joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e0c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x440320]
jne 0x41e0ce
repz ret
jmp fcn.004239a6

Function at 0x428bd3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00423d3a
and dword [ebp - 4], 0
cmp dword [0x44275c], 0
mov ebx, eax
jne 0x428c84
push 0x437934
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x428d35
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
test eax, eax
je 0x428d35
push eax
call fcn.00423cc8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44275c], eax
call esi
push eax
call fcn.00423cc8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x442760], eax
call esi
push eax
call fcn.00423cc8
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x442764], eax
call esi
push eax
call fcn.00423cc8
pop ecx
mov dword [0x44276c], eax
test eax, eax
je 0x428c84
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00423cc8
pop ecx
mov dword [0x442768], eax
mov eax, dword [0x442768]
cmp eax, ebx
je 0x428cdc
cmp dword [0x44276c], ebx
je 0x428cdc
push eax
call fcn.00423d43
push dword [0x44276c]
mov esi, eax
call fcn.00423d43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x428cdc
test edi, edi
je 0x428cdc
call esi
test eax, eax
je 0x428cd3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x428cd3
test byte [ebp - 0xc], 1
jne 0x428cdc
or dword [ebp + 0x10], 0x200000
jmp 0x428d15
mov eax, dword [0x442760]
cmp eax, ebx
je 0x428d15
push eax
call fcn.00423d43
pop ecx
test eax, eax
je 0x428d15
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x428d15
mov eax, dword [0x442764]
cmp eax, ebx
je 0x428d15
push eax
call fcn.00423d43
pop ecx
test eax, eax
je 0x428d15
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44275c]
call fcn.00423d43
pop ecx
test eax, eax
je 0x428d35
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x428d37
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42d0fa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00423d3a
and dword [ebp - 4], 0
cmp dword [0x4428c4], 0
mov ebx, eax
jne 0x42d1ab
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42d25c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42d25c
push eax
call fcn.00423cc8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4428c4], eax
call esi
push eax
call fcn.00423cc8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4428c8], eax
call esi
push eax
call fcn.00423cc8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4428cc], eax
call esi
push eax
call fcn.00423cc8
pop ecx
mov dword [0x4428d4], eax
test eax, eax
je 0x42d1ab
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00423cc8
pop ecx
mov dword [0x4428d0], eax
mov eax, dword [0x4428d0]
cmp eax, ebx
je 0x42d203
cmp dword [0x4428d4], ebx
je 0x42d203
push eax
call fcn.00423d43
push dword [0x4428d4]
mov esi, eax
call fcn.00423d43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42d203
test edi, edi
je 0x42d203
call esi
test eax, eax
je 0x42d1fa
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42d1fa
test byte [ebp - 0xc], 1
jne 0x42d203
or dword [ebp + 0x10], 0x200000
jmp 0x42d23c
mov eax, dword [0x4428c8]
cmp eax, ebx
je 0x42d23c
push eax
call fcn.00423d43
pop ecx
test eax, eax
je 0x42d23c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42d23c
mov eax, dword [0x4428cc]
cmp eax, ebx
je 0x42d23c
push eax
call fcn.00423d43
pop ecx
test eax, eax
je 0x42d23c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4428c4]
call fcn.00423d43
pop ecx
test eax, eax
je 0x42d25c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42d25e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001c40
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov ecx, dword [ebx + 0x14]
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jle 0x10001c89
mov eax, edi
shl eax, 4
add eax, dword [ecx]
cmp eax, dword [ebx + 0xc]
jb 0x10001c64
mov eax, 0x1004c638
mov ecx, dword [eax + 8]
and ecx, 0xf
cmp ecx, 4
je 0x10001ce5
cmp ecx, 3
je 0x10001cc5
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10001c82
mov dword [eax], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret
cmp edi, 0xfff0b9d8
jle 0x10001c9b
mov eax, edi
shl eax, 4
add eax, dword [ebx + 0xc]
jmp 0x10001c64
jne 0x10001ca5
mov eax, dword [ebx + 0x10]
add eax, 0x28
jmp 0x10001c64
mov ecx, dword [ecx]
mov eax, 0xfff0b9d8
sub eax, edi
cmp dword [ecx + 8], 0x16
je 0x10001c5f
mov ecx, dword [ecx]
movzx edx, byte [ecx + 6]
cmp eax, edx
jg 0x10001c5f
shl eax, 4
add eax, ecx
jmp 0x10001c64
mov esi, eax
call fcn.100189e0
mov eax, dword [ebx + 0x10]
cmp dword [eax + 0xc], 0
jle 0x10001cdc
mov eax, ebx
call fcn.10010820
mov eax, edi
mov ecx, ebx
call section..text
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x10001d0a
mov ecx, dword [eax]
cmp byte [ecx + 4], 4
jne 0x10001d05
movzx ecx, byte [ecx + 7]
mov dword [edx], ecx
mov eax, dword [eax]
add eax, 0x10
pop edi
pop esi
pop ebx
pop ecx
ret
mov ecx, dword [ecx + 0xc]
mov dword [edx], ecx
mov eax, dword [eax]
pop edi
pop esi
add eax, 0x10
pop ebx
pop ecx
ret
Function at 0x1000f290
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 4]
and byte [esi + 5], 0xfc
mov ebx, 4
sub eax, ebx
push edi
cmp eax, 0x22
ja case.0x1000f2c7.6
mov edi, dword [ebp + 8]
lea ebx, [ebx]
movzx eax, byte [eax + 0x1000f3cc]
jmp dword [eax*4 + 0x1000f3a8]
mov eax, dword [esi + 8]
test eax, eax
je 0x1000f2e5
test byte [eax + 5], 3
je 0x1000f2e5
push eax
push edi
call fcn.1000f290
add esp, 8
mov ecx, dword [esi + 0xc]
or byte [esi + 5], bl
add ecx, 0x18
add dword [edi + 0x10], ecx
movzx ecx, byte [esi + 6]
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x14], edx
test cl, 0x40
je case.0x1000f2c7.6
mov cl, byte [eax + 5]
test cl, 3
je case.0x1000f2c7.6
and cl, 0xfc
mov esi, eax
mov byte [eax + 5], cl
movzx eax, byte [eax + 4]
sub eax, ebx
cmp eax, 0x22
jbe 0x1000f2c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [esi + 7]
or byte [esi + 5], bl
add eax, 0x11
add dword [edi + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0xc]
or byte [esi + 5], bl
add ecx, 0x11
add dword [edi + 0x10], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x4c]
mov dword [esi + 8], edx
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x4c]
mov dword [esi + 8], eax
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x4c]
mov dword [esi + 0x1c], ecx
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x4c]
mov dword [esi + 0x28], edx
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10011bcf
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x101c
call fcn.10038110
mov eax, dword [0x1005a510]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
push esi
mov esi, ecx
lea edx, [esp + 8]
lea ecx, [esp + 0x18]
push esi
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x1000
call sym.lua5.3.dll_luaL_prepbuffsize
push edi
push esi
push 1
push eax
call fcn.1002bb2a
mov esi, eax
add dword [esp + 0x28], esi
lea eax, [esp + 0x20]
push eax
call sym.lua5.3.dll_luaL_pushresult
xor ecx, ecx
add esp, 0x1c
cmp ecx, esi
mov ecx, dword [esp + 0x101c]
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.1002afd0
add esp, 0x101c
ret
Function at 0x1001e590
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x1005a510]
xor eax, esp
mov dword [esp + 0x14], eax
push 0
call fcn.10030d4a
mov ecx, dword [esp + 0x20]
add esp, 4
lea edx, [esp]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov ecx, 0x10
lea edx, [esp + 0x13]
push esi
xor eax, ecx
mov dword [esp + 0x10], 0x1004c638
mov dword [esp + 0x14], sym.lua5.3.dll_lua_newstate
sub edx, ecx
push edi
movzx esi, byte [edx + ecx]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
dec ecx
xor eax, esi
cmp ecx, 1
jae 0x1001e5d6
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.1002afd0
add esp, 0x18
ret

Function at 0x1001ec90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [esi + 6], 0
jne 0x1001ecd7
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, eax
shr edx, 5
inc edx
xor ecx, eax
cmp eax, edx
jb 0x1001eccd
push ebx
push edi
lea ebx, [ebx]
movzx edi, byte [esi + eax + 0xf]
mov ebx, ecx
shl ebx, 5
add edi, ebx
mov ebx, ecx
shr ebx, 2
add edi, ebx
sub eax, edx
xor ecx, edi
cmp eax, edx
jae 0x1001ecb0
pop edi
pop ebx
mov dword [esi + 8], ecx
mov byte [esi + 6], 1
mov eax, ecx
ret
mov eax, dword [esi + 8]
ret
Function at 0x1001eed0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, dword [eax + 0x10]
mov ebp, dword [edi + 0x38]
mov eax, ebx
shr eax, 5
inc eax
xor ebp, ebx
mov dword [esp + 0xc], edi
mov ecx, ebx
cmp ebx, eax
jb 0x1001ef11
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ecx - 1]
mov esi, ebp
shl esi, 5
add edx, esi
mov esi, ebp
shr esi, 2
add edx, esi
sub ecx, eax
xor ebp, edx
cmp ecx, eax
jae 0x1001eef2
mov ecx, dword [edi + 0x20]
mov edx, dword [edi + 0x18]
lea eax, [ecx - 1]
and eax, ebp
lea eax, [edx + eax*4]
mov dword [esp + 0x10], eax
mov eax, dword [eax]
mov dword [esp + 0x14], ecx
test eax, eax
je 0x1001ef8d
lea ecx, [ecx]
movzx edx, byte [eax + 7]
cmp ebx, edx
jne 0x1001ef86
mov edi, dword [esp + 0x20]
mov ecx, ebx
lea esi, [eax + 0x10]
cmp ebx, 4
jb 0x1001ef5a
mov edx, dword [edi]
cmp edx, dword [esi]
jne 0x1001ef7e
sub ecx, 4
add esi, 4
add edi, 4
cmp ecx, 4
jae 0x1001ef46
test ecx, ecx
je 0x1001efbd
mov dl, byte [esi]
cmp dl, byte [edi]
jne 0x1001ef7e
cmp ecx, 1
jbe 0x1001efbd
mov dl, byte [esi + 1]
cmp dl, byte [edi + 1]
jne 0x1001ef7e
cmp ecx, 2
jbe 0x1001efbd
mov cl, byte [esi + 2]
cmp cl, byte [edi + 2]
je 0x1001efbd
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x1001ef30
cmp dword [edi + 0x1c], ecx
jl 0x1001efdb
cmp ecx, 0x3fffffff
jg 0x1001efdb
mov esi, dword [esp + 0x1c]
lea eax, [ecx + ecx]
push eax
push esi
call fcn.1001ece0
mov ecx, dword [edi + 0x20]
mov edx, dword [edi + 0x18]
dec ecx
add esp, 8
and ecx, ebp
lea eax, [edx + ecx*4]
mov dword [esp + 0x10], eax
jmp 0x1001efdf
mov edx, dword [esp + 0xc]
mov cl, byte [eax + 5]
mov dl, byte [edx + 0x3c]
xor cl, 3
xor dl, 3
test cl, dl
jne 0x1001f03c
pop edi
pop esi
mov byte [eax + 5], cl
pop ebp
add esp, 0xc
ret
mov esi, dword [esp + 0x1c]
mov edi, dword [esi + 0x10]
lea ecx, [ebx + 0x11]
push ecx
push 4
push 0
push esi
call fcn.10016170
mov dl, byte [edi + 0x3c]
mov ecx, dword [esp + 0x30]
mov esi, eax
mov byte [esi + 4], 4
and dl, 3
mov byte [esi + 5], dl
mov eax, dword [edi + 0x40]
mov dword [esi], eax
push ebx
mov dword [edi + 0x40], esi
push ecx
lea edx, [esi + 0x10]
mov dword [esi + 8], ebp
mov byte [esi + 6], 0
push edx
mov byte [esi + ebx + 0x10], 0
call fcn.10035780
mov eax, dword [esp + 0x2c]
mov byte [esi + 7], bl
mov ecx, dword [eax]
mov dword [esi + 0xc], ecx
mov dword [eax], esi
mov eax, dword [esp + 0x28]
add esp, 0x1c
inc dword [eax + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x10023600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x88
push esi
push edi
mov edi, eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.10023180
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push ebx
mov dword [esp + 0x20], eax
mov esi, eax
call fcn.10023200
add esp, 0x14
add esi, eax
cmp dword [edi + 8], 0x13
jne 0x10023715
mov eax, dword [edi]
mov edi, dword [edi + 4]
test edi, edi
jl 0x10023715
jg 0x100236d3
test eax, eax
jbe 0x10023715
test edi, edi
ja 0x10023715
jb 0x100236e0
cmp eax, 0x80000000
ja 0x10023715
test eax, eax
je 0x10023715
dec eax
xor ecx, ecx
cmp eax, 0x100
jb 0x100236fd
mov edi, edi
shr eax, 8
add ecx, 8
cmp eax, 0x100
jae 0x100236f0
movzx eax, byte [eax + 0x1004c648]
add eax, ecx
inc dword [esp + eax*4 + 0x10]
lea eax, [esp + eax*4 + 0x10]
mov eax, 1
jmp 0x10023717
xor eax, eax
add dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.10023120
sub esi, dword [esp + 0x14]
mov edx, dword [esp + 0x9c]
inc esi
push esi
push eax
push edx
mov eax, ebx
call fcn.10023410
add esp, 0x14
pop edi
pop esi
add esp, 0x88
ret

Function at 0x1002afd0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005a510]
jne 0x1002afda
repz ret
jmp fcn.100315c9

Function at 0x1002c351
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push esi
push dword [ebp + 8]
call fcn.1002bf69
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1002bfb4
push eax
push esi
push dword [ebp + 8]
call fcn.1002bf69
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
xlatb
Function at 0x1002c3d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xlatb
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1002bfb4
push eax
push esi
push dword [ebp + 8]
call fcn.1002bf69
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1002bfa4
xchg ecx, eax
cmp al, 0x3d
sub cl, byte [eax - 0x8363]
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid

Function at 0x1002c4d5
Capabilities:
Inspect section memory permissions

Disassembly:
add esp, 0xc
cmp word [edi + 6], bx
mov dword [ebp + 0xc], ebx
jbe 0x1002c514
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.1002bf15
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x1002c4e1
call fcn.1002bfa4
leave
xor bl, byte [esi]
in al, dx
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x1002c793
add eax, esi
mov dword [ebp - 0x44], eax
Function at 0x1002c5d8
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x1002c549
cmp dword [eax + 0xc], ebx
je 0x1002c5ec
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
dec dword [ecx + 0x47e80c45]
cli
invalid
invalid
stc
sbb al, 3
cwde
cmp dword [ebp + 0xc], ebx
jne 0x1002c578
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x1002c793
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x1002c58c
mov dword [ebp + 0x10], edi
jmp 0x1002c591
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.1002bfa4
adc ebp, ebx
push esp
sahf
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x1002c5da
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x1002c5b5
and eax, 0xffff
push eax
jmp 0x1002c5b9
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002bf69
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x1002c793
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x1002c59a
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x1002c53b
call fcn.1002bfa4
loope 0x1002c65a
or bh, byte [ebx - 0x75]
xchg dword [eax + 0x3b000000], esp
ret
or al, 0xeb
push es
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1002c67b
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1002c699
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1002c6f7
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1002c6de
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1002c6e7
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1002c6f1
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1002c6d3
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1002c65d
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1002c744
dec eax
je 0x1002c73b
sub eax, 3
je 0x1002c732
mov dword [ebp - 4], 0x40
jmp 0x1002c761
mov dword [ebp - 4], 4
jmp 0x1002c747
mov dword [ebp - 4], 0x20
jmp 0x1002c747
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1002c793
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1002c713
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1002bfa4
mov ecx, dword [esp + edx + 0x1475ff4c]
push 1
push esi
call edi
mov eax, esi
jmp 0x1002c79f
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002c6df
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x1002c549
cmp dword [eax + 0xc], ebx
je 0x1002c5ec
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
dec dword [ecx + 0x47e80c45]
cli
invalid
invalid
stc
sbb al, 3
cwde
cmp dword [ebp + 0xc], ebx
jne 0x1002c578
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x1002c793
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x1002c58c
mov dword [ebp + 0x10], edi
jmp 0x1002c591
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.1002bfa4
adc ebp, ebx
push esp
sahf
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x1002c5da
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x1002c5b5
and eax, 0xffff
push eax
jmp 0x1002c5b9
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002bf69
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x1002c793
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x1002c59a
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x1002c53b
call fcn.1002bfa4
loope 0x1002c65a
or bh, byte [ebx - 0x75]
xchg dword [eax + 0x3b000000], esp
ret
or al, 0xeb
push es
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1002c67b
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1002c699
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1002c6f7
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1002c6de
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1002c6e7
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1002c6f1
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1002c6d3
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1002c65d
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1002c744
dec eax
je 0x1002c73b
sub eax, 3
je 0x1002c732
mov dword [ebp - 4], 0x40
jmp 0x1002c761
mov dword [ebp - 4], 4
jmp 0x1002c747
mov dword [ebp - 4], 0x20
jmp 0x1002c747
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1002c793
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1002c713
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1002bfa4
mov ecx, dword [esp + edx + 0x1475ff4c]
push 1
push esi
call edi
mov eax, esi
jmp 0x1002c79f
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret