joyce8/EMBER2024-capa huggingface dataset:
Function at 0x655f42
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebp
add esp, 0xa
jmp 0x655f4d
pop dword [esp]
mov dword [esp], esi
add esp, 1
rdtsc
mov word [esp], di
push word [esp + 2]
jmp 0x655f82
setl bh
setae ah
push word [esp + 1]
mov byte [esp], bh
lea esi, [esi*4]
jmp 0x655fc9
pop edx
mov cl, 0xf3
rcl ax, 1
setge ch
neg ax
mov ebx, dword [esp]
jmp 0x655fe4
lea ecx, [ebp*4]
lea esi, [edi*4]
mov bl, 0x66
rcr bl, cl
pop word [esp + 1]
cpuid
jmp 0x655fb3
lea esp, [esp]
mov esi, dword [esp]
mov dh, 0xde
mov bl, 0x2f
neg dh
mov bh, bl
jmp 0x6578dc
lea eax, [edx*4]
mov ah, byte [esp]
mov edi, dword [esp]
lea esp, [esp]
call fcn.0065601f
invalid
mov si, bp
mov dx, word [esp]
lea edi, [eax + edx]
bswap ebp
stc
mov bl, 0x99
jmp 0x655ff8
mov dl, byte [esp]
mov edx, eax
mov bp, 0xb499
xchg al, dl
neg dx
mov ax, di
jmp 0x65600e
rdtsc
neg ebx
rdtsc
clc
sub ebx, 0x5645b957
lea esp, [esp]
jmp 0x656035
xchg byte [esp], cl
xchg byte [esp], bh
add esp, 0
bts ebp, ebp
add esp, 0
mov byte [esp], ch
jmp 0x6560a8
bsr cx, bp
mov esi, dword [esp]
std
mov si, word [esp]
cld
rol bp, cl
jmp 0x65611d
xchg byte [esp + 1], al
xchg byte [esp], bh
mov cx, word [esp]
mov ax, bx
lea esp, [esp + 2]
mov byte [esp], bh
jmp 0x65619e
lea esp, [esp + 5]
lea ebp, reloc.KERNEL32.dll_CreateEventA
xchg si, cx
add esp, 1
mov ecx, 0xe8d14803
sub ax, 0xab92
jmp 0x65628a
add esp, 0
sub esp, 8
xor si, si
cmc
clc
mov byte [esp + 4], bl
jmp 0x656377
lea ecx, [edx*4]
xchg bh, ah
and dx, bx
lea esp, [esp]
bsr si, di
lea ecx, [edx + edx]
jmp 0x656705

Function at 0x65606f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 3]
mov dword [esp + 6], esp
mov di, word [esp + 0x10]
jmp 0x65608f
Function at 0x65632d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, bl
xchg word [esp + 7], dx
cpuid
dec dx
mov byte [esp + 3], ch
call fcn.006562a4
mov edx, dword [esp + 5]
stc
sbb bh, bl
mov ebx, dword [esp + 0x20]
mov esi, esp
xchg word [esp + 4], di
jmp 0x65634a
neg edx
mov dword [esp + 8], ecx
xchg dword [esp + 0x18], edx
pop edi
push dword [esp + 0xa]
jmp 0x6562ba
xchg ebp, eax
not esi
dec ecx
mov ch, 7
mov al, 0xc0
cpuid
jmp 0x656321
sub esp, 0x10
lea esp, [esp + 0x42]
xchg edi, edx
mov ax, word [esp]
std
setl dh
jmp 0x6562f7
mov si, 0xcbd
rdtsc
call 0x65632d
pop edi
mov ebp, ebx
mov bh, 0xbe
xchg byte [esp], bl
setns dh
jmp 0x656360
mov dword [esp + 0x1a], edx
mov bh, dh
push dword [esp + 3]
push dword [esp + 0x22]
bt bx, bx
mov ch, dh
jmp 0x65630e
add esp, 1
sub esp, 0x15
lea ebp, [ecx*4]
mov bh, byte [esp + 6]
jmp 0x656408
mov ecx, esp
setl ah
mov ax, 0xb951
bts bp, bx
mov si, dx
jmp 0x6563dc
lea esp, [esp + 0xb]
lea ebp, reloc.KERNEL32.dll_CreateEventA
xchg byte [esp + 5], bh
bts ax, sp
bt eax, esi
mov esi, dword [esp + 5]
jmp 0x656395
mov bp, word [esp + 1]
xchg byte [esp + 2], cl
mov bh, 0x38
mov ch, 0x6e
sub esp, 0x1c
jmp 0x6563ed
pop eax
setae bl
push bp
xchg word [esp + 1], dx
xchg bh, bl
pop bx
jmp 0x6563c6
mov ebp, eax
neg cx
lea esi, [esi*4]
mov dword [esp + 0x1b], edi
push dword [esp]
inc edx
jmp 0x6566c5
mov ebx, dword [esp + 6]
lea esp, [esp + 5]
mov dx, word [esp + 7]
xchg dword [esp + 9], ebp
mov ebp, 0x1f3c8c22
lea edx, [edx + edi]
jmp 0x6563ab
bsr di, dx
mov ebx, eax
push dword [esp + 0xe]
dec edi
setae bl
jmp 0x656480
not dx
sub esp, 0x1b
mov dword [esp + 0x15], esp
mov cx, 0x7e0
pop cx
stc
jmp 0x656423
cld
mov eax, 0x1146d5bd
adc ebx, esp
neg al
push bx
cld
jmp 0x6564b0
lea esp, [esp + 0x19]
mov word [esp + 1], bx
add esp, 2
bswap ecx
mov cx, word [esp + 1]
pushfd
jmp 0x65644c
mov bp, ax
lea edi, [esi*4]
mov dword [esp + 0xd], esp
mov dl, 0xc3
not dx
mov dx, word [esp + 0xd]
jmp 0x656462
lea esp, [esp + 3]
mov dl, byte [esp + 2]
mov ah, byte [esp + 3]
pop bp
push bx
jmp 0x656521
xchg dword [esp + 4], ebx
mov bh, ch
bt esi, esp
pop word [esp]
xchg al, dl
mov bp, 0x55e6
jmp 0x65649a
mov dl, 0x71
mov si, word [esp]
mov esi, 0xa8bf99ba
bt si, bp
bswap ebp
xchg ecx, eax
jmp 0x656439
mov byte [esp + 0x12], ch
call fcn.0065655e
aaa
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
dec ecx
pop edi
int3
lea edx, [eax*4]
sub esp, 0x1d
rcr esi, 0xf
cpuid
sub si, dx
bswap edx
jmp 0x6564e7
push word [esp + 2]
bsf edx, edi
mov byte [esp + 4], al
mov dword [esp], edi
pop edi
pop si
jmp 0x6564fd
mov edx, 0xb7f09e7d
bt bp, bx
rdtsc
cmc
xchg dh, ah
xchg ebp, esi
jmp 0x6564d0
mov edx, dword [esp]
bswap edx
bswap esi
sete bh
cpuid
setb al
jmp 0x6565be
rdtsc
sub dx, di
mov bp, word [esp]
mov byte [esp], dl
mov byte [esp], dl
inc bx
jmp 0x656601
mov ecx, ebx
lea esp, [esp + 3]
xchg byte [esp + 0x10], ch
mov byte [esp + 0x1b], ch
mov word [esp + 0xb], dx
popal
jmp 0x65668e
Function at 0x656a9a
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
push dword [esp + 5]
mov byte [esp + 0xb], cl
push word [esp + 0xd]
mov cx, 0x14ad
mov cl, bl
jmp 0x656ad9
xchg ecx, edx
xchg byte [esp + 0xf], al
mov dword [esp + 9], edi
std
not esi
jmp 0x656b53
bsf dx, si
xchg dl, bh
pop dword [esp + 6]
rdtsc
or edx, 0xaf1964b
sub esp, 0x11
jmp 0x656aaf
xchg word [esp + 0x10], cx
mov byte [esp + 5], cl
rdtsc
push word [esp + 0x13]
call fcn.00656b3d
cld
std
popfd
lea esp, [esp + 4]
jmp 0x656d07
mov byte [esp + 0x13], ch
push word [esp + 0x16]
lea esp, [esp + 2]
mov dword [esp + 0x18], edx
jmp 0x656ccd
lea esp, [esp + 2]
mov dword [esp + 0x18], esp
call fcn.00656bd9
mov dword [esp + 0x14], ebx
pushfd
push dword [esp + 3]
mov word [esp], cx
mov word [esp + 1], di
push ax
jmp 0x656c0b
push eax
push ecx
pushal
pop dword [esp + 0xf]
mov word [esp + 0xe], cx
mov dword [esp + 0x13], eax
jmp 0x656b74

Function at 0x656b3d
Capabilities:
Parse pe header

Disassembly:
mov ebx, dword [esp + 9]
pop si
jmp 0x656b8b
bswap ebp
pop dword [esp + 0x14]
cld
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
popal
jmp 0x656b68

Function at 0x656bbd
Capabilities:
Parse pe header

Disassembly:
call fcn.0065602a
pushal
mov word [esp + 0x13], si
mov dword [esp + 0x58], edi
lea esp, [esp + 0x58]
jmp 0x656be1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x656bf3
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x656c33
push eax
jmp 0x656025
Function at 0x4015ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4015e0
test dl, 7
je 0x4015e0
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x42fa30]
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0x4015c0
cmp esi, 8
jb 0x401670
push edi
mov edi, esi
shr edi, 3
xor ebx, dword [edx]
sub esi, 8
mov edx, dword [edx + 4]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0x42fa30]
xor ecx, dword [eax*4 + 0x42fe30]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x430230]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x430a30]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x430e30]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x431230]
movzx eax, dl
mov edx, dword [ebp + 0xc]
add edx, 8
mov dword [ebp + 0xc], edx
xor ecx, dword [eax*4 + 0x430630]
movzx eax, bl
xor ecx, dword [eax*4 + 0x431630]
mov ebx, ecx
sub edi, 1
jne 0x4015ef
pop edi
test esi, esi
je 0x40168c
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x42fa30]
inc edx
sub esi, 1
jne 0x401674
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc
Function at 0x404889
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp dword [esp + 8], 0
movups xmm1, xmmword [ecx + 8]
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [ecx + 0x18]
jbe 0x404903
mov edx, dword [esp + 0x14]
mov eax, esi
add esi, 0x10
cmp byte [ecx + 1], 0
movups xmm0, xmmword [eax]
je 0x4048b3
pxor xmm0, xmm1
movups xmm1, xmmword [edi]
mov eax, dword [ecx + 4]
pxor xmm1, xmm0
cmp eax, 1
jle 0x4048e5
lea edx, [edi + 0x10]
lea edi, [eax - 1]
mov dword [esp + 0xc], edi
lea edi, [ecx + 0x18]
sub dword [esp + 0xc], 1
movups xmm0, xmmword [edx]
lea edx, [edx + 0x10]
aesenc xmm1, xmm0
jne 0x4048cf
mov edx, dword [esp + 0x14]
add eax, eax
movups xmm0, xmmword [edi + eax*8]
mov eax, edx
add edx, 0x10
sub dword [esp + 0x10], 1
aesenclast xmm1, xmm0
mov dword [esp + 0x14], edx
movups xmmword [eax], xmm1
jne 0x4048a1
pop edi
movups xmmword [ecx + 8], xmm1
pop esi
ret 0xc

Function at 0x404ca4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x436ca8]
test eax, eax
jne 0x404cbf
mov ecx, 0x436ca0
call fcn.00404c25
mov eax, dword [0x436ca8]
push esi
mov esi, dword [ebp + 0xc]
xor edx, edx
mov ecx, esi
and ecx, 0xfffffff0
cmp byte [ebp + 0x14], dl
setne dl
cmp byte [ebp + 0x10], 0
je 0x404d09
test eax, eax
je 0x404d24
push edx
push ecx
push dword [ebp + 8]
call eax
test eax, eax
jne 0x404d49
push 0x4253b8
mov esi, 0x44a83c
push esi
call fcn.004017c7
pop ecx
pop ecx
mov ecx, esi
call fcn.00401905
push 2
mov ecx, esi
call fcn.004017c2
jmp 0x404d49
mov eax, dword [0x436cac]
test eax, eax
je 0x404d24
push edx
push ecx
push dword [ebp + 8]
call eax
test eax, eax
jne 0x404d49
push 0x4253ec
jmp 0x404cea
push ebx
call dword [0x425074]
xor edx, edx
mov ebx, eax
test esi, esi
je 0x404d48
push edi
mov edi, dword [ebp + 8]
add bl, 0x4b
lea ecx, [edx + edi]
lea eax, [edx + ebx]
xor byte [ecx], al
inc edx
cmp edx, esi
jb 0x404d3a
pop edi
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x4056e0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x1c], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4
Function at 0x40c010
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x448378]
mov eax, ecx
xor eax, dword [esp + 4]
mov edx, dword [0x448380]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x436df0]
movzx eax, cl
add eax, dword [0x44837c]
mov dword [0x448378], ecx
imul ecx, eax, 0x8088405
mov eax, dword [esp + 4]
inc ecx
mov dword [0x44837c], ecx
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x436df0]
mov dword [0x448380], edx
ret 4

Function at 0x40c3b5
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0xa0]
cmp eax, 0xffffffff
je 0x40c463
push ebp
push esi
push edi
push 0x40
pop edi
cmp eax, edi
jbe 0x40c3e7
push ebx
lea eax, [ebx + 0x40]
push eax
call fcn.0040c5a3
mov dword [ebx + 0xa0], 0x14
cmp dword [esp + 0x20], 0
je 0x40c407
mov eax, dword [esp + 0x24]
cmp byte [eax], 0
je 0x40c407
mov esi, dword [esp + 0x20]
lea ebp, [ebx + 0x40]
push 0x18
pop ecx
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
jmp 0x40c43f
mov ecx, dword [ebx + 0xa0]
mov eax, edi
sub eax, ecx
xor esi, esi
push eax
push esi
lea eax, [ecx + ebx]
push eax
call fcn.00412b10
add esp, 0xc
xor byte [esi + ebx], 0x36
inc esi
cmp esi, edi
jb 0x40c421
lea ebp, [ebx + 0x40]
push ebp
call fcn.004056e0
push edi
push ebx
push ebp
call fcn.00405711
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x20], 0
je 0x40c459
cmp byte [eax], 0
jne 0x40c459
mov edi, dword [esp + 0x20]
mov esi, ebp
push 0x18
pop ecx
rep movsd dword es:[edi], dword [esi]
mov byte [eax], 1
or dword [ebx + 0xa0], 0xffffffff
pop edi
pop esi
pop ebp
cmp dword [esp + 0xc], 0
je 0x40c47b
push dword [esp + 0xc]
lea eax, [ebx + 0x40]
push dword [esp + 0xc]
push eax
call fcn.00405711
pop ebx
ret 0x14
Function at 0x4051fb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ebp, 0xfffffdd1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040430e
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
invalid
invalid
movsb byte es:[edi], byte [esi]
cld

Function at 0x4057ce
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
push edx

Function at 0x405f5a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
cmp dword [ebp - 0x6fc], 2
jne 0x406019
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
invalid
invalid
invalid

Function at 0x406032
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
pop ecx
clc
invalid
call dword [ebp - 0x3a]
test dword [edx - 8], ebx
invalid
call dword [esi - 0x3a]
test dword [ebx - 8], ebx
invalid
invalid
jle 0x406025
test dword [eax + edi*8 - 1], ebx
jmp dword [ecx]
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.00404340
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.004042a1
add esp, 0xc
jmp 0x4062a8

Function at 0x4064db
Capabilities:
Access peb ldr_data

Disassembly:
and byte [ebp + 0x5b], bh
in al, dx
mov eax, dword fs:[0x30]
xor byte [eax], al
add byte [eax], al
Function at 0xb122f1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xb0a410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
test eax, eax
jne 0xb12314
push ebx
call dword [0xb2301c]
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [ebp - 0xc], 0x646f632e
mov dword [ebp - 8], 0x65
movzx edi, word [esi + 0x14]
push dword [esi + 0x88]
add edi, 0x18
push esi
add edi, esi
call fcn.00b0b824
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0xb123bd
movzx edx, word [esi + 6]
xor ecx, ecx
test edx, edx
jle 0xb1236a
lea eax, [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [edi]
jne 0xb12362
lea eax, [ebp - 0xc]
mov eax, dword [eax + 4]
cmp eax, dword [edi + 4]
je 0xb1236a
add edi, 0x28
inc ecx
cmp ecx, edx
jl 0xb1234e
cmp ecx, edx
je 0xb123bd
mov ecx, dword [esi + 0x34]
add ecx, dword [edi + 0xc]
mov edi, 0xb0be30
xor edx, edx
mov eax, dword [ecx + edx*4]
cmp eax, dword [edi + edx*4]
jne 0xb123bd
inc edx
cmp edx, 4
jne 0xb1237b
xor edx, edx
mov eax, dword [ecx + edx*4 + 0x140]
cmp eax, dword [edi + edx*4]
jne 0xb123bd
inc edx
cmp edx, 4
jne 0xb1238b
cmp dword [ecx + 0x124], 0
je 0xb123ad
push 0xb1267c
jmp 0xb123b2
push 0xb12661
push esi
push ebx
push ecx
call fcn.00b123ce
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00b13d46
mov esp, ebp
pop ebp
ret
Function at 0xb52b70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.00b66670
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.00b65ef0
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0xb52c55
mov ecx, esi
call fcn.00b65ef0
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.00b65ef0
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.00b65ef0
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.00b65ef0
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.00b50380
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.00b65ef0
lea ecx, [ebx + eax]
call fcn.00b50380
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.00b65ef0
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.00b50380
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.00b65d20
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.00b671c0

Function at 0xb52c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.00b66670
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.00b65ef0
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0xb52d55
mov ecx, esi
call fcn.00b65ef0
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.00b65ef0
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.00b65ef0
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.00b65ef0
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.00b50420
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.00b65ef0
lea ecx, [ebx + eax]
call fcn.00b50420
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.00b65ef0
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.00b50420
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.00b65d20
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.00b671c0
Function at 0xb52d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
mov ecx, ebx
push edi
call fcn.00b66670
mov ecx, ebx
call fcn.00b65ef0
mov edi, eax
add edi, dword [esp + 0x20]
push edi
call dword [0x100df290]
test eax, eax
jne 0xb52dff
mov ecx, ebx
call fcn.00b66670
cmp dword [edi + 0x28], 0xffffffff
jne 0xb52dab
cmp dword [edi + 0x2c], 0xffffffff
je 0xb52de9
push esi
mov esi, dword [edi + 0x28]
lea ecx, [esp + 0xc]
mov edi, dword [edi + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
call fcn.00b52b20
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
call fcn.00b52b20
pop esi
push dword [esp + 0x24]
mov ecx, ebx
push dword [esp + 0x24]
call fcn.00b65d20
mov ecx, ebx
call fcn.00b671c0
pop edi
mov ecx, ebx
pop ebx
add esp, 0x10
jmp fcn.00b671c0

Function at 0xb52e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
mov ecx, esi
push edi
call fcn.00b66670
mov ecx, esi
call fcn.00b65ef0
mov edi, eax
add edi, dword [esp + 0x20]
push edi
call dword [0x100df290]
test eax, eax
jne 0xb52e92
mov ecx, esi
call fcn.00b66670
cmp dword [edi + 0x28], 0xffffffff
jne 0xb52e4b
cmp dword [edi + 0x2c], 0xffffffff
je 0xb52e7c
push dword [edi + 0x2c]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push dword [edi + 0x28]
mov dword [esp + 0x18], 0xffffffff
push esi
mov dword [esp + 0x20], 0xffffffff
call fcn.00b4f0a0
lea ecx, [esp + 8]
call fcn.00b4d780
push dword [esp + 0x24]
mov ecx, esi
push dword [esp + 0x24]
call fcn.00b65d20
mov ecx, esi
call fcn.00b671c0
pop edi
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.00b671c0

Function at 0xb52ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.00b66670
mov ecx, edi
call fcn.00b65ef0
mov esi, eax
add esi, dword [esp + 0x10]
lea ecx, [esi + 4]
push ecx
call dword [0x100df290]
test eax, eax
jne 0xb52f3d
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
cmp ecx, 0xffffffff
jne 0xb52ed7
cmp eax, ecx
je 0xb52ee0
push eax
push ecx
mov ecx, edi
call fcn.00b65d20
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
cmp ecx, 0xffffffff
jne 0xb52eef
cmp eax, ecx
je 0xb52ef8
push eax
push ecx
mov ecx, edi
call fcn.00b65d20
cmp dword [esi + 0x18], 0xffffffff
jne 0xb52f04
cmp dword [esi + 0x1c], 0xffffffff
je 0xb52f13
push dword [esi + 0x1c]
push dword [esi + 0x18]
push edi
call fcn.00b52b70
add esp, 0xc
cmp dword [esi + 0x20], 0xffffffff
jne 0xb52f1f
cmp dword [esi + 0x24], 0xffffffff
je 0xb52f2e
push dword [esi + 0x24]
push dword [esi + 0x20]
push edi
call fcn.00b52c70
add esp, 0xc
push dword [esp + 0x14]
mov ecx, edi
push dword [esp + 0x14]
call fcn.00b65d20
mov ecx, edi
pop edi
pop esi
jmp fcn.00b671c0
Function at 0xb52f50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
push edi
call fcn.00b66670
mov ecx, esi
call fcn.00b65ef0
mov edi, eax
add edi, dword [esp + 0x10]
lea ecx, [edi + 4]
push ecx
call dword [0x100df290]
test eax, eax
jne 0xb52fb4
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
cmp ecx, 0xffffffff
jne 0xb52f87
cmp eax, ecx
je 0xb52f90
push eax
push ecx
mov ecx, esi
call fcn.00b65d20
mov edx, dword [edi + 0x10]
mov eax, edx
mov ecx, dword [edi + 0x14]
or eax, ecx
je 0xb52fa5
push ecx
push edx
mov ecx, esi
call fcn.00b65d20
push dword [esp + 0x14]
mov ecx, esi
push dword [esp + 0x14]
call fcn.00b65d20
pop edi
mov ecx, esi
pop esi
jmp fcn.00b671c0
Function at 0xbfa380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
xor ebp, ebp
push edi
test ebx, ebx
je 0xbfa3e6
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov dword [esp + 0x14], eax
mov edi, dword [eax + 0x78]
add edi, ebx
cmp dword [edi + 0x18], esi
jbe 0xbfa3e6
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x20]
lea eax, [eax + esi*4]
mov ecx, dword [eax + ebx]
add ecx, ebx
test ecx, 0xffff0000
je 0xbfa3d5
test edx, 0xffff0000
je 0xbfa3d5
push edx
push ecx
call dword [0x100df134]
mov edx, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
jmp 0xbfa3dc
xor eax, eax
cmp ecx, edx
sete al
test eax, eax
jne 0xbfa3ed
inc esi
cmp esi, dword [edi + 0x18]
jb 0xbfa3a7
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov ebp, dword [eax + ebx]
add ebp, ebx
cmp ebp, edi
jb 0xbfa3e6
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x7c]
add eax, edi
cmp ebp, eax
ja 0xbfa3e6
xor ecx, ecx
mov eax, ebp
cmp byte [ebp], cl
je 0xbfa429
lea esp, [esp]
lea eax, [eax + 1]
inc ecx
cmp byte [eax], 0
jne 0xbfa420
lea esi, [ecx + 1]
xor edi, edi
test esi, esi
je 0xbfa43d
push esi
call fcn.00bf4830
add esp, 4
mov edi, eax
push esi
push ebp
push edi
call fcn.00bf4930
add esp, 0xc
mov esi, edi
cmp byte [edi], 0
je 0xbfa45b
nop
cmp byte [esi], 0x2e
je 0xbfa46d
inc esi
cmp byte [esi], 0
jne 0xbfa450
push edi
xor esi, esi
call fcn.00bf4820
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
mov byte [esi], 0
call dword [0x100df1e0]
mov ecx, eax
lea eax, [esi + 1]
push eax
push ecx
call fcn.00bfa380
add esp, 8
mov esi, eax
push edi
call fcn.00bf4820
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret