joyce8/EMBER2024-capa huggingface dataset:
Function at 0x300d6d20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x300d6d41
mov eax, dword [esp + 0x30]
push eax
call fcn.30077120
add esp, 4
pop esi
add esp, 0x24
ret 8
mov eax, dword [eax + 0x78]
cmp eax, 7
push edi
jne 0x300d6da8
mov ecx, dword [esi + 4]
movzx edi, word [ecx + 0x5e]
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x18]
push edx
lea ecx, [eax + 0x10]
push edi
push ecx
add eax, 0x3c
push eax
call fcn.3008ab20
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x18]
push edx
push edi
push eax
add eax, 0x4c
push eax
call fcn.3008ab20
mov eax, dword [esi + 0x18]
movzx ecx, byte [eax + 0x20]
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
add esp, 0x20
push ecx
push edx
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.300d3fa0
pop edi
pop esi
add esp, 0x24
ret 8
test eax, eax
mov ecx, esi
jne 0x300d6de1
push eax
call fcn.300d5780
push 1
mov ecx, esi
mov edi, eax
call fcn.300d5780
mov ecx, dword [esi + 0x18]
movzx edx, byte [ecx]
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push ecx
push edx
push eax
push edi
mov ecx, esi
call fcn.300d3fa0
pop edi
pop esi
add esp, 0x24
ret 8
push ebx
push ebp
push 0
call fcn.300d5780
push 1
mov ecx, esi
mov ebp, eax
call fcn.300d5780
mov edi, eax
push 0
push edi
push ebp
call fcn.30077490
add esp, 0xc
test eax, eax
jne 0x300d6e54
mov eax, dword [esp + 0x38]
push eax
call fcn.30078a20
add esp, 4
test eax, eax
jne 0x300d6e54
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x2c]
test ecx, ecx
je 0x300d6e39
mov ecx, dword [ecx + 0x48]
test cl, 2
je 0x300d6e2f
mov eax, 1
test cl, 1
je 0x300d6e3e
or eax, 2
jmp 0x300d6e3e
mov eax, 0xff
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push eax
push ebx
push edx
push edi
push ebp
mov ecx, esi
call fcn.300d3fa0
jmp 0x300d6e67
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push edi
push eax
call fcn.30077da0
add esp, 0xc
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x300d6e87
push ebx
mov ecx, esi
call fcn.300d20e0
mov edx, dword [eax + 0x38]
neg edx
push edx
call fcn.30079160
add esp, 8
mov ecx, dword [esi + 0x18]
cmp dword [ecx + 0x78], 4
jne 0x300d6ee9
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x300d6ee9
mov edx, dword [eax + 0xc]
test edx, edx
jbe 0x300d6ee9
mov ecx, dword [ecx + 0x68]
mov eax, dword [ecx + 0x218]
test eax, eax
jne 0x300d6eb3
call fcn.300e4110
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x24], eax
call fcn.30077120
mov eax, dword [esp + 0x3c]
add esp, 4
lea edx, [esp + 0x20]
push edx
push 0x300d04b0
push eax
mov ecx, esi
call fcn.300d3890
push ebx
lea ecx, [esp + 0x28]
push ebx
push ecx
call fcn.30079280
add esp, 0xc
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x24
ret 8
Function at 0x300db4e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, ecx
mov eax, dword [ebp + 0x18]
xor ebx, ebx
cmp eax, ebx
push esi
push edi
je 0x300db56e
cmp dword [eax + 0x78], 9
jne 0x300db56e
mov eax, dword [ebp + 0x2c]
cmp eax, ebx
je 0x300db50e
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x300db50e
mov eax, dword [eax + 0x3e4]
jmp 0x300db510
xor eax, eax
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.30079470
add esp, 0xc
test al, al
je 0x300db5b8
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.30077890
mov edx, dword [ebp + 4]
mov ecx, dword [edx + 0x18]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call fcn.3006bcb0
push eax
call fcn.30077430
add esp, 8
test eax, eax
je 0x300db5b8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
cmp dword [esp + 0x44], ebx
je 0x300db5c4
mov ecx, ebp
call fcn.300d1800
test eax, eax
je 0x300db5b8
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push 1
push ecx
push edx
sub esp, 0xdc
mov ecx, esp
push eax
call fcn.300d6c90
mov ecx, ebp
call fcn.300dbd90
test eax, eax
je 0x300db5b8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
mov edi, dword [esp + 0x40]
lea ecx, [ebp + 0x7c]
push edi
push ecx
mov dword [esp + 0x4c], ebx
call fcn.30077430
add esp, 8
test eax, eax
je 0x300db6ba
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push ebx
push 1
push edx
push eax
mov ecx, ebp
call fcn.300da0a0
mov esi, dword [ebp + 0x4c]
test esi, esi
je 0x300db6ba
movsx eax, word [esi + 0x12]
mov edx, dword [edi + 4]
cmp eax, edx
jg 0x300db68a
movsx ecx, word [esi + 0x1a]
cmp edx, ecx
jge 0x300db68a
movsx edx, word [esi + 0x10]
mov dword [esp + 0x1c], eax
movsx eax, word [esi + 0x14]
mov dword [esp + 0x18], edx
movsx edx, word [esi + 0x16]
mov dword [esp + 0x20], eax
movsx eax, word [esi + 0x18]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [esi + 0x1c]
push 0
mov dword [esp + 0x28], edx
lea edx, [esp + 0x1c]
push edi
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], ecx
call fcn.300592e0
add esp, 0xc
test ax, ax
je 0x300db68a
movzx eax, byte [esi + 0x1d]
sub eax, 0
mov ebx, 1
je 0x300db67c
dec eax
je 0x300db677
dec eax
jne 0x300db68a
mov eax, dword [esi + 8]
mov cl, byte [esi + 0x1e]
add byte [eax + 0x2d], cl
jmp 0x300db68a
mov eax, dword [esi + 8]
jmp 0x300db686
mov eax, dword [esi + 8]
xor byte [eax + 0x2d], 1
mov eax, dword [esi + 0xc]
xor byte [eax + 0x2d], 1
mov esi, dword [esi]
test esi, esi
jne 0x300db600
test ebx, ebx
je 0x300db6ba
mov eax, dword [ebp + 0x50]
test eax, eax
je 0x300db6ba
nop
mov cl, byte [eax + 0x2d]
test cl, cl
je 0x300db6af
mov dword [esp + 0x44], 1
mov byte [eax + 0x2d], 0
mov eax, dword [eax + 0x20]
test eax, eax
jne 0x300db6a0
mov eax, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10
Function at 0x300e32e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov edx, ecx
mov ecx, dword [edx + 8]
mov eax, dword [edx + 4]
push esi
push edi
lea edi, [edx + 4]
add eax, ecx
add ecx, 2
mov dword [edi + 4], ecx
xor ecx, ecx
mov ch, byte [eax + 1]
mov dword [esp + 0x10], edx
mov cl, byte [eax]
push ecx
mov ecx, dword [edx + 0x2c]
call fcn.300e0cd0
mov esi, eax
test esi, esi
je 0x300e34aa
cmp dword [esi + 0x78], 3
jne 0x300e34aa
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov cl, byte [eax + edx]
inc eax
mov dword [edi + 4], eax
movzx eax, cl
shr eax, 6
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x300e34aa
cmp word [esi + 0x36], 0
je 0x300e34aa
push ebx
push ebp
mov ecx, esi
call fcn.300e0480
mov ebp, dword [esi + 0x74]
mov ebx, eax
cmp ebx, ebp
ja 0x300e3498
lea ecx, [esp + 0x1c]
call fcn.30004870
mov ecx, dword [esi + 0x70]
push ebp
push ebx
push ecx
lea ecx, [esp + 0x28]
call fcn.300dfc60
xor ebx, ebx
cmp word [esi + 0x36], bx
jbe 0x300e3456
push 0x14
call fcn.3007a1f0
add esp, 4
cmp eax, ebx
je 0x300e33a3
movzx edx, word [esi + 0x36]
push 1
push edx
mov ecx, eax
call fcn.3007b3d0
jmp 0x300e33a5
xor eax, eax
cmp word [esi + 0x36], bx
mov dword [esi + 0x24], eax
mov dword [esp + 0x14], ebx
jbe 0x300e3456
test byte [esi + 0x38], 4
lea ecx, [esp + 0x1c]
je 0x300e33cb
call fcn.3005e020
mov dword [esp + 0x10], eax
jmp 0x300e33d9
call fcn.3005dff0
movzx ax, al
mov word [esp + 0x10], ax
push 0xc
call fcn.3007a1f0
add esp, 4
mov ecx, edi
mov ebp, eax
call fcn.3005dff0
mov bl, al
cmp bl, 1
jbe 0x300e340a
mov ecx, edi
call fcn.3003d0f0
mov ecx, edi
mov dword [ebp], eax
call fcn.3003d0f0
mov dword [ebp + 4], eax
add bl, 0xfe
movzx ecx, bl
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 8]
shl ecx, 2
add eax, ecx
mov ecx, edi
mov dword [ebx + 8], eax
call fcn.3005dff0
movzx edx, al
movzx eax, word [esp + 0x10]
push ebp
mov dword [ebp + 8], edx
mov ecx, dword [esi + 0x24]
push eax
call fcn.3007b7f0
mov al, byte [ebx + 0x24]
test al, al
jne 0x300e3454
mov eax, dword [esp + 0x14]
movzx ecx, word [esi + 0x36]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x300e33b6
xor ebx, ebx
mov edi, dword [esp + 0x18]
mov al, byte [edi + 0x24]
test al, al
jne 0x300e3469
mov al, byte [esp + 0x3c]
test al, al
je 0x300e34a8
mov ecx, dword [esi + 0x24]
cmp ecx, ebx
je 0x300e3476
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x70], ebx
mov word [esi + 0x36], bx
mov eax, dword [edi + 0x2c]
mov ecx, dword [eax + 0xdc]
push 1
call fcn.300f8ab0
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x30
ret
mov ecx, dword [esi + 0x68]
mov ecx, dword [ecx + 0xdc]
push 1
call fcn.300f8ab0
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x300ebab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x24]
test ebx, ebx
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov byte [esp + 0xf], 1
je 0x300ebae1
mov eax, dword [ebx + 4]
test eax, eax
je 0x300ebae1
cmp esi, eax
jbe 0x300ebae1
mov ecx, esi
sub ecx, eax
cmp ecx, dword [ebx + 0x38]
jl 0x300ebb25
mov edx, edi
and edx, 0xfffff000
mov eax, dword [edx]
mov ecx, dword [eax + 0x138]
mov eax, dword [ecx + 0x578]
test eax, eax
je 0x300ebb2a
jmp 0x300ebb00
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x300ebb17
cmp esi, ecx
jbe 0x300ebb17
mov edx, dword [eax + 0x1d0]
add edx, ecx
cmp esi, edx
jb 0x300ebb23
mov eax, dword [eax + 0x28c]
test eax, eax
jne 0x300ebb00
jmp 0x300ebb2a
mov ebx, eax
mov byte [esp + 0xf], 0
mov ecx, dword [esp + 0x1c]
mov al, byte [esp + 0xf]
add esi, ecx
test al, al
push ebp
je 0x300ebb6e
mov ebp, dword [esp + 0x28]
cmp ebp, 0xffffffff
je 0x300ebb6e
lea eax, [ebp + 1]
push eax
call fcn.3007a1f0
add esp, 4
test eax, eax
je 0x300ebb70
mov ecx, ebp
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x14]
mov byte [eax + ebp], 0
jmp 0x300ebb70
mov eax, esi
mov dl, byte [esp + 0x48]
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
mov dword [edi + 0x7c], ecx
xor ecx, ecx
mov byte [edi + 0x78], dl
mov dl, byte [esp + 0x13]
test dl, dl
mov edx, dword [esp + 0x44]
setne cl
dec ecx
and ecx, ebx
push ecx
mov ecx, dword [esp + 0x30]
push edx
push ecx
push eax
mov ecx, esi
call fcn.300eb860
mov eax, dword [esi + 0x80]
test eax, eax
pop ebp
je 0x300ebbbc
dec dword [eax + 4]
jne 0x300ebbbc
push eax
call fcn.30208320
add esp, 4
test ebx, ebx
je 0x300ebbf6
mov eax, dword [ebx + 0x388]
test eax, eax
jne 0x300ebbee
push 8
call fcn.3007a1f0
add esp, 4
test eax, eax
je 0x300ebbe3
mov dword [eax], ebx
mov dword [eax + 4], 0
jmp 0x300ebbe5
xor eax, eax
mov dword [ebx + 0x388], eax
inc dword [eax + 4]
mov eax, dword [ebx + 0x388]
jmp 0x300ebbf8
xor eax, eax
test eax, eax
mov dword [esi + 0x80], eax
je 0x300ebc05
inc dword [eax + 4]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x84], edx
mov edx, dword [esp + 0x3c]
pop edi
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], ecx
mov dword [esi + 0x4c], edx
pop esi
pop ebx
add esp, 8
ret 0x30
Function at 0x300f7230
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x30
push ebx
mov ebx, dword [esp + 0x38]
push esi
push edi
xor edi, edi
mov esi, ecx
mov ecx, dword [ebx + 0x570]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov eax, dword [ecx + 0x218]
cmp eax, edi
jne 0x300f725f
call fcn.300e4110
push ebp
push eax
lea eax, [esp + 0x20]
push eax
call fcn.300216d0
mov eax, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
add esp, 8
test eax, eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
jle 0x300f72ac
mov al, byte [edi + ebp]
cmp al, 0x20
lea ecx, [esp + 0x10]
jne 0x300f729d
push 0x3029ba74
call fcn.30074c30
jmp 0x300f72a3
push eax
call fcn.30074af0
mov eax, dword [esp + 0x20]
inc edi
cmp edi, eax
jl 0x300f7286
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ecx + 0x84c]
mov eax, 1
cmp edx, eax
sete dl
mov byte [esi + 0x14], dl
mov ecx, dword [ebx + 0x1c]
cmp dword [ecx + 0x850], eax
sete dl
mov byte [esi + 0x15], dl
mov eax, dword [ebx + 0x1c]
mov edi, dword [eax + 0x8ac]
test edi, edi
setne cl
mov byte [esi + 0x16], cl
mov ecx, dword [esi]
mov dl, byte [ecx]
xor eax, eax
test dl, dl
pop ebp
je 0x300f7331
mov ebx, ecx
mov edi, ecx
mov dl, 0x32
mov cl, byte [edi]
cmp cl, 0x20
jne 0x300f730c
mov byte [esp + eax + 0x24], 0x25
inc eax
mov byte [esp + eax + 0x24], dl
inc eax
mov byte [esp + eax + 0x24], 0x30
jmp 0x300f7327
cmp cl, 0x2c
jne 0x300f7323
mov byte [esp + eax + 0x24], 0x25
inc eax
mov byte [esp + eax + 0x24], dl
inc eax
mov byte [esp + eax + 0x24], 0x43
jmp 0x300f7327
mov byte [esp + eax + 0x24], cl
mov cl, byte [ebx + 1]
inc eax
inc edi
inc ebx
test cl, cl
jne 0x300f72f3
mov byte [esp + eax + 0x24], 0
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x300f7343
mov eax, 0x30293680
movzx edx, byte [esi + 0x18]
movzx ecx, byte [esi + 0x17]
push edx
movzx edx, byte [esi + 0x16]
push ecx
movzx ecx, byte [esi + 0x15]
push edx
movzx edx, byte [esi + 0x14]
push ecx
mov ecx, dword [esi + 0x10]
push edx
push ecx
movzx ecx, byte [esi + 0xe]
push eax
movzx eax, byte [esi + 0xf]
lea edx, [esp + 0x40]
push edx
movzx edx, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 0xc]
push ecx
movzx ecx, byte [esi + 0xb]
push edx
movzx edx, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 9]
push ecx
movzx ecx, byte [esi + 8]
push edx
movzx edx, byte [esi + 7]
push eax
movzx eax, byte [esi + 6]
push ecx
movzx ecx, byte [esi + 5]
push edx
movzx edx, byte [esi + 4]
push eax
mov eax, dword [esp + 0x8c]
push ecx
push edx
push str.A_bSA_bSV_bEV_bMP3_bAE_bVE_bACC_bPR_bSP_bSB_bDEB_bV_s_sPT_sAVD_bLFD_bWD_bTLS_b
push eax
call fcn.30075810
mov ecx, dword [esp + 0x64]
push ecx
call fcn.30208320
mov edx, dword [esp + 0x74]
xor eax, eax
add esp, 0x5c
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call fcn.30208320
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x30
ret 8
Function at 0x300f7c40
Capabilities:
Parse credit card information

Disassembly:
sub esp, 8
push ebx
mov bl, byte [eax]
test bl, bl
push esi
mov byte [esp + 0xb], 0
mov esi, eax
je 0x300f7ca1
cmp bl, 0x3d
mov byte [esp + 0xc], bl
je 0x300f7ca1
cmp bl, 0x3b
je 0x300f7ca1
cmp bl, 0x2f
je 0x300f7ca1
cmp bl, 0x23
je 0x300f7ca1
cmp bl, 0x3f
je 0x300f7ca1
cmp bl, 0x20
je 0x300f7ca1
cmp bl, 0x3a
je 0x300f7ca9
mov eax, dword [esp + 0xc]
push eax
call fcn.300f7a50
add esp, 4
test al, al
jne 0x300f7c99
cmp bl, 0x2d
je 0x300f7c99
cmp bl, 0x5b
je 0x300f7c99
mov byte [esp + 0xb], 1
mov bl, byte [esi + 1]
inc esi
test bl, bl
jne 0x300f7c52
pop esi
xor al, al
pop ebx
add esp, 8
ret
mov al, byte [esp + 0xb]
test al, al
pop esi
setne al
pop ebx
add esp, 8
ret

Function at 0x300f8fc0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
mov cx, word [edx]
xor eax, eax
test cx, cx
je 0x300f8fee
push esi
mov esi, eax
shl eax, 4
sar esi, 0x1c
xor esi, eax
movzx eax, cx
add edx, 2
xor ecx, ecx
mov cx, word [edx]
xor eax, esi
test cx, cx
jne 0x300f8fd1
pop esi
ret 4

Function at 0x300f9000
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
mov eax, dword [ebx + 0xd48]
mov ecx, dword [ebx + 0xd4c]
push edi
lea edi, [esi*4]
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
call fcn.3007a1f0
mov edx, eax
mov ecx, edi
mov dword [ebx + 0xd48], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
xor eax, eax
add esp, 4
cmp ecx, eax
mov dword [ebx + 0xd4c], esi
mov dword [ebx + 0xd54], eax
lea ebp, [esi - 1]
mov dword [esp + 0x1c], eax
jle 0x300f9109
mov edi, edi
mov ecx, dword [esp + 0x14]
mov edi, dword [ecx + eax*4]
and edi, 0xfffffff8
cmp edi, 1
jbe 0x300f90f8
mov ecx, edi
xor esi, esi
call fcn.30075ed0
mov cx, word [eax]
test cx, cx
je 0x300f90ae
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x300f9090
mov edx, dword [ebx + 0xd48]
and esi, ebp
and esi, 0x7fffffff
cmp dword [edx + esi*4], 0
mov eax, 7
je 0x300f90dc
mov ecx, edx
lea esp, [esp]
add esi, eax
and esi, ebp
mov edx, dword [ecx + esi*4]
inc eax
test edx, edx
jne 0x300f90d0
mov ecx, edi
call fcn.30075ed0
movzx eax, byte [eax]
mov ecx, dword [ebx + 0xd48]
and eax, 7
or eax, edi
mov dword [ecx + esi*4], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x300f9070
mov edx, dword [esp + 0x14]
push edx
call fcn.30208320
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x300ff110
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [eax + 0x18]
mov esi, ecx
mov ecx, edi
and ecx, 7
cmp cl, 7
jne 0x300ff12b
and edi, 0xfffffff8
mov edi, dword [edi + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx + 0x1c]
mov ecx, dword [ecx + 0x894]
and edi, 0xfffffff8
cmp ecx, 5
je 0x300ff143
cmp ecx, 6
jne 0x300ff147
mov byte [esi + 0x18], 1
mov edx, dword [eax]
mov ecx, dword [edx + 0x1c]
mov edx, dword [ecx + 0x84c]
test edx, edx
setne dl
mov byte [esi + 0x14], dl
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
mov ecx, dword [edx + 0x850]
test ecx, ecx
setne cl
mov byte [esi + 0x15], cl
mov edx, dword [eax]
mov ecx, dword [edx + 0x1c]
mov edx, dword [ecx + 0x8ac]
test edx, edx
setne dl
mov byte [esi + 0x16], dl
mov eax, dword [eax]
mov ecx, dword [eax + 0x7c4]
mov edx, dword [ecx]
push edx
push str.serverString
mov ecx, edi
call fcn.300ee940
mov eax, dword [esi]
push eax
push str.version
mov ecx, edi
call fcn.300ee940
movzx ecx, byte [esi + 4]
push ecx
push str.hasAudio
mov ecx, edi
call fcn.300f0610
movzx edx, byte [esi + 5]
push edx
push str.hasStreamingAudio
mov ecx, edi
call fcn.300f0610
movzx eax, byte [esi + 6]
push eax
push str.hasStreamingVideo
mov ecx, edi
call fcn.300f0610
movzx ecx, byte [esi + 7]
push ecx
push str.hasEmbeddedVideo
mov ecx, edi
call fcn.300f0610
movzx edx, byte [esi + 8]
push edx
push 0x3029be38
mov ecx, edi
call fcn.300f0610
movzx eax, byte [esi + 9]
push eax
push 0x3029be28
mov ecx, edi
call fcn.300f0610
movzx ecx, byte [esi + 0xa]
push ecx
push str.hasVideoEncoder
mov ecx, edi
call fcn.300f0610
movzx edx, byte [esi + 0xb]
push edx
push 0x3029be04
mov ecx, edi
call fcn.300f0610
movzx eax, byte [esi + 0xc]
push eax
push str.hasPrinting
mov ecx, edi
call fcn.300f0610
movzx ecx, byte [esi + 0xd]
push ecx
push str.hasScreenPlayback
mov ecx, edi
call fcn.300f0610
movzx edx, byte [esi + 0xe]
push edx
push 0x3029bdd0
mov ecx, edi
call fcn.300f0610
movzx eax, byte [esi + 0xf]
push eax
push str.isDebugger
mov ecx, edi
call fcn.300f0610
mov ecx, dword [esi + 0x10]
push ecx
push str.playerType
mov ecx, edi
call fcn.300ee940
movzx edx, byte [esi + 0x14]
push edx
push 0x3029bda4
mov ecx, edi
call fcn.300f0610
movzx eax, byte [esi + 0x15]
push eax
push str.localFileReadDisable
mov ecx, edi
call fcn.300f0610
movzx ecx, byte [esi + 0x16]
push ecx
push str.windowlessDisable
mov ecx, edi
call fcn.300f0610
movzx edx, byte [esi + 0x17]
push edx
push 0x3029bd84
mov ecx, edi
call fcn.300f0610
movzx eax, byte [esi + 0x18]
push eax
push 0x3029bd70
mov ecx, edi
call fcn.300f0610
pop edi
pop esi
ret 4
Function at 0x301009a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, ecx
mov ecx, ebx
call fcn.30075ed0
mov ecx, ebx
mov ebp, eax
xor esi, esi
call fcn.30075ed0
mov cx, word [eax]
test cx, cx
je 0x301009e2
mov edx, esi
sar edx, 0x1c
shl esi, 4
movzx ecx, cx
xor edx, esi
xor edx, ecx
add eax, 2
xor ecx, ecx
mov cx, word [eax]
test cx, cx
mov esi, edx
jne 0x301009c4
push esi
push ebp
mov ecx, edi
call fcn.300fdb20
mov edx, dword [edi + 0xd48]
mov ecx, dword [edx + eax*4]
cmp ecx, 1
ja 0x30100a11
push esi
mov esi, dword [esp + 0x18]
push eax
push ebx
push esi
mov ecx, edi
call fcn.300fda80
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
and ecx, 0xfffffffd
or ecx, 5
pop ebp
mov dword [eax], ecx
pop ebx
ret 8
Function at 0x30104d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call fcn.300c3130
mov ebp, dword [esp + 0x34]
mov esi, dword [ebp + 0x54]
test esi, esi
mov byte [esp + 0x13], 0
je 0x30104f72
mov ebx, dword [esi + 0x18]
test ebx, ebx
mov dword [esp + 0x18], ebx
je 0x30104f72
mov eax, dword [ebp + 0xc0]
mov ecx, dword [eax + 0x34]
push ecx
lea ecx, [esp + 0x20]
call fcn.300c3c90
mov eax, dword [ebx + 0x78]
add eax, 0xfffffffe
cmp eax, 0x5f
ja case.0x30104db7.3
movzx edx, byte [eax + 0x30104fb4]
jmp dword [edx*4 + 0x30104fa0]
mov ecx, dword [edi + 0x808]
test ecx, ecx
jne 0x30104dcc
xor esi, esi
jmp 0x30104dd3
call fcn.300c42e0
mov esi, eax
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x30104e1f
test esi, esi
je 0x30104e1f
mov ecx, dword [edi + 0xbfc]
mov dl, byte [ecx + 0x21d]
push eax
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
mov byte [esp + 0x3c], dl
call fcn.30101cc0
mov ecx, dword [esp + 0x34]
mov eax, dword [eax]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.300ec0e0
test eax, eax
mov dword [esp + 0x18], 0
jne case.0x30104db7.3
mov ecx, dword [ebp + 0xc0]
push 0
push str.MovieClip
push ecx
mov ecx, edi
call fcn.301021c0
jmp 0x30104f72
mov ebx, str.Button
jmp 0x30104e4c
mov ebx, str.TextField
jmp 0x30104e4c
mov ebx, str.Video
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], edx
call fcn.30005ac0
test al, al
je 0x30104f72
mov esi, dword [edi + 0x808]
test esi, esi
je 0x30104f72
mov ecx, esi
call fcn.300c42b0
test eax, eax
jne 0x30104e84
mov ecx, edi
call fcn.30101760
mov ecx, esi
call fcn.300c42b0
test eax, eax
je 0x30104f72
push ebx
mov ecx, eax
call fcn.300ed720
mov esi, eax
test esi, esi
je 0x30104f72
mov ecx, esi
call fcn.30018650
test al, al
je 0x30104f72
mov ecx, esi
call fcn.30007f30
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x30104f72
mov ecx, ebp
call fcn.30043e80
mov esi, eax
mov ecx, dword [esi + 4]
push 1
inc ecx
push 0
mov dword [esi + 4], ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 0xc44]
mov edx, dword [ebp + 0xc0]
push eax
push 1
push 0
push ecx
push ebp
push edx
mov ecx, edi
mov byte [esp + 0x33], 1
call fcn.300fbca0
mov ecx, edi
call fcn.30003480
cmp ebp, dword [esi]
je 0x30104f14
xor ebp, ebp
mov ecx, dword [esi + 4]
dec ecx
mov eax, ecx
test eax, eax
mov dword [esi + 4], ecx
jg 0x30104f2a
push esi
call fcn.30208320
add esp, 4
mov eax, dword [ebx + 0x78]
cmp eax, 6
je 0x30104f37
cmp eax, 0x61
jne 0x30104f72
test ebp, ebp
je 0x30104f8c
mov eax, dword [ebp + 0x5c]
test eax, eax
je 0x30104f47
cmp dword [eax], 0
jne 0x30104f72
mov ecx, dword [ebp + 0xc0]
call fcn.300ef150
test al, 1
je 0x30104f72
mov ecx, dword [edi + 0x540]
push SysReAllocString
push 0
push 0
push 0
push ebp
push 0
push 0
push edi
call fcn.300be3e0
test ebp, ebp
je 0x30104f8c
mov al, byte [esp + 0x13]
test al, al
jne 0x30104f8c
mov ecx, ebp
call fcn.300e7f30
mov ecx, ebp
call fcn.300ef360
lea ecx, [esp + 0x1c]
call fcn.300c3150
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4