joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a340
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov eax, dword [ecx + 4]
test edi, ebp
jne 0x40a3c1
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop esi
pop ebp
sub dword [eax + 0x1f88300], edi
jne 0x40a370
mov eax, dword [ecx + 8]
push eax
call dword [0x93c030]
jmp 0x40a37f
pop ebp
clc
add dh, byte [ebp - 0x3e]
mov ecx, dword [ecx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [0x8b1d7542], al
xor eax, 0x40c00b
call esi
sti
rcl byte [ecx + ecx*8], 0xff
and byte [0xafc80], al
stosb byte es:[edi], al
pop ebp
ret 4
rol dl, 4
sub esp, dword [edx - 0x70]
nop
nop
nop
nop
nop
nop
nop
nop
sahf

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov byte [ebp + 8], 0x24
jg 0x40a3ed
push edx
sal byte [ebx + esi - 0x75], 0x4d
and dword [ecx + 0x50], edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a40a
push esi
mov esi, dword [0xbfc098]
call esi
test eax, eax
jne 0x40a3fe
pop esi
pop ebp
ret 8
jmp dword [ebx + 5]
xor eax, eax
pop ebp
and byte [eax], cl
add byte [eax + 0x4e3b], bh
pop ebp
ret 0x2f

Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
or eax, 0x46d30875
rol dword [eax + eax*8 + 0xbe84a6], 0
mov byte [ebx - 0x3fccb7cf], cl
push ebx
sar cl, cl
add dword [edi - 0x77], edx
inc ebp
cld
xchg byte [ebp - 0x38], al
jne 0x40b395
mov edi, dword [esi + 5]
mov al, byte [0x91840ff8]
add byte [eax], al
add byte [ebx - 0x7cc7a2], cl
cmpsd dword [esi], dword es:[edi]
jnp 0x40b311
or eax, 0xffffffff
pop ss
add cl, byte [ebx + 0x4568bc6]
mov eax, esi
mov edx, dword [esi + 4]
lea ecx, [ebp + 0x1a]
push 0x70
push ecx
push eax
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b358
mov eax, dword [ebp - 4]
mov edx, dword [esi + 0x50]
mov ebx, dword [ebx]
push esp
add edx, eax
and esp, 0
sub edi, eax
sbb eax, 0x90cc89d8
test esi, eax
mov dword [esi + 0x54], ecx
push esp
ja 0x40b362
mov eax, dword [ebp + 8]
cmp bh, al
inc esi
cmp al, 0
add byte [eax], al
add byte [ebx + 0x2b], bl
mov esp, ebp
pop ebp
in eax, 4
stosd dword es:[edi], eax
mov esp, dword [eax + 0x5840c098]
call edi
test eax, eax
jne 0x40b369
mov dword [ebp + 0x64], eax
dec esp
or dh, byte [ecx - 0x29]
jno 0x40b342
add eax, 0x7e07fc80
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x23]
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
add edx, eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x50], edx
add esp, 0xffffffee
test eax, eax
mov eax, ebx
push esp
jne 0x40b395
mov dword [esi + 0x3c], 0x95000000
mov eax, dword [ebp + 8]
pop edi
pop ebx
sal byte [ebp + 0x7c04c25d], 0x33
rcr byte [esi - 0x75], 0xe5
pop ebp
ret 0x604
Function at 0x1000c510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
push ebx
mov ebx, dword [esp + 0x78]
lea eax, [esp + 0xc]
push esi
push edi
push eax
push dword [ebx + 0xc]
call fcn.1000d1d0
lea eax, [esp + 0x2c]
push eax
push dword [ebx + 0xc]
call fcn.1000d1d0
lea eax, [esp + 0x44]
push eax
push dword [ebx + 0xc]
call fcn.1000d1d0
mov eax, dword [ebx + 0xc]
lea ecx, [esp + 0x60]
push ecx
push eax
mov dword [esp + 0x64], eax
call fcn.1000d1d0
lea eax, [esp + 0x78]
push eax
push dword [ebx + 0xc]
call fcn.1000d1d0
lea eax, [esp + 0x90]
push eax
push dword [ebx + 0xc]
call fcn.1000d1d0
mov eax, dword [ebx + 0xc]
mov ebx, dword [esp + 0xd0]
mov edi, dword [esp + 0xcc]
sub ebx, 0xffffff80
push edi
push ebx
mov dword [esp + 0xb0], eax
call fcn.1000d9b0
mov esi, eax
add esp, 0x38
test esi, esi
jne 0x1000c73f
lea eax, [edi + 0x10]
push eax
push ebx
call fcn.1000d9b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000c73f
lea eax, [edi + 0x20]
push eax
push esi
call fcn.1000d530
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000c73f
push ebp
mov ebp, dword [esp + 0x94]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x94]
add eax, 4
push ebp
push eax
call fcn.10032230
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1000c73e
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x94]
add eax, 0x14
push ebp
push eax
call fcn.10032230
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1000c73e
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.1000d9b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000c73e
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.1000d9b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000c73e
lea eax, [esp + 0x5c]
push eax
push ebp
lea eax, [esp + 0x30]
push eax
push ebp
call fcn.1000f770
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x1000c73e
lea eax, [esp + 0x6c]
push eax
push ebx
call fcn.1000d9b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000c73e
mov ebx, dword [esp + 0x8c]
dec ebx
test ebx, ebx
jle 0x1000c73e
jmp 0x1000c6a0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x8c]
push ebx
call fcn.1000d740
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x94]
push ebx
call fcn.1000d740
push dword [esp + 0xbc]
push edi
push dword [esp + 0xbc]
push ebp
push dword [esp + 0xc0]
push edi
call fcn.1000be10
mov esi, eax
add esp, 0x30
test esi, esi
jne 0x1000c73e
mov eax, dword [esp + 0x14]
cmp eax, 1
jne 0x1000c6ff
cmp dword [esp + 0x10], esi
jne 0x1000c735
lea eax, [esp + 0x18]
jmp 0x1000c70e
test eax, eax
jne 0x1000c735
cmp dword [esp + 0x10], 1
jne 0x1000c735
lea eax, [esp + 0x4c]
push dword [esp + 0xa4]
push edi
push dword [esp + 0xa4]
push ebp
push dword [esp + 0xa8]
push eax
push edi
call fcn.1000ba70
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x1000c73e
dec ebx
test ebx, ebx
jg 0x1000c6a0
pop ebp
lea eax, [esp + 0x14]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x28]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x3c]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x54]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x68]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x7c]
push eax
call fcn.1000d1f0
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x70
ret
Function at 0x10025040
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
test esi, esi
je 0x100251fb
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x100251fb
mov ebp, dword [esp + 0x34]
test ebp, ebp
je 0x100251fb
push ebx
mov ebx, dword [esp + 0x28]
cmp dword [esp + 0x3c], edi
jne 0x1002517b
mov eax, dword [esi]
lea ecx, [esp + 0x20]
push ecx
push eax
push dword [ebx + 0x1c]
mov dword [esp + 0x28], eax
call fcn.10050400
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100251cc
lea eax, [esp + 0x30]
push eax
push 4
push dword [ebx + 0x18]
call fcn.10050c10
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100251cc
lea eax, [esp + 0x18]
push eax
push esi
push edi
push dword [ebx + 0x1c]
push dword [esp + 0x40]
call fcn.10051790
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x100251cc
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
push esi
call fcn.10051840
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10025120
mov eax, dword [ebx]
push esi
push 0
push 0x3ec
mov eax, dword [eax + 0x1c]
push ebx
call eax
add esp, 0x10
jmp 0x100251cc
mov eax, dword [ebp]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x38]
push dword [ebp + 4]
push dword [eax]
push dword [eax + 4]
push esi
call fcn.10051890
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x10025108
mov eax, dword [ebp]
sub eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 4]
add eax, dword [esp + 0x14]
push eax
push esi
call fcn.100518f0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10025108
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x10]
mov dword [ebp], eax
jmp 0x100251cc
mov ecx, dword [ecx]
cmp ecx, dword [esi]
cmova ecx, dword [esi]
xor esi, esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
test ecx, ecx
je 0x100251c9
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
jmp 0x100251a0
mov eax, dword [ebx + 4]
mov ecx, dword [edi + 4]
mov dl, byte [eax + esi]
xor dl, byte [ecx + esi]
mov eax, dword [ebp + 4]
mov byte [esi + eax], dl
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc esi
mov dword [esp + 0x10], esi
cmp esi, ecx
jb 0x100251a0
mov ebx, dword [esp + 0x28]
xor edi, edi
mov dword [ebp], ecx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100251e0
push eax
push dword [ebx + 0x1c]
call fcn.10050380
add esp, 8
mov eax, dword [esp + 0x18]
pop ebx
test eax, eax
je 0x100251f2
push eax
call fcn.10051820
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x14
ret
pop edi
pop esi
mov eax, 0x2721
pop ebp
add esp, 0x14
ret
Function at 0x10025320
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
test esi, esi
je 0x100254db
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x100254db
mov ebp, dword [esp + 0x34]
test ebp, ebp
je 0x100254db
push ebx
mov ebx, dword [esp + 0x28]
cmp dword [esp + 0x3c], edi
jne 0x1002545b
mov eax, dword [esi]
lea ecx, [esp + 0x20]
push ecx
push eax
push dword [ebx + 0x1c]
mov dword [esp + 0x28], eax
call fcn.10050400
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100254ac
lea eax, [esp + 0x30]
push eax
push 4
push dword [ebx + 0x18]
call fcn.10050c10
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100254ac
lea eax, [esp + 0x18]
push eax
push esi
push edi
push dword [ebx + 0x1c]
push dword [esp + 0x40]
call fcn.10051790
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x100254ac
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x1c]
push esi
call fcn.10051a30
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10025400
mov eax, dword [ebx]
push esi
push 0
push 0x3ec
mov eax, dword [eax + 0x1c]
push ebx
call eax
add esp, 0x10
jmp 0x100254ac
mov eax, dword [ebp]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x38]
push dword [ebp + 4]
push dword [eax]
push dword [eax + 4]
push esi
call fcn.10051a80
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x100253e8
mov eax, dword [ebp]
sub eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 4]
add eax, dword [esp + 0x14]
push eax
push esi
call fcn.10051ae0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x100253e8
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x10]
mov dword [ebp], eax
jmp 0x100254ac
mov ecx, dword [ecx]
cmp ecx, dword [esi]
cmova ecx, dword [esi]
xor esi, esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
test ecx, ecx
je 0x100254a9
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
jmp 0x10025480
mov eax, dword [ebx + 4]
mov ecx, dword [edi + 4]
mov dl, byte [eax + esi]
xor dl, byte [ecx + esi]
mov eax, dword [ebp + 4]
mov byte [esi + eax], dl
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc esi
mov dword [esp + 0x10], esi
cmp esi, ecx
jb 0x10025480
mov ebx, dword [esp + 0x28]
xor edi, edi
mov dword [ebp], ecx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100254c0
push eax
push dword [ebx + 0x1c]
call fcn.10050380
add esp, 8
mov eax, dword [esp + 0x18]
pop ebx
test eax, eax
je 0x100254d2
push eax
call fcn.10051820
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x14
ret
pop edi
pop esi
mov eax, 0x2721
pop ebp
add esp, 0x14
ret
Function at 0x10025a40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [ebx], 0
mov dword [esp + 0xc], 0
cmp dword [edi], 2
je 0x10025a76
mov esi, 0xe
push esi
call fcn.10051300
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov esi, dword [edi + 4]
push ebp
mov ebp, dword [esp + 0x34]
add esi, 7
push ebp
push dword [edi + 0x84]
shr esi, 3
mov dword [esp + 0x20], esi
call fcn.10050640
mov ecx, eax
add esp, 8
mov dword [esp + 0x14], ecx
test ecx, ecx
jne 0x10025aa9
lea esi, [eax + 0x10]
jmp 0x10025bbd
mov eax, dword [edi + 0x24]
add eax, 0x14
add eax, ebp
cmp dword [esp + 0x24], 0
jne 0x10025ac1
xor esi, esi
mov dword [ebx], eax
jmp 0x10025bbd
cmp dword [esp + 0x2c], eax
jae 0x10025ad1
mov esi, 0x10
jmp 0x10025bbd
push ebp
push ecx
push esi
push dword [edi + 0x28]
push dword [edi + 0x84]
call fcn.10036e60
mov esi, eax
add esp, 0x14
test esi, esi
je 0x10025af5
mov esi, 0x10
jmp 0x10025bbd
push dword [edi + 0x24]
push dword [edi + 0x20]
push dword [esp + 0x2c]
call fcn.100506d0
mov eax, dword [edi + 0x24]
add esp, 0xc
add dword [ebx], eax
mov ecx, dword [edi + 0x24]
test ebp, ebp
jle 0x10025b3f
mov edx, dword [esp + 0x24]
mov edi, ebp
mov ebx, dword [esp + 0x14]
add edx, ecx
mov ecx, dword [esp + 0x30]
sub ebx, ecx
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
dec edi
jne 0x10025b25
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x28]
add dword [ebx], ebp
push dword [edi + 0x84]
call fcn.10037270
push eax
lea eax, [esp + 0x18]
push eax
call fcn.10037120
add esp, 0xc
test eax, eax
je 0x10025b65
mov esi, 0x10
jmp 0x10025bbd
push dword [esp + 0x10]
call fcn.100371e0
add esp, 4
test eax, eax
je 0x10025b7c
mov esi, 0x10
jmp 0x10025bbd
push dword [esp + 0x18]
push dword [edi + 0x28]
push dword [esp + 0x18]
call fcn.10037210
mov eax, dword [edi + 0x24]
add eax, dword [esp + 0x30]
push ebp
push eax
push dword [esp + 0x24]
call fcn.10037210
mov eax, dword [edi + 0x24]
add eax, dword [esp + 0x3c]
add eax, ebp
push eax
push dword [esp + 0x2c]
call fcn.10037240
add esp, 0x20
add dword [ebx], 0x14
mov dword [edi], 1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10025bd8
push eax
call fcn.10037080
add esp, 4
mov ecx, 0x10
test eax, eax
cmovne esi, ecx
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x10025bf8
push ebp
push 0
push ebx
call fcn.100506f0
push ebx
push dword [edi + 0x84]
call fcn.10050630
add esp, 0x14
pop ebp
test esi, esi
jne 0x10025a66
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x1002b4e0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
mov eax, dword [edi]
add eax, 0x1f
sar eax, 5
dec eax
js 0x1002b518
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
jmp 0x1002b500
mov ecx, dword [edi + 4]
mov edx, dword [ebx + 4]
mov esi, dword [ecx + eax*4]
mov ecx, dword [ebp + 4]
xor esi, dword [edx + eax*4]
mov dword [ecx + eax*4], esi
dec eax
jns 0x1002b500
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
ret
Function at 0x100385d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov eax, dword [0x1007b6c0]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
push edi
mov edi, dword [esp + 0x70]
lea eax, [esp + 0x20]
push eax
push dword [edi + 0x14]
call fcn.10037ad0
lea eax, [esp + 0x40]
push eax
push dword [edi + 0x14]
call fcn.10037ad0
lea eax, [esp + 0x60]
push eax
push dword [edi + 0x14]
call fcn.10037ad0
lea eax, [esp + 0x20]
push eax
push dword [edi + 0x14]
call fcn.10037ad0
lea eax, [esp + 0x28]
push eax
mov eax, dword [edi + 4]
add eax, eax
push eax
call fcn.10038390
mov esi, eax
add esp, 0x28
test esi, esi
jne 0x100386ff
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], 1
mov dword [eax], 2
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0xc]
push eax
call fcn.10037d20
mov esi, eax
add esp, 8
test esi, esi
jne 0x100386ff
push ebx
mov ebx, 1
cmp dword [edi + 4], ebx
jle 0x100386fe
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.10050400
mov esi, eax
add esp, 8
test esi, esi
jne 0x100386fe
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x44]
push edi
push eax
call fcn.10038740
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x100386fe
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x14]
push eax
call fcn.10037860
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100386fe
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x40]
push edi
push eax
call fcn.10038410
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100386fe
cmp dword [esp + 0x28], eax
jne 0x100386f9
mov eax, dword [esp + 0x30]
test byte [eax], 1
je 0x100386f9
inc ebx
cmp ebx, dword [edi + 4]
jl 0x10038672
jmp 0x100386fe
mov esi, 0x515
pop ebx
lea eax, [esp + 0x20]
push eax
call fcn.10037b00
lea eax, [esp + 0x3c]
push eax
call fcn.10037b00
lea eax, [esp + 0x58]
push eax
call fcn.10037b00
lea eax, [esp + 0x14]
push eax
call fcn.10037b00
mov ecx, dword [esp + 0x78]
add esp, 0x10
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.10052dd6
add esp, 0x64
ret
Function at 0x10039a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x44
push ebp
push esi
push edi
mov edi, dword [esp + 0x54]
lea eax, [esp + 0x20]
push eax
push edi
mov dword [esp + 0x14], 0
call fcn.1000d1d0
lea eax, [esp + 0x38]
push eax
push edi
call fcn.1000d1d0
lea eax, [esp + 0x20]
push eax
push edi
call fcn.1000d1d0
lea eax, [esp + 0x58]
push eax
push edi
call fcn.1000d1d0
mov ebp, dword [esp + 0x9c]
push ebp
call fcn.10051e40
mov esi, eax
add esp, 0x24
test esi, esi
jne 0x10039c49
push ebx
mov ebx, dword [esp + 0x60]
lea eax, [esp + 0x34]
push ebp
push eax
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x74]
push dword [esp + 0x74]
push ebx
push dword [esp + 0x74]
push edi
call fcn.10038fe0
mov esi, eax
add esp, 0x20
test esi, esi
jne 0x10039c48
push ebp
call fcn.10051e40
mov esi, eax
add esp, 4
test esi, esi
jne 0x10039c48
mov edi, dword [esp + 0x78]
mov ebp, dword [esp + 0x74]
push ebx
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x64]
call fcn.1003d4f0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10039c48
mov eax, dword [esp + 0x64]
cmp eax, 1
jne 0x10039b5f
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.1000d9b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x10039c48
push edi
push eax
call fcn.1000d530
add esp, 8
jmp 0x10039be9
cmp eax, 3
lea eax, [esp + 0x14]
push edi
jne 0x10039b88
push eax
call fcn.1000d9b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x10039c48
push ebp
push eax
call fcn.1000d530
add esp, 8
jmp 0x10039be9
push ebx
push eax
lea eax, [esp + 0x20]
push eax
call fcn.1000f710
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x10039c48
push ebp
push ebx
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.1000f710
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x10039c48
lea eax, [esp + 0x44]
push eax
push ebx
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.1000f710
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x10039c48
push edi
push ebx
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.1000f710
add esp, 0x10
mov esi, eax
test esi, esi
jne 0x10039c48
push dword [esp + 0x7c]
push ebx
push edi
push ebp
push dword [esp + 0x80]
push dword [esp + 0x80]
push dword [esp + 0x74]
call fcn.10039c80
mov esi, eax
add esp, 0x1c
cmp esi, 0xd1
jne 0x10039c48
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x64
jae 0x10039c43
push dword [esp + 0x80]
call fcn.10051e40
mov esi, eax
add esp, 4
test esi, esi
je 0x10039b13
jmp 0x10039c48
mov esi, 0xd7
pop ebx
lea eax, [esp + 0x20]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x34]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x18]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x4c]
push eax
call fcn.1000d1f0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x44
ret
Function at 0x10039c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x78]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x14], 0
push dword [edi + 0xc]
call fcn.1000d1d0
lea eax, [esp + 0x2c]
push eax
push dword [edi + 0xc]
call fcn.1000d1d0
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x4c]
push ecx
push eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], 0
call fcn.1000d1d0
lea eax, [esp + 0x64]
push eax
push dword [edi + 0xc]
call fcn.1000d1d0
mov eax, dword [edi + 0xc]
mov ebp, dword [esp + 0x84]
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x34]
push edi
push eax
push ebp
call fcn.1003d4f0
mov ebx, dword [esp + 0xa0]
mov esi, eax
add esp, 0x2c
test esi, esi
jne 0x10039dbf
mov eax, dword [esp + 0x1c]
push edi
mov ebx, dword [eax]
lea eax, [esp + 0x18]
push eax
push ebp
and ebx, 1
call fcn.1003d4f0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10039d5b
lea eax, [esp + 0x24]
push eax
push edi
push dword [esp + 0x7c]
lea eax, [esp + 0x20]
push dword [esp + 0x7c]
push ebx
push eax
call fcn.1000cbe0
mov esi, eax
add esp, 0x18
cmp esi, 0x1f6
jne 0x10039d5b
push edi
lea eax, [esp + 0x18]
push eax
push ebp
call fcn.1003d4f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10039d02
mov ebx, dword [esp + 0x74]
test esi, esi
jne 0x10039dbf
mov ebp, dword [esp + 0x7c]
lea eax, [esp + 0x10]
push esi
push ebp
push edi
push ebx
push dword [esp + 0x80]
push dword [esp + 0x7c]
push eax
call fcn.1000cd40
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x10039dbf
cmp dword [ebp], eax
jne 0x10039dbf
push eax
lea eax, [esp + 0x3c]
push eax
push edi
push ebx
push dword [esp + 0x80]
push dword [esp + 0x80]
push ebp
call fcn.1000cd40
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x10039dbf
cmp dword [esp + 0x38], esi
mov eax, 0xd1
cmove esi, eax
lea eax, [esp + 0x14]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x28]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x44]
push eax
call fcn.1000d1f0
lea eax, [esp + 0x58]
push eax
call fcn.1000d1f0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret