joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1108dfd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax], 0
je 0x1108e067
push 2
lea ecx, [ebp - 2]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.1108dda4
test al, al
je 0x1108e067
cmp word [ebp - 2], 0x5a4d
jne 0x1108e067
push 4
lea ecx, [ebp - 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
add edx, 0x3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.1108dda4
test al, al
je 0x1108e067
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov edx, dword [edx]
add edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.1108dda4
test al, al
je 0x1108e067
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp dword [eax], 0x4550
jne 0x1108e067
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
test byte [eax + 0x17], 0x20
je 0x1108e06b
xor eax, eax
jmp 0x1108e06d
mov al, 1
test al, al
je 0x1108e08a
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
movzx ecx, word [ebp - 2]
add edx, ecx
add edx, 0x78
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov dword [ecx], edx
pop ecx
pop ecx
pop ebp
ret
Function at 0x1108e584
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, eax
xor edi, edi
push esi
push 0x2bb
call fcn.1107d054
mov ebx, eax
test ebx, ebx
je 0x1108e78d
cmp dword [0x11098ffc], 0
jne 0x1108e5c6
mov dl, 1
mov eax, dword [0x11098c1c]
call fcn.1107bbb8
mov dword [0x11098ffc], eax
cmp dword [0x11099000], 0
jne 0x1108e5e0
mov dl, 1
mov eax, dword [0x11098c50]
call fcn.1107bbb8
mov dword [0x11099000], eax
mov byte [ebp - 0x24a], 0xb8
mov dword [ebp - 0x249], ebx
mov byte [ebp - 0x245], 0xb9
lea eax, [ebx + 0x235]
mov dword [ebp - 0x244], eax
mov word [ebp - 0x240], 0xd1ff
xor eax, eax
mov dword [ebp - 0x23e], eax
xor eax, eax
mov dword [ebp - 0x23a], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.1108e548
mov dword [ebp - 0x236], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x14]
push eax
call sub.KERNEL32.dll_lstrlenW
add eax, eax
mov word [ebp - 0x22d], ax
mov ax, word [ebp - 0x22d]
add ax, 2
mov word [ebp - 0x22b], ax
lea eax, [ebx + 0x25]
mov dword [ebp - 0x229], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov eax, dword [eax - 0x14]
push eax
lea eax, [ebp - 0x225]
push eax
call sub.KERNEL32.dll_lstrcpyW
mov eax, dword [0x11099000]
mov dword [ebp - 0x1d], eax
mov eax, dword [0x11098ffc]
mov dword [ebp - 0x19], eax
cmp dword [ebp - 0x236], 0
je 0x1108e78d
lea eax, [ebp - 0x10]
push eax
push 0x236
lea eax, [ebp - 0x24a]
push eax
push ebx
push esi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x1108e78d
cmp dword [ebp - 0x10], 0x236
jne 0x1108e78d
lea eax, [ebp - 0x10]
push eax
push 0x85
push 0x110992b8
lea eax, [ebx + 0x235]
push eax
push esi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x1108e78d
cmp dword [ebp - 0x10], 0x85
jne 0x1108e78d
lea eax, [ebp - 0x10]
push eax
push 5
lea eax, [ebp - 9]
push eax
mov eax, dword [ebp - 0x236]
push eax
push esi
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x1108e78d
cmp dword [ebp - 0x10], 5
jne 0x1108e78d
lea eax, [ebp - 0x10]
push eax
push 5
lea eax, [ebp - 9]
push eax
lea eax, [ebx + 0x18]
push eax
push esi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x1108e78d
cmp dword [ebp - 0x10], 5
jne 0x1108e78d
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
mov eax, dword [ebp - 0x236]
push eax
push esi
call sub.KERNEL32.dll_VirtualProtectEx
test eax, eax
je 0x1108e78d
mov byte [ebp - 9], 0xe9
sub ebx, dword [ebp - 0x236]
sub ebx, 5
mov dword [ebp - 8], ebx
lea eax, [ebp - 0x10]
push eax
push 5
lea eax, [ebp - 9]
push eax
mov eax, dword [ebp - 0x236]
push eax
push esi
call sub.KERNEL32.dll_WriteProcessMemory
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 5
mov eax, dword [ebp - 0x236]
push eax
push esi
call sub.KERNEL32.dll_VirtualProtectEx
mov edi, 1
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1108e900
Capabilities:
Get number of processors

Disassembly:
mov eax, dword gs:[0x60]
mov edx, dword gs:[0x64]
ret
Function at 0x11090108
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0
push 1
push 0
push 0
push 0
push 0xffffffffffffffff
push 1
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.1108f024
mov ebx, eax
test bl, bl
je 0x1109015e
test esi, 4
jne 0x11090169
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_ResumeThread
jmp 0x11090169
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_TerminateProcess
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x11092844
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
xor eax, eax
mov dword [ebp - 0x150], eax
xor eax, eax
push ebp
push 0x110928e9
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x150]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
call fcn.11074720
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
xor ecx, ecx
call fcn.11090bf4
mov ebx, eax
test bl, bl
je 0x110928d0
mov eax, dword [ebp - 0x140]
push eax
call sub.KERNEL32.dll_CloseHandle
push 0x64
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
push 0
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_TerminateThread
mov eax, dword [ebp - 0x144]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x110928f0
lea eax, [ebp - 0x150]
call fcn.11074528
ret
Function at 0x11092b88
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x11092d72
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x11099448], 0
jne 0x11092d57
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x11092d50
xor eax, eax
push ebp
push 0x11092d49
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x11092d32
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x11092d2c
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x11098d54]
call fcn.11077d38
mov eax, dword [ebp - 0x24]
call fcn.1107497c
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x11092c60
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x11098d58]
call fcn.11077d38
mov eax, dword [ebp - 0x28]
call fcn.1107497c
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x11092c93
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x11098d5c]
call fcn.11077d38
mov eax, dword [ebp - 0x2c]
call fcn.1107497c
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x11092cc6
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov esi, dword [ebx]
dec esi
test esi, esi
jl 0x11092d18
inc esi
xor ecx, ecx
lea edi, [ecx + ecx*2]
mov eax, dword [ebx + edi*4 + 4]
mov edx, dword [ebx + edi*4 + 8]
cmp edx, dword [ebp - 0xc]
jne 0x11092ce3
cmp eax, dword [ebp - 0x10]
je 0x11092d14
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x14]
jne 0x11092cf8
cmp eax, dword [ebp - 0x18]
je 0x11092d14
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x1c]
jne 0x11092d0d
cmp eax, dword [ebp - 0x20]
je 0x11092d14
or dword [ebx + edi*4 + 0xc], 2
inc ecx
dec esi
jne 0x11092cd0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_AdjustTokenPrivileges
push ebx
call sub.KERNEL32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x11092d50
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
ret
mov byte [0x11099448], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x11092d79
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.1107454c
ret
Function at 0x1803058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.018031a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x180307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x180306a
add dl, dl
jne 0x1803089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x18030dc
xor eax, eax
add dl, dl
jne 0x1803096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x180317d
add dl, dl
jne 0x18030a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18030b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18030bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18030c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x18030d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1803075
mov eax, 1
add dl, dl
jne 0x18030ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x18030f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x18030e1
sub eax, ebx
mov ebx, 1
jne 0x1803128
mov ecx, 1
add dl, dl
jne 0x180310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1803119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1803105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1803075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1803136
cmp eax, 0x7d00
jae 0x180316d
cmp eax, 0x500
jb 0x1803168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1803075
cmp eax, 0x7f
ja 0x1803170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1803075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x180319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1803075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x1000b530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebp
push edi
mov edi, edx
mov ebp, ecx
mov eax, dword [eax + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x1000b550
mov ecx, dword [edi + 0x74]
call eax
push ebx
push esi
mov esi, dword [edi + 0x54]
test esi, esi
je 0x1000b5b9
nop dword [eax]
mov ebx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x1000b5b2
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x1000b587
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x1000b576
jmp 0x1000b5b2
test edx, edx
jne 0x1000b590
mov dword [ebx + 0x54], ecx
jmp 0x1000b593
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1000b59e
mov ecx, esi
call eax
mov ecx, esi
call fcn.1000ac10
mov eax, dword [esp + 0x10]
mov edx, esi
mov ecx, eax
mov eax, dword [eax + 8]
call eax
mov esi, dword [edi + 0x54]
test esi, esi
jne 0x1000b560
lea eax, [edi + 0x6c]
test eax, eax
je 0x1000b638
test ebp, ebp
je 0x1000b638
mov ebx, dword [eax]
test ebx, ebx
je 0x1000b62b
nop word [eax + eax]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x1000b5e5
mov ecx, esi
call eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x1000b5f7
mov ecx, esi
call eax
mov edx, dword [esi + 0x28]
test edx, edx
je 0x1000b605
mov eax, dword [ebp + 8]
mov ecx, ebp
call eax
mov dword [esi + 0x28], 0
mov edx, esi
mov eax, dword [ebp + 8]
mov ecx, ebp
call eax
mov eax, dword [ebp + 8]
mov edx, ebx
mov ecx, ebp
call eax
mov eax, dword [esp + 0x10]
mov ebx, eax
test eax, eax
jne 0x1000b5d0
lea eax, [edi + 0x6c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x30]
mov dword [edi + 0x58], 0
test eax, eax
je 0x1000b64a
mov ecx, edi
call eax
mov edx, ebp
mov ecx, edi
call fcn.1000b4b0
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x1000b662
mov ecx, edi
call eax
mov esi, dword [edi + 0x68]
mov eax, dword [edi + 8]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x1000b691
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
test eax, eax
je 0x1000b67e
mov ecx, esi
call eax
test dword [esp + 0x1c], 0x400
jne 0x1000b691
mov eax, dword [ebx + 8]
mov edx, esi
mov ecx, ebx
call eax
mov edx, dword [edi + 0x80]
mov dword [edi + 0x68], 0
pop esi
pop ebx
test edx, edx
je 0x1000b6b5
mov eax, dword [ebp + 8]
mov ecx, ebp
call eax
mov dword [edi + 0x80], 0
mov eax, dword [ebp + 8]
mov edx, edi
mov ecx, ebp
call eax
pop edi
pop ebp
add esp, 8
ret 4
Function at 0x10025eb0
Capabilities:
Encode data using xor

Disassembly:
push ecx
imul eax, edx, 0xcc
push ebx
push esi
mov ebx, dword [eax + ecx + 4]
lea esi, [eax + ecx]
test ebx, ebx
je 0x10025f29
push ebp
mov ebp, dword [eax + ecx + 0xc8]
mov edx, ebp
mov ecx, dword [esi + 8]
call fcn.10009400
lea ecx, [esi + 0xc]
mov dword [ecx], eax
add eax, 0x20
and eax, 0xffffffc0
mov dword [esp + 0xc], ecx
mov dword [esi + 0x10], eax
add esi, 0x14
sub ebx, 1
je 0x10025f28
push edi
mov ecx, dword [esi]
mov edx, ebp
call fcn.10009400
mov edi, eax
lea esi, [esi + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov eax, edi
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x80
cmovl edi, ecx
mov dword [esi - 8], edi
lea eax, [edi + 0x20]
and eax, 0xffffffc0
mov dword [esi - 4], eax
sub ebx, 1
jne 0x10025ef1
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0x100287b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
xor ebp, ebp
mov dword [esp + 0x10], ebx
push edi
mov eax, dword [esi + 0x1c]
sub eax, 0x20
mov dword [esi + 0x54], 0
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x50], eax
mov word [esi + 0x4e], 0
mov dword [esi + 0x2c], 0
mov dword [eax + 8], eax
xor eax, eax
mov word [esi + 0x4c], ax
cmp ax, word [esi + 0x78]
jge 0x100288c6
xor edx, edx
nop dword [eax]
mov eax, dword [esi + 0x84]
mov ecx, esi
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
push ebx
movzx eax, word [eax + ebp*2]
push eax
call fcn.100283f0
test al, al
jne 0x10028963
mov eax, dword [esi + 0x84]
mov edi, dword [esi + 4]
mov edx, dword [esi + 0x40]
movzx eax, word [eax + ebp*2]
mov dword [esp + 0x10], eax
lea eax, [edi - 1]
test edx, eax
jne 0x10028867
cmp edx, dword [esi + 0x44]
jl 0x10028867
cmp edx, dword [esi + 0x48]
jg 0x10028867
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x10028867
mov eax, dword [esi + 0x50]
mov cl, byte [ecx + 0xc]
xor cl, byte [eax + 0xc]
test cl, 8
jne 0x10028867
add dword [esi + 0x24], 0xfffffffc
mov ebx, dword [esi + 0x50]
mov eax, dword [esi + 0x24]
cmp eax, dword [ebx + 8]
je 0x10028883
test byte [ebx + 0xc], 8
je 0x10028883
neg edi
and edi, edx
sub edx, edi
cmp edx, dword [esi + 8]
jmp 0x10028891
lea eax, [edi - 1]
neg edi
add eax, edx
and eax, edi
sub eax, edx
cmp eax, dword [esi + 8]
setge dl
mov ecx, esi
call fcn.100279b0
test al, al
jne 0x10028963
mov eax, dword [esi + 0x58]
test eax, eax
je 0x100288ad
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0x10]
inc ebp
mov ebx, dword [esp + 0x14]
inc eax
movzx edx, ax
movsx eax, word [esi + 0x78]
cmp ebp, eax
jl 0x10028800
movzx eax, word [esi + 0x4c]
mov edi, dword [esi + 0x54]
mov dword [esp + 0x10], eax
cmp eax, 1
jbe 0x1002896d
test edi, edi
je 0x1002896d
lea ebx, [edi + 4]
mov dword [esp + 0x14], ebx
cmp ax, 1
jbe 0x100288fa
mov ecx, dword [edi + 0x10]
mov eax, dword [edi + 8]
lea eax, [eax + ecx*4]
jmp 0x100288fc
xor eax, eax
mov dword [ebx], eax
test byte [edi + 0xc], 8
mov ebx, dword [edi + 0x14]
mov edx, ebx
mov eax, dword [edi + 0x10]
je 0x10028911
dec ebx
add ebx, eax
jmp 0x10028921
sub edx, eax
lea eax, [eax*4 - 4]
inc edx
add dword [edi + 8], eax
mov dword [edi + 0x14], edx
mov ecx, esi
call fcn.10027a40
test al, al
jne 0x10028963
lea edx, [ebx + 1]
mov ecx, esi
call fcn.10027a40
test al, al
jne 0x10028963
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
add eax, 0xffff
mov dword [esp + 0x10], eax
mov edi, dword [edi]
test ax, ax
jne 0x100288e2
mov eax, dword [esi + 0x24]
cmp eax, dword [esi + 0x20]
pop edi
pop esi
pop ebp
setae al
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
mov eax, dword [esi + 0x24]
cmp eax, dword [esi + 0x20]
pop edi
mov dword [esi + 0x54], 0
setae al
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10037a40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x18], edi
mov ebx, dword [edi + 0xc]
mov ecx, dword [edi + 0x44]
mov edx, dword [edi + 0x48]
mov dword [esp + 0x1c], ebx
movsx ebp, word [ebx + 0x3a]
mov eax, dword [ebx + 0x3c]
lea esi, [ebp*8]
mov dword [esi + eax], ecx
mov dword [esi + eax + 4], edx
mov eax, dword [ebx + 0x3c]
mov ecx, dword [edi + 0x4c]
mov edx, dword [edi + 0x50]
mov dword [esp + 0x20], esi
mov dword [eax + esi + 8], ecx
mov dword [eax + esi + 0xc], edx
mov eax, dword [ebx + 0x3c]
mov ecx, dword [edi + 0xb4]
mov edx, dword [edi + 0xb8]
mov dword [eax + ebp*8 + 0x10], ecx
mov dword [eax + ebp*8 + 0x14], edx
mov eax, dword [ebx + 0x3c]
mov ecx, dword [edi + 0xbc]
mov edx, dword [edi + 0xc0]
mov dword [eax + ebp*8 + 0x18], ecx
mov dword [eax + ebp*8 + 0x1c], edx
mov eax, dword [ebx + 0x40]
mov byte [eax + ebp], 0
mov eax, dword [ebx + 0x40]
mov byte [eax + ebp + 1], 0
mov eax, dword [ebx + 0x40]
mov byte [eax + ebp + 2], 0
mov eax, dword [ebx + 0x40]
mov byte [eax + ebp + 3], 0
add ebp, 4
test byte [edi + 0x10], 2
mov dword [esp + 0x24], ebp
jne 0x10037b3c
movzx esi, word [ebx + 0x3a]
mov word [edi + 0x80], si
mov ax, word [ebx + 0x38]
mov word [edi + 0x82], ax
mov eax, dword [ebx + 0x4c]
mov dword [edi + 0x84], eax
mov edx, dword [ebx + 0x3c]
mov dword [edi + 0x88], edx
mov ecx, dword [ebx + 0x50]
mov dword [edi + 0x8c], ecx
mov eax, dword [ebx + 0x40]
mov dword [edi + 0x90], eax
mov eax, dword [ebx + 0x44]
mov dword [edi + 0x94], eax
xor eax, eax
mov word [edi + 0x98], ax
lea eax, [esi*8 + 0x20]
push eax
push edx
push ecx
call fcn.10101750
add esp, 0xc
mov esi, dword [ebx + 0x3c]
mov edx, edi
sub edx, 0xffffff80
test byte [edi + 0x10], 1
lea ebp, [esi + ebp*8]
jne 0x10037b8e
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x2c]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
cmp esi, ebp
jae 0x10037b8e
mov ebx, ecx
mov edi, eax
mov ecx, dword [esi]
mov edx, ebx
call fcn.10009400
mov ecx, dword [esi + 4]
mov edx, edi
mov dword [esi], eax
call fcn.10009400
mov dword [esi + 4], eax
add esi, 8
cmp esi, ebp
jb 0x10037b61
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
lea edx, [edi + 0x80]
test byte [edi + 0x10], 2
mov eax, dword [ebx + 0x3c]
mov esi, dword [esp + 0x20]
mov ecx, dword [esi + eax]
mov eax, dword [esi + eax + 4]
mov esi, dword [esp + 0x24]
mov dword [edi + 0x44], ecx
mov dword [edi + 0x48], eax
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + esi*8 - 0x18]
mov eax, dword [eax + esi*8 - 0x14]
mov dword [edi + 0x4c], ecx
mov dword [edi + 0x50], eax
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + esi*8 - 0x10]
mov eax, dword [eax + esi*8 - 0xc]
mov dword [edi + 0xb4], ecx
mov dword [edi + 0xb8], eax
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + esi*8 - 8]
mov eax, dword [eax + esi*8 - 4]
mov dword [edi + 0xbc], ecx
mov dword [edi + 0xc0], eax
jne 0x10037bff
add word [edx], 4
mov ecx, edi
pop edi
pop esi
pop ebp
xor dl, dl
pop ebx
add esp, 0x18
jmp fcn.100376e0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x10040740
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100407a0
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10040782
cmp edi, 2
jb 0x10040782
cmp byte [esi], cl
jne 0x10040782
cmp byte [esi + 1], cl
jne 0x10040782
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1013dac8]
jmp 0x10040753
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1013dac8]
test edi, edi
jne 0x10040753
pop edi
pop esi
not eax
pop ebx
ret 4
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100407cf
cmp cl, 0x23
jne 0x100407b6
cmp byte [esi], cl
jne 0x100407b6
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1013dac8]
test cl, cl
jne 0x100407a7
pop edi
pop esi
not eax
pop ebx
ret 4

Function at 0x100408b0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
test ebp, ebp
je 0x100408c3
mov dword [ebp], 0
call fcn.100407e0
mov esi, eax
test esi, esi
je 0x100409bb
push esi
call fcn.10108be8
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x100409b2
push 2
push 0
push esi
call fcn.10108f2d
add esp, 0xc
test eax, eax
jne 0x100409b2
push esi
call fcn.10108be8
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x100409b2
push 0
push ebx
push esi
call fcn.10108f2d
add esp, 0xc
test eax, eax
jne 0x100409b2
mov eax, dword [0x10159260]
test eax, eax
je 0x10040932
inc dword [eax + 0x370]
mov eax, dword [esp + 0x18]
add eax, edi
push eax
call fcn.10105fb5
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100409b2
push esi
push edi
push 1
push ebx
call fcn.1010914d
add esp, 0x10
cmp eax, edi
je 0x10040982
push esi
call fcn.101084da
mov eax, dword [0x10159260]
add esp, 4
test eax, eax
je 0x10040970
dec dword [eax + 0x370]
push ebx
call fcn.10105fcb
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x10040999
push eax
lea eax, [edi + ebx]
push 0
push eax
call fcn.101010f0
add esp, 0xc
push esi
call fcn.101084da
add esp, 4
test ebp, ebp
je 0x100409a9
mov dword [ebp], edi
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret 8
push esi
call fcn.101084da
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8