joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007c840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x40
push ebp
mov ebp, dword [esp + 0x48]
push edi
mov edi, eax
test edi, edi
jne 0x1007c85a
pop edi
mov eax, 1
pop ebp
add esp, 0x40
ret
cmp dword [esp + 0x50], 0
je 0x1007c84f
cmp dword [esp + 0x54], 0
je 0x1007c84f
cmp dword [esp + 0x58], 0
je 0x1007c84f
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x1007c84f
push ebx
mov dword [eax], 0
lea eax, [esp + 0xc]
push esi
push eax
mov eax, ebp
call fcn.1007c160
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, 0xffffffff
je 0x1007ca40
jmp 0x1007c8a0
cmp eax, ebp
je 0x1007c8ab
mov ebp, eax
jmp 0x1007c9f8
lea ecx, [esp + 0x10]
push ecx
mov eax, ebp
mov ebx, edi
call fcn.1007c1d0
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, 0xffffffff
je 0x1007ca40
cmp eax, ebp
je 0x1007c8d4
mov ebp, eax
jmp 0x1007c9f8
lea edx, [esp + 0x10]
push edx
push edi
mov eax, ebp
call fcn.1007c260
mov esi, dword [esp + 0x18]
add esp, 8
cmp esi, 0xffffffff
je 0x1007ca40
cmp esi, ebp
je 0x1007c8fc
mov ebp, esi
jmp 0x1007c9f8
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x28
push esi
push edi
call fcn.1007c650
mov eax, dword [esp + 0x30]
add esp, 0x18
cmp eax, 0xffffffff
je 0x1007ca40
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x48]
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
push ecx
push ebx
push edx
push eax
push esi
push edi
call fcn.1007c720
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x50]
push edx
push 0x7b
push esi
push edi
call fcn.1007c650
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x7c]
push edx
push 0x3b
push esi
push edi
call fcn.1007c650
mov eax, dword [esp + 0x74]
add esp, 0x50
cmp eax, 0xffffffff
je 0x1007ca40
mov ecx, dword [esp + 0x28]
cmp ecx, 0xffffffff
je 0x1007ca40
mov edx, dword [esp + 0x2c]
cmp edx, ebx
jge 0x1007c9cf
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x3c]
push edx
push eax
add ecx, esi
push ecx
push edi
call fcn.1007c480
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x28]
push ecx
push edx
push eax
push edi
call fcn.1007c5a0
add esp, 0x24
jmp 0x1007c9f3
cmp dword [esp + 0x3c], 0xffffffff
je 0x1007ca1e
mov ecx, dword [esp + 0x40]
cmp ecx, edx
jl 0x1007c9e2
cmp ecx, ebx
jge 0x1007ca1e
lea ecx, [esp + 0x14]
push ecx
push 0
push esi
push edi
call fcn.1007c5a0
add esp, 0x10
mov ebp, dword [esp + 0x14]
inc ebp
lea edx, [esp + 0x10]
push edx
mov eax, ebp
call fcn.1007c160
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, 0xffffffff
jne 0x1007c8a0
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x40
ret
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov dword [ecx], esi
mov ecx, dword [esp + 0x60]
add eax, esi
mov dword [edx], eax
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x64]
mov dword [ecx], eax
mov dword [edx], 1
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x40
ret
Function at 0x100909f0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
jne 0x100909fe
lea eax, [edi + 1]
pop edi
ret
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x10090a0d
lea eax, [esi + 1]
pop esi
pop edi
ret
push ebx
mov ebx, dword [esi]
push ebp
mov ebp, dword [sym.imp.MSVCR90.dll_fprintf]
push 1
push str._nPixacomp_Version__d_n
push edi
mov dword [esp + 0x20], ebx
call ebp
push ebx
push str.Number_of_pixcomp___d
push edi
call ebp
mov eax, dword [esi + 0xc]
push eax
push edi
call sym.leptonlib.dll_boxaWriteStream
xor ebx, ebx
add esp, 0x20
cmp dword [esp + 0x14], ebx
jle 0x10090ab8
test ebx, ebx
jl 0x10090aae
cmp ebx, dword [esi]
jge 0x10090aae
mov ecx, dword [esi + 8]
mov esi, dword [ecx + ebx*4]
test esi, esi
je 0x10090aae
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push edx
push eax
push ecx
push ebx
push str.__Pixcomp__d_:_w___d__h___d__d___d_n
push edi
call ebp
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x14]
push edx
push eax
push ecx
push str.____comptype___d__size___d__cmapflag___d_n
push edi
call ebp
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
push edx
push eax
push str.____xres___d__yres___d_n
push edi
call ebp
mov ecx, dword [esi + 0x24]
mov edx, dword [esi + 0x20]
push edi
push ecx
push 1
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
inc ebx
add esp, 0x4c
cmp ebx, dword [esp + 0x14]
jge 0x10090ab8
mov esi, dword [esp + 0x18]
jmp 0x10090a43
pop ebp
pop ebx
pop esi
mov eax, 1
pop edi
ret
pop ebp
pop ebx
pop esi
xor eax, eax
pop edi
ret
Function at 0x10091270
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [esp + 0x34]
test ebx, ebx
jne 0x10091283
xor eax, eax
pop ebx
add esp, 0x2c
ret
push esi
mov esi, dword [sym.imp.MSVCR90.dll_fscanf]
lea eax, [esp + 0x10]
push eax
push str._nPixacomp_Version__d_n
push ebx
call esi
add esp, 0xc
cmp eax, 1
jne 0x100912d1
cmp dword [esp + 0x10], eax
jne 0x100912d1
lea ecx, [esp + 8]
push ecx
push str.Number_of_pixcomp___d
push ebx
call esi
add esp, 0xc
cmp eax, 1
jne 0x100912d1
mov edx, dword [esp + 8]
push edx
call sym.leptonlib.dll_pixacompCreate
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
test esi, esi
jne 0x100912d9
pop esi
xor eax, eax
pop ebx
add esp, 0x2c
ret
push edi
push ebx
call sym.leptonlib.dll_boxaReadStream
mov edi, eax
add esp, 4
test edi, edi
jne 0x100912f0
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
push ebp
add esi, 0xc
push esi
call sym.leptonlib.dll_boxaDestroy
xor ebp, ebp
add esp, 4
mov dword [esi], edi
cmp dword [esp + 0x10], ebp
jle 0x1009140e
jmp 0x10091310
push 0x28
push 1
call dword [sym.imp.MSVCR90.dll_calloc]
mov esi, eax
add esp, 8
test esi, esi
je 0x1009141a
mov edi, dword [sym.imp.MSVCR90.dll_fscanf]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x44]
push eax
push str.__Pixcomp__d_:_w___d__h___d__d___d_n
push ebx
call edi
add esp, 0x18
cmp eax, 4
jne 0x1009141a
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x38]
push eax
push str.____comptype___d__size___d__cmapflag___d_n
push ebx
call edi
add esp, 0x14
cmp eax, 3
jne 0x1009141a
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x2c]
push edx
push str.____xres___d__yres___d_n
push ebx
call edi
add esp, 0x10
cmp eax, 2
jne 0x1009141a
mov eax, dword [esp + 0x40]
push eax
push 1
call dword [sym.imp.MSVCR90.dll_calloc]
mov edi, eax
add esp, 8
test edi, edi
je 0x1009141a
mov ecx, dword [esp + 0x40]
push ebx
push 1
push ecx
push edi
call dword [sym.imp.MSVCR90.dll_fread]
mov edx, dword [esp + 0x2c]
mov dword [esi], edx
mov eax, dword [esp + 0x30]
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x34]
mov dword [esi + 8], ecx
mov edx, dword [esp + 0x38]
mov dword [esi + 0xc], edx
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x10], eax
mov ecx, dword [esp + 0x40]
mov dword [esi + 0x14], ecx
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], edi
mov eax, dword [esp + 0x50]
push esi
push ecx
mov dword [esi + 0x24], eax
call sym.leptonlib.dll_pixacompAddPixcomp
inc ebp
add esp, 0x18
cmp ebp, dword [esp + 0x10]
jl 0x10091310
mov eax, dword [esp + 0x14]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2c
ret
Function at 0x10092df0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jne 0x10092e03
xor eax, eax
pop ebx
add esp, 0x10
ret
push ebx
call sym.leptonlib.dll_numaGetRefcount
add esp, 4
cmp eax, 0x10
jne 0x10092dfc
push esi
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
call sym.leptonlib.dll_pixGetDimensions
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
push 8
push edx
push eax
call sym.leptonlib.dll_pixCreate
mov esi, eax
add esp, 0x1c
mov dword [esp + 0x14], esi
test esi, esi
jne 0x10092e48
pop esi
pop ebx
add esp, 0x10
ret
push ebp
push edi
push ebx
push esi
call sym.leptonlib.dll_pixCopyResolution
push ebx
call sym.leptonlib.dll_dpixGetRefcount
push ebx
mov edi, eax
call sym.leptonlib.dll_pixGetData
push esi
mov ebx, eax
call sym.leptonlib.dll_dpixGetRefcount
push esi
mov ebp, eax
call sym.leptonlib.dll_pixGetData
add esp, 0x18
cmp dword [esp + 0x24], 0
mov dword [esp + 0x10], 0
jle 0x10092f1e
lea ecx, [ebp*4]
mov dword [esp + 0x18], ecx
mov ebp, eax
xor esi, esi
cmp dword [esp + 0x28], esi
jne 0x10092eca
test edi, edi
jle 0x10092efa
mov edi, edi
mov eax, dword [ebx + esi*4]
mov edx, eax
shr edx, 8
xor edx, eax
shr eax, 8
movzx eax, ax
and edx, 0xff
xor edx, eax
push edx
push esi
push ebp
call sym.leptonlib.dll_l_setDataTwoBytes
inc esi
add esp, 0xc
cmp esi, edi
jl 0x10092ea0
jmp 0x10092efa
test edi, edi
jle 0x10092efa
mov edi, edi
mov eax, dword [ebx + esi*4]
mov ecx, eax
mov edx, eax
shr ecx, 0x10
shr edx, 8
xor ecx, edx
and ecx, 0xff
shr eax, 0x10
xor ecx, eax
push ecx
push esi
push ebp
call sym.leptonlib.dll_l_setDataTwoBytes
inc esi
add esp, 0xc
cmp esi, edi
jl 0x10092ed0
mov ecx, dword [esp + 0x10]
add ebp, dword [esp + 0x18]
inc ecx
lea eax, [edi*4]
add ebx, eax
cmp ecx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
jl 0x10092e92
mov esi, dword [esp + 0x1c]
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x10097c10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
jne 0x10097c1e
lea eax, [ebp + 1]
pop ebp
ret
cmp dword [esp + 0xc], 0
push ebx
push edi
je 0x10097c9e
cmp dword [esp + 0x18], 0
je 0x10097c9e
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x10097c9e
mov edi, dword [esp + 0x20]
test edi, edi
je 0x10097c9e
push ebp
call sym.leptonlib.dll_fnbytesInFile
add esp, 4
cmp eax, 0x28
jl 0x10097c9e
push esi
push 1
push 0x28
call dword [sym.imp.MSVCR90.dll_calloc]
mov esi, eax
add esp, 8
test esi, esi
jne 0x10097c68
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
push ebp
push 1
push 0x28
push esi
call dword [sym.imp.MSVCR90.dll_fread]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
push edi
push ebx
push ecx
push edx
push esi
call sym.leptonlib.dll_sreadHeaderPng
push esi
mov edi, eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 0x2c
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret
pop edi
pop ebx
mov eax, 1
pop ebp
ret
Function at 0x1009c1c0
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
jne 0x1009c1d0
mov eax, 1
pop edi
ret
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1009c1c9
push eax
call sym.leptonlib.dll_pixConvertForPSWrap
add esp, 4
mov dword [esp + 8], eax
test eax, eax
je 0x1009c1c9
fld dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push esi
push ecx
mov ecx, dword [esp + 0x1c]
fstp dword [esp]
push ecx
push edx
push eax
call sym.leptonlib.dll_pixWriteStringPS
add esp, 0x10
mov esi, eax
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009c210
push edi
sub eax, edx
push eax
push 1
push esi
call dword [sym.imp.MSVCR90.dll_fwrite]
push esi
call dword [sym.imp.MSVCR90.dll_free]
lea eax, [esp + 0x20]
push eax
call sym.leptonlib.dll_pixDestroy
add esp, 0x18
pop esi
xor eax, eax
pop edi
ret

Function at 0x100a4670
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [0x10185cf0]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x20]
test ebx, ebx
jne 0x100a46a2
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.101407ce
add esp, 0x14
ret
mov dword [ebx], 0
test esi, esi
je 0x100a468c
push edi
mov edi, dword [sym.imp.MSVCR90.dll_rewind]
push esi
call edi
push esi
call sym.leptonlib.dll_fnbytesInFile
add esp, 8
cmp eax, 0xc
jl 0x100a46dc
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
cmp eax, 0xc
je 0x100a46f3
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.101407ce
add esp, 0x14
ret
push esi
call edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
call sym.leptonlib.dll_findFileFormatBuffer
mov eax, dword [esp + 0x18]
add esp, 0xc
cmp eax, 4
jne 0x100a4726
lea eax, [esp + 0xc]
push eax
push esi
call sym.leptonlib.dll_findTiffCompression
push esi
call edi
mov eax, dword [esp + 0x18]
add esp, 0xc
xor ecx, ecx
test eax, eax
sete cl
pop edi
mov dword [ebx], eax
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.101407ce
add esp, 0x14
ret
Function at 0x100af2e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push edi
mov edi, dword [esp + 0x20]
test edi, edi
jne 0x100af2f3
xor eax, eax
pop edi
add esp, 0x18
ret
push esi
mov esi, dword [sym.imp.MSVCR90.dll_fscanf]
lea eax, [esp + 0x14]
push eax
push str._nSarray_Version__d_n
push edi
call esi
add esp, 0xc
cmp eax, 1
jne 0x100af315
cmp dword [esp + 0x14], eax
je 0x100af31d
pop esi
xor eax, eax
pop edi
add esp, 0x18
ret
push ebx
lea ecx, [esp + 0x10]
push ecx
push str.Number_of_strings___d_n
push edi
call esi
mov edx, dword [esp + 0x1c]
push edx
call sym.leptonlib.dll_sarrayCreate
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x100af345
pop ebx
pop esi
pop edi
add esp, 0x18
ret
push ebp
mov ebp, 0x201
push 1
push ebp
call dword [sym.imp.MSVCR90.dll_calloc]
mov esi, eax
add esp, 8
test esi, esi
jne 0x100af365
pop ebp
pop ebx
pop esi
pop edi
add esp, 0x18
ret
cmp dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
jle 0x100af42e
jmp 0x100af380
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push ecx
push str._d__d_:
push edi
call dword [sym.imp.MSVCR90.dll_fscanf]
lea edx, [ebp - 5]
add esp, 0x10
cmp dword [esp + 0x10], edx
jle 0x100af3c8
push esi
call dword [sym.imp.MSVCR90.dll_free]
fild dword [esp + 0x14]
fmul qword [0x10146890]
call fcn.10140710
mov ebp, eax
push 1
push ebp
call dword [sym.imp.MSVCR90.dll_calloc]
add esp, 0xc
mov esi, eax
mov eax, dword [esp + 0x10]
push edi
add eax, 3
push eax
push 1
push esi
call dword [sym.imp.MSVCR90.dll_fread]
mov ecx, dword [esp + 0x20]
lea edi, [esi + 2]
add esp, 0x10
mov byte [ecx + esi + 2], 0
test edi, edi
je 0x100af417
mov eax, dword [ebx + 4]
cmp eax, dword [ebx]
mov dword [esp + 0x20], eax
jl 0x100af401
push ebx
call sym.leptonlib.dll_lqueueExtendArray
add esp, 4
push edi
call sym.leptonlib.dll_stringNew
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x24]
add esp, 4
mov dword [edx + ecx*4], eax
inc dword [ebx + 4]
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x2c]
inc eax
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
jl 0x100af380
push 0x101437f4
push edi
call dword [sym.imp.MSVCR90.dll_fscanf]
push esi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 0xc
pop ebp
mov eax, ebx
pop ebx
pop esi
pop edi
add esp, 0x18
ret
Function at 0x100af4b0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x14c
mov eax, dword [0x10185cf0]
xor eax, esp
mov dword [esp + 0x148], eax
push edi
mov edi, dword [esp + 0x154]
test edi, edi
jne 0x100af4e8
xor eax, eax
pop edi
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.101407ce
add esp, 0x14c
ret
push esi
push 0
push 0x101482f0
push 0x101482ec
push edi
call sym.leptonlib.dll_stringReplaceEachSubstr
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x100af50f
push edi
call sym.leptonlib.dll_stringNew
add esp, 4
mov esi, eax
push ebx
push ebp
push 0x101482e8
push esi
call sym.leptonlib.dll_stringJoin
mov ebp, dword [sym.imp.MSVCR90.dll_free]
mov ebx, eax
push esi
mov dword [esp + 0x1c], ebx
call ebp
mov eax, ebx
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100af533
sub eax, edx
inc eax
cmp eax, 0x104
ja 0x100af589
mov edi, dword [sym.imp.MSVCR90.dll_calloc]
push 0x10
push 1
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x100af581
push 4
push 0x32
call edi
add esp, 8
mov dword [esi + 0xc], eax
test eax, eax
jne 0x100af56d
xor esi, esi
jmp 0x100af581
mov dword [esi], 0x32
mov dword [esi + 4], 0
mov dword [esi + 8], 1
mov dword [esp + 0x14], esi
test esi, esi
jne 0x100af596
push ebx
call ebp
add esp, 4
xor eax, eax
jmp 0x100af623
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x100af5c1
lea ecx, [esp + 0x14]
push ecx
call sym.leptonlib.dll_sarrayDestroy
push ebx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 8
xor eax, eax
jmp 0x100af623
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x18]
push edx
push ebp
call ebx
test eax, eax
je 0x100af60c
test byte [esp + 0x18], 0x10
jne 0x100af600
mov edi, dword [esi + 4]
cmp edi, dword [esi]
jl 0x100af5ea
push esi
call sym.leptonlib.dll_lqueueExtendArray
add esp, 4
lea eax, [esp + 0x44]
push eax
call sym.leptonlib.dll_stringNew
mov ecx, dword [esi + 0xc]
add esp, 4
mov dword [ecx + edi*4], eax
inc dword [esi + 4]
lea edx, [esp + 0x18]
push edx
push ebp
call ebx
test eax, eax
jne 0x100af5d3
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x158]
pop ebp
pop ebx
pop esi
pop edi
xor ecx, esp
call fcn.101407ce
add esp, 0x14c
ret
Function at 0x100b00f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
test esi, esi
jne 0x100b0103
xor eax, eax
pop esi
add esp, 0x1c
ret
push esi
call sym.leptonlib.dll_numaGetRefcount
add esp, 4
cmp eax, 0x20
jne 0x100b00fc
push edi
mov edi, dword [esp + 0x2c]
cmp edi, 1
jl 0x100b0265
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x100b0131
mov dword [esp + 8], 0x18
jmp 0x100b0151
cmp eax, 1
jne 0x100b0140
mov dword [esp + 8], 0x10
jmp 0x100b0151
cmp eax, 2
jne 0x100b0265
mov dword [esp + 8], 8
push ebx
push ebp
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
call sym.leptonlib.dll_pixGetDimensions
push esi
call sym.leptonlib.dll_pixGetData
push esi
mov dword [esp + 0x2c], eax
call sym.leptonlib.dll_dpixGetRefcount
mov esi, eax
mov eax, dword [esp + 0x30]
cdq
idiv edi
push 8
mov ebp, eax
mov eax, dword [esp + 0x38]
cdq
idiv edi
mov edi, eax
push edi
push ebp
call sym.leptonlib.dll_pixCreate
mov ebx, eax
add esp, 0x24
mov dword [esp + 0x28], ebx
test ebx, ebx
jne 0x100b01a7
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x1c
ret
mov edx, dword [esp + 0x30]
push edx
push ebx
call sym.leptonlib.dll_pixCopyResolution
fild dword [esp + 0x3c]
fld1
fdivrp st(1)
fstp dword [esp + 0x38]
fld dword [esp + 0x38]
fst dword [esp + 4]
fstp dword [esp]
push ebx
call sym.leptonlib.dll_pixScaleResolution
push ebx
call sym.leptonlib.dll_pixGetData
push ebx
mov dword [esp + 0x44], eax
call sym.leptonlib.dll_dpixGetRefcount
add esp, 0x14
test edi, edi
jle 0x100b025b
imul esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
add eax, eax
add eax, eax
add esi, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
add esi, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], edi
jmp 0x100b0210
xor esi, esi
mov edi, eax
test ebp, ebp
jle 0x100b0240
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
shr edx, cl
and edx, 0xff
push edx
push esi
push ebx
call sym.leptonlib.dll_l_setDataByte
mov eax, dword [esp + 0x40]
add eax, eax
add eax, eax
inc esi
add esp, 0xc
add edi, eax
cmp esi, ebp
jl 0x100b0218
mov eax, dword [esp + 0x30]
add eax, dword [esp + 0x20]
add ebx, dword [esp + 0x24]
sub dword [esp + 0x14], 1
mov dword [esp + 0x30], eax
jne 0x100b0210
mov ebx, dword [esp + 0x28]
pop ebp
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x1c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
Function at 0x100b8480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 0xc]
sub esp, 0x38
test edx, edx
jle 0x100b85f5
mov eax, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x50]
lea ecx, [eax*4]
mov eax, dword [esp + 0x54]
push ebp
mov dword [esp + 0x3c], ecx
push esi
mov esi, dword [esp + 0x48]
mov ecx, eax
shl ecx, 5
push edi
mov edi, dword [esp + 0x64]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x54], esi
mov dword [esp + 0x10], edx
xor esi, esi
cmp dword [esp + 0x50], esi
jle 0x100b85dc
lea edx, [eax + eax*2]
lea ecx, [ebx + edx*4]
mov edx, eax
shl edx, 4
add edx, ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [eax + eax*4]
lea edx, [ebx + ecx*4]
lea ecx, [eax + eax*2]
mov dword [esp + 0x1c], edx
lea edx, [ebx + ecx*8]
lea ecx, [eax*8]
sub ecx, eax
mov dword [esp + 0x20], edx
lea edx, [ebx + ecx*4]
mov dword [esp + 0x24], edx
push esi
push ebx
call sym.leptonlib.dll_l_getDataByte
mov ebp, eax
mov eax, dword [esp + 0x68]
lea eax, [ebx + eax*4]
push esi
push eax
call sym.leptonlib.dll_l_getDataByte
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x4c], eax
lea eax, [ebx + ecx*8]
push esi
push eax
call sym.leptonlib.dll_l_getDataByte
mov edx, dword [esp + 0x2c]
push esi
push edx
mov dword [esp + 0x58], eax
call sym.leptonlib.dll_l_getDataByte
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x38]
push esi
push eax
call sym.leptonlib.dll_l_getDataByte
mov ecx, dword [esp + 0x44]
push esi
push ecx
mov dword [esp + 0x60], eax
call sym.leptonlib.dll_l_getDataByte
mov edx, dword [esp + 0x50]
push esi
push edx
mov dword [esp + 0x64], eax
call sym.leptonlib.dll_l_getDataByte
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x5c]
push esi
push eax
call sym.leptonlib.dll_l_getDataByte
mov ecx, dword [edi + eax*4]
mov edx, dword [esp + 0x68]
add ecx, dword [edi + edx*4]
mov eax, dword [esp + 0x6c]
add ecx, dword [edi + eax*4]
mov edx, dword [esp + 0x70]
add ecx, dword [edi + edx*4]
mov eax, dword [esp + 0x74]
add ecx, dword [edi + eax*4]
mov edx, dword [esp + 0x78]
add ecx, dword [edi + edx*4]
mov eax, dword [esp + 0x7c]
add ecx, dword [edi + eax*4]
mov edx, dword [esp + 0xa8]
add ecx, dword [edi + ebp*4]
add esp, 0x40
movzx eax, byte [ecx + edx]
mov ecx, dword [esp + 0x54]
push eax
push esi
push ecx
call sym.leptonlib.dll_l_setDataByte
inc esi
add esp, 0xc
cmp esi, dword [esp + 0x50]
jl 0x100b8508
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x44]
add dword [esp + 0x54], edx
add ebx, ecx
sub dword [esp + 0x10], 1
jne 0x100b84c3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x100c4600
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x100c460e
mov eax, 1
ret
cmp dword [esp + 8], 0
push ebx
push ebp
push edi
je 0x100c4690
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x100c4690
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x100c4690
mov edi, dword [esp + 0x20]
test edi, edi
je 0x100c4690
push eax
call sym.leptonlib.dll_fnbytesInFile
add esp, 4
cmp eax, 0x20
jl 0x100c4690
push esi
push 4
push 6
call dword [sym.imp.MSVCR90.dll_calloc]
mov esi, eax
add esp, 8
test esi, esi
jne 0x100c465a
lea eax, [esi + 1]
pop esi
pop edi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
push eax
push 4
push 6
push esi
call dword [sym.imp.MSVCR90.dll_fread]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x28]
push ecx
push edi
push ebx
push ebp
push edx
push esi
call sym.leptonlib.dll_sreadHeaderSpix
push esi
mov edi, eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 0x2c
pop esi
mov eax, edi
pop edi
pop ebp
pop ebx
ret
pop edi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x100c47a0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x100c47b2
mov eax, 1
pop esi
pop ecx
ret
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100c47aa
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 8]
push edx
push eax
call sym.leptonlib.dll_pixSerializeToMemory
add esp, 0xc
test eax, eax
jne 0x100c47aa
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 8]
push eax
push 1
push esi
call dword [sym.imp.MSVCR90.dll_fwrite]
push esi
call dword [sym.imp.MSVCR90.dll_free]
add esp, 0x14
xor eax, eax
pop esi
pop ecx
ret