joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401750
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40765f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov dword [esp + 0x1c], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString
mov ebp, dword [esp + 0x34]
mov byte [esp + 0x28], 2
mov eax, ebp
cdq
xor eax, edx
sub eax, edx
push eax
lea eax, [esp + 0x10]
push 0x40b030
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x18]
mov esi, 3
add esp, 0xc
cmp dword [ecx - 8], esi
jle 0x401866
push edi
mov bl, 5
lea edx, [esp + 0x1c]
push esi
push edx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Right
mov edi, eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 3
mov eax, dword [eax - 8]
sub eax, esi
push eax
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
push 0x40b02c
lea edx, [esp + 0x18]
push eax
push edx
mov byte [esp + 0x38], 4
call sub.MFC42.DLL_operator_2
push edi
push eax
lea eax, [esp + 0x40]
mov byte [esp + 0x34], bl
push eax
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 6
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x38]
mov byte [esp + 0x2c], bl
call fcn.00406f44
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 4
call fcn.00406f44
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 3
call fcn.00406f44
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 2
call fcn.00406f44
mov ecx, dword [esp + 0x10]
add esi, 4
cmp dword [ecx - 8], esi
jg 0x4017bc
pop edi
test ebp, ebp
jge 0x40189b
lea edx, [esp + 0xc]
lea eax, [esp + 0x34]
push edx
push 0x40b028
push eax
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 7
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 2
call fcn.00406f44
lea ecx, [esp + 0xc]
push 0x40b024
lea edx, [esp + 0x1c]
push ecx
push edx
call sub.MFC42.DLL_operator_2
lea ecx, [esp + 0x38]
lea edx, [esp + 0x34]
push ecx
mov bl, 8
push eax
push edx
mov byte [esp + 0x34], bl
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 9
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], bl
call fcn.00406f44
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.00406f44
cmp ebp, 1
jg 0x4018f9
cmp ebp, 0xffffffff
jge 0x401907
push str.s___
lea ecx, [esp + 0x10]
call fcn.00406f80
mov esi, dword [esp + 0x30]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.00406f44
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 0
call fcn.00406f44
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x401950
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x10
push esi
push edi
push 0
mov edi, ecx
push 0x20000080
push 3
mov eax, dword [edi]
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
push 0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea edx, [esp + 8]
add edi, 8
push edx
lea eax, [esp + 0x14]
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4022b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, 0x10000
je 0x40232f
mov ecx, dword [esi + 0x200]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x1009
push ecx
call edi
mov edx, dword [esi + 0x200]
push 0
push 0
push 0x1004
push edx
call edi
test eax, eax
jne 0x40232b
push eax
lea ecx, [esi + 0x1a0]
call sub.MFC42.DLL_CWnd::EnableWindow
push 0
push 0x3f5
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
push 0
push 0x422
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetDlgItem
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
pop edi
pop esi
pop ebx
ret
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esi + 0x200]
push 2
push 0xffffffffffffffff
push 0x100c
push edx
call edi
inc eax
je 0x4022df
lea ebx, [eax - 1]
mov eax, dword [esi + 0x200]
push 2
push ebx
push 0x100c
push eax
call edi
mov ecx, dword [esi + 0x200]
push 0
push ebx
push 0x1008
push ecx
call edi
jmp 0x402335
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1000edb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1006ca23
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.std::locale::_Locimp.0
push esi
mov dword [esp + 0x18], 1
call fcn.10029f5c
add esp, 4
cmp dword [esi + 0x30], 0x10
jb 0x1000ee01
mov eax, dword [esi + 0x1c]
push eax
call sub.MFC80U.DLL_Ordinal_764
add esp, 4
xor eax, eax
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], eax
mov byte [esi + 0x1c], al
mov dword [esi], vtable.std::locale::facet.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x10011210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1006cc9c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 0xc]
mov dword [ecx], vtable.Idis::gr1::tstring__wchar_t_.0
xor edi, edi
mov eax, 7
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x18], edi
mov word [ecx + 8], di
lea ebx, [esi + 0x2c]
mov dword [ebx], vtable.Idis::gr1::tstring__wchar_t_.0
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x18], edi
mov dword [esp + 0x20], edi
mov word [ebx + 8], di
lea ebp, [esi + 0x54]
mov dword [ebp], vtable.Idis::gr1::tstring__wchar_t_.0
mov dword [ebp + 0x1c], eax
mov dword [ebp + 0x18], edi
mov word [ebp + 8], di
mov dword [esi + 0x7c], vtable.Idis::gr1::tstring__wchar_t_.0
mov dword [esi + 0x98], eax
mov dword [esi + 0x94], edi
mov word [esi + 0x84], di
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esi], eax
mov eax, dword [esp + 0x30]
push 0x10076a74
mov byte [esp + 0x24], 3
mov dword [esi + 4], edx
mov dword [esi + 8], eax
call fcn.10029d5b
push 0x10076a74
mov ecx, ebx
call fcn.10003f30
push 0x10076a74
mov ecx, ebp
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
call fcn.10003f30
push 0x10076a74
lea ecx, [esi + 0x7c]
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
call fcn.10003f30
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x10012de0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1006cf78
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0
cmp esi, ebp
je 0x10012e6e
movzx edi, word [esi - 2]
lea eax, [esp + 0x3c]
sub esi, 2
push eax
call fcn.10004990
mov edx, dword [eax]
add esp, 4
push edi
mov ecx, eax
mov eax, dword [edx + 8]
push ebx
call eax
test al, al
jne 0x10012e18
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
add esi, 2
lea ecx, [esp + 0x38]
mov dword [edi], eax
mov dword [edi + 4], esi
call fcn.1000fa70
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov dword [esi], ecx
lea ecx, [esp + 0x38]
mov dword [esi + 4], ebp
call fcn.1000fa70
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x100151c0
Capabilities:
Hash data using murmur3

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
xor eax, eax
jmp 0x100151d0
cmp edx, esi
je 0x100151f7
movzx ecx, word [edx]
imul ecx, ecx, 0xcc9e2d51
rol ecx, 0xf
imul ecx, ecx, 0x1b873593
xor ecx, eax
rol ecx, 0xd
lea eax, [ecx + ecx*4 - 0x19ab949c]
add edx, 2
jmp 0x100151d0
pop esi
ret

Function at 0x10016a90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1006d4d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esi + 0x30]
test edi, edi
mov dword [esp + 0x18], 0
je 0x10016af2
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10016af2
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10016af2
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
mov dword [esi], vtable.Idis::G2Notification.0
mov dword [esi + 4], vtable.Idis::G2String.0
cmp dword [esi + 0x20], 8
jb 0x10016b11
mov eax, dword [esi + 0xc]
push eax
call sub.MFC80U.DLL_Ordinal_764
add esp, 4
mov dword [esi + 0x20], 7
mov dword [esi + 0x1c], 0
mov word [esi + 0xc], 0
mov dword [esi + 4], vtable.Idis::G2Object.0
mov dword [esi], vtable.Idis::G2Object.0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x10017050
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1006d508
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.10004170
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x2c], ecx
mov eax, dword [edi + 0x30]
xor edx, edx
mov dword [esi + 0x30], eax
push 0xffffffffffffffff
lea ecx, [esi + 0x34]
lea eax, [edi + 0x34]
push edx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], edx
push eax
mov dword [esp + 0x24], edx
mov byte [ecx + 4], dl
call fcn.100035d0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x1001b260
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1006dae0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1008c288]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x5c]
xor ebx, ebx
mov eax, 7
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], bx
mov edx, dword [esp + 0x60]
mov dword [esp + 0x28], eax
mov eax, edx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x24], ebx
mov word [esp + 0x14], bx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1001b2c3
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.10003870
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x60], 1
call fcn.1001a7f0
mov esi, 8
add esp, 0xc
cmp dword [esp + 0x28], esi
mov byte [esp + 0x54], bl
jb 0x1001b315
mov eax, dword [esp + 0x14]
push eax
call sub.MFC80U.DLL_Ordinal_764
add esp, 4
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x34]
push ecx
lea ecx, [edi + 4]
call fcn.10005f60
cmp dword [esp + 0x44], esi
jb 0x1001b338
mov edx, dword [esp + 0x30]
push edx
call sub.MFC80U.DLL_Ordinal_764
add esp, 4
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10028d90
add esp, 0x48
ret

Function at 0x1001bbc0
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push str.DBGHELP.DLL
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MiniDumpWriteDump
push eax
mov dword [esi + 0x10], eax
call edi
push str.KERNEL32
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
push str.CreateToolhelp32Snapshot
push ebx
call edi
push str.Module32First
push ebx
mov dword [esi + 4], eax
call edi
push str.Module32Next
push ebx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x10020700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1006c838
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1008c288]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov edi, ecx
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x20]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
call fcn.100015d0
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x74], 0
call fcn.1001ec50
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.1002a829
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
test eax, eax
mov dword [esp + 0x58], 0xffffffff
je 0x100207f7
push 0
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.10029ea3
mov eax, dword [edi + 4]
test eax, eax
jbe 0x100207d5
cmp eax, 0xffffffff
jae 0x100207d5
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.10029ec4
test esi, esi
je 0x100207f7
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x10020838
test edi, edi
je 0x10020831
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x1002081d
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x1002081d
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10020826
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x10020831
mov byte [esp + 0x6d], al
jmp 0x10020833
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x1002086e
test esi, esi
je 0x1002086c
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x1002085e
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x1002085e
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10020867
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x1002086e
xor esi, esi
test edi, edi
jne 0x10020878
test esi, esi
je 0x1002087c
jmp 0x10020880
test esi, esi
je 0x10020880
or dword [ebp], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x1002089d
cmp dword [esp + 0x10], 0
jne 0x1002089d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
jmp 0x100208a1
or dword [ebp], 2
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10028d90
add esp, 0x4c
ret 0x28
Function at 0x100208e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1006c838
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1008c288]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x7c]
mov ebp, dword [esp + 0x80]
mov edi, ecx
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x20]
mov dword [esp + 0x1c], ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
call fcn.100015d0
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x74], 0
call fcn.1001ec50
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.1002a693
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
test eax, eax
mov dword [esp + 0x58], 0xffffffff
je 0x100209d7
push 0
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.10029ea3
mov eax, dword [edi + 4]
test eax, eax
jbe 0x100209b5
cmp eax, 0xffffffff
jae 0x100209b5
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.10029ec4
test esi, esi
je 0x100209d7
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x10020a18
test edi, edi
je 0x10020a11
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x100209fd
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x100209fd
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10020a06
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x10020a11
mov byte [esp + 0x6d], al
jmp 0x10020a13
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x10020a4e
test esi, esi
je 0x10020a4c
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x10020a3e
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x10020a3e
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10020a47
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x10020a4e
xor esi, esi
test edi, edi
jne 0x10020a58
test esi, esi
je 0x10020a5c
jmp 0x10020a60
test esi, esi
je 0x10020a60
or dword [ebp], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x10020a7d
cmp dword [esp + 0x10], 0
jne 0x10020a7d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
jmp 0x10020a81
or dword [ebp], 2
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov dword [eax], ecx
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10028d90
add esp, 0x4c
ret 0x28
Function at 0x10020ac0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1006df68
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1008c288]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x84]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x80]
mov edi, ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.100015d0
mov esi, dword [esi + 0x10]
push eax
push esi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x3c]
push ecx
push edi
mov dword [esp + 0x70], 0
call fcn.1001ec50
push eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.MSVCR80.dll__strtoi64]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x4c]
add esp, 0x24
test eax, eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x58], 0xffffffff
je 0x10020ba9
push 0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.10029ea3
mov eax, dword [edi + 4]
test eax, eax
jbe 0x10020b87
cmp eax, 0xffffffff
jae 0x10020b87
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x1c]
and esi, edi
call fcn.10029ec4
test esi, esi
je 0x10020ba9
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x10020bea
test edi, edi
je 0x10020be3
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x10020bcf
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x10020bcf
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10020bd8
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x10020be3
mov byte [esp + 0x6d], al
jmp 0x10020be5
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x10020c20
test esi, esi
je 0x10020c1e
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x10020c10
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x10020c10
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10020c19
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x10020c20
xor esi, esi
test edi, edi
jne 0x10020c2a
test esi, esi
je 0x10020c2e
jmp 0x10020c31
test esi, esi
je 0x10020c31
or dword [ebx], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x10020c4e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x10020c51
or dword [ebx], 2
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10028d90
add esp, 0x48
ret 0x28