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, 0xfe
mov esi, 0xad7
push edi
push esi
mov edx, 0x764758
xor ecx, ecx
call fcn.0047145c
add esp, 0xc
push esi
push 0x764774
push 0x764790
call fcn.004010b4
add esp, 0xc
push edi
call fcn.005aae60
int3