joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1014d260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10198bef
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
mov eax, dword [edi - 0x5a8]
mov dword [edi - 0x5ac], 0x101e2198
mov ecx, dword [eax + 4]
mov dword [ecx + edi - 0x5a8], 0x101e21d4
lea esi, [edi - 0x28]
mov ecx, esi
mov dword [esp + 0x20], 0x13
call fcn.1006bc70
mov ebp, vtable.ert_RefCounter.0
mov dword [esi + 0x1c], ebp
lea esi, [edi - 0x4c]
mov ecx, esi
mov byte [esp + 0x20], 0x12
call fcn.1006bc70
mov dword [esi + 0x1c], ebp
lea esi, [edi - 0x70]
xor ebx, ebx
cmp esi, ebx
mov byte [esp + 0x20], 0x11
je 0x1014d2e8
lea eax, [esi + 0x14]
jmp 0x1014d2ea
xor eax, eax
lea ecx, [eax + 8]
call fcn.1005e680
cmp byte [esi + 0x11], bl
mov dword [esi], vtable.ert_TmplArr_unsigned_char_.0
je 0x1014d30d
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1014d30d
push eax
call fcn.10178e5d
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x11], bl
mov dword [esi + 0x1c], ebp
lea esi, [edi - 0x94]
mov ecx, esi
mov byte [esp + 0x20], 0x10
call fcn.1006bc70
mov dword [esi + 0x1c], ebp
lea esi, [edi - 0x9c]
mov ecx, esi
mov byte [esp + 0x20], 0xf
call fcn.10019760
mov dword [esi], ebp
lea esi, [edi - 0x1c8]
push esi
mov byte [esp + 0x24], 0xe
call fcn.10001b50
mov dword [esi + 0x1c], ebp
lea esi, [edi - 0x1ec]
mov byte [esp + 0x20], 0xd
call fcn.10002000
mov dword [esi + 0x1c], ebp
lea esi, [edi - 0x1f4]
mov ecx, esi
mov byte [esp + 0x20], 0xc
call fcn.10161660
mov dword [esi], ebp
lea esi, [edi - 0x3bc]
push esi
mov byte [esp + 0x24], 0xb
call fcn.1002ce10
mov dword [esi + 0x30], ebp
lea esi, [edi - 0x3e0]
mov ecx, esi
mov byte [esp + 0x20], 0xa
call fcn.10013f50
mov dword [esi + 0x1c], ebp
lea esi, [edi - 0x404]
mov ecx, esi
mov byte [esp + 0x20], 9
call fcn.10013f50
mov dword [esi + 0x1c], ebp
lea esi, [edi - 0x428]
mov ecx, esi
mov byte [esp + 0x20], 8
call fcn.10013f50
mov dword [esi + 0x1c], ebp
lea esi, [edi - 0x430]
mov ecx, esi
mov byte [esp + 0x20], 7
call fcn.1000ab00
mov dword [esi], ebp
lea esi, [edi - 0x518]
mov byte [esp + 0x20], 6
call fcn.10041780
lea esi, [edi - 0x528]
mov byte [esp + 0x20], 5
call fcn.10041780
lea ecx, [edi - 0x538]
mov byte [esp + 0x20], 4
call fcn.10063be0
lea ecx, [edi - 0x54c]
mov byte [esp + 0x20], 3
call fcn.10063be0
lea ecx, [edi - 0x558]
mov byte [esp + 0x20], 2
call fcn.10063be0
lea esi, [edi - 0x57c]
mov ecx, esi
mov byte [esp + 0x20], 1
call fcn.10013f50
lea ecx, [edi - 0x588]
mov dword [esi + 0x1c], ebp
mov byte [esp + 0x20], bl
call fcn.10063be0
lea ecx, [edi - 0x5a4]
call fcn.10162570
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x101596f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x18
fldz
push esi
mov esi, dword [ecx + 0x1c]
fstp dword [esp + 4]
push edi
mov edi, dword [ecx + 0x60]
xor edx, edx
test edi, edi
jle 0x101597d9
mov eax, dword [ecx + 8]
push ebx
mov ebx, dword [ecx + 0x5c]
mov ecx, dword [ecx + 0x38]
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edi
xor ecx, ecx
cmp eax, ecx
mov dword [esp + 0x14], ecx
mov di, cx
jle 0x10159796
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + ecx*4]
xor eax, dword [esi + edx*4 + 4]
add ecx, 1
and eax, dword [esi + edx*4]
add edx, 2
mov ebx, eax
shr ebx, 0x10
mov ebp, eax
and ebx, 0xff
movzx bx, byte [ebx + 0x101aaf50]
shr ebp, 0x18
movzx bp, byte [ebp + 0x101aaf50]
add bx, bp
mov ebp, eax
and ebp, 0xff
movzx bp, byte [ebp + 0x101aaf50]
movzx eax, ah
movzx ax, byte [eax + 0x101aaf50]
add bx, bp
add bx, ax
mov eax, dword [esp + 0x24]
add di, bx
cmp ecx, eax
jl 0x10159733
mov ebp, dword [esp + 0x18]
xor ecx, ecx
cmp di, word [ebp]
setle cl
add ebp, 2
lea ecx, [ecx + ecx - 1]
mov dword [esp + 0x18], ecx
fild dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, 4
sub dword [esp + 0x20], 1
fmul dword [ecx - 4]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ecx
fadd dword [esp + 0x10]
fstp dword [esp + 0x10]
jne 0x10159726
pop ebp
pop ebx
fld dword [esp + 8]
pop edi
pop esi
add esp, 0x18
ret 4
Function at 0x101627f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebx, eax
xor eax, eax
push edi
mov edi, ecx
lea ebp, [eax + 2]
lea ecx, [ecx]
mov edx, dword [edi]
xor edx, dword [ebx]
mov esi, dword [edi + 4]
xor esi, dword [ebx + 4]
mov ecx, edx
and edx, 0x55555555
shr ecx, 1
and ecx, 0x55555555
add ecx, edx
mov edx, ecx
shr edx, 2
and edx, 0x33333333
and ecx, 0x33333333
add edx, ecx
mov ecx, esi
and esi, 0x55555555
shr ecx, 1
and ecx, 0x55555555
add ecx, esi
mov esi, ecx
shr esi, 2
and esi, 0x33333333
and ecx, 0x33333333
add esi, ecx
mov ecx, esi
shr ecx, 4
add ecx, esi
mov esi, edx
shr esi, 4
add esi, edx
and esi, 0xf0f0f0f
and ecx, 0xf0f0f0f
add ecx, esi
mov esi, dword [edi + 8]
xor esi, dword [ebx + 8]
add edi, 0x10
mov edx, esi
shr edx, 1
and edx, 0x55555555
and esi, 0x55555555
add edx, esi
mov esi, edx
and edx, 0x33333333
shr esi, 2
and esi, 0x33333333
add esi, edx
mov edx, esi
shr edx, 4
add edx, esi
mov esi, dword [edi - 4]
xor esi, dword [ebx + 0xc]
and edx, 0xf0f0f0f
add ecx, edx
mov edx, esi
shr edx, 1
and edx, 0x55555555
and esi, 0x55555555
add edx, esi
mov esi, edx
and edx, 0x33333333
shr esi, 2
and esi, 0x33333333
add esi, edx
mov edx, esi
shr edx, 4
add edx, esi
and edx, 0xf0f0f0f
add ecx, edx
mov edx, ecx
shr edx, 8
add ecx, edx
mov edx, ecx
shr edx, 0x10
add edx, ecx
and edx, 0xff
add eax, edx
add ebx, 0x10
sub ebp, 1
jne 0x10162800
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x101645c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10195473
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esi - 0x1c8]
mov dword [esi - 0x1cc], 0x101e4b74
mov ecx, dword [eax + 4]
mov dword [ecx + esi - 0x1c8], 0x101e4be8
lea edi, [esi - 8]
mov ecx, edi
mov dword [esp + 0x18], 5
call fcn.1000ab00
mov dword [edi], vtable.ert_RefCounter.0
lea edi, [esi - 0x110]
push edi
mov byte [esp + 0x1c], 4
call fcn.1002cfc0
mov dword [edi + 0x2c], vtable.ert_RefCounter.0
lea edi, [esi - 0x148]
push edi
mov byte [esp + 0x1c], 3
call fcn.1002ce10
lea ecx, [esi - 0x154]
mov dword [edi + 0x30], vtable.ert_RefCounter.0
mov byte [esp + 0x18], 2
call fcn.10063be0
lea edi, [esi - 0x15c]
mov ecx, edi
call fcn.10049090
add esi, 0xfffffe78
mov ecx, esi
mov dword [edi], vtable.ert_RefCounter.0
mov byte [esp + 0x18], 0
call fcn.10063be0
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.10036f50
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x10165120
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10195403
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esi - 0x2d4]
mov dword [esi - 0x2d8], 0x101e4db4
mov ecx, dword [eax + 4]
mov dword [ecx + esi - 0x2d4], 0x101e4e28
lea edi, [esi - 8]
mov ecx, edi
mov dword [esp + 0x18], 5
call fcn.1000ab00
mov dword [edi], vtable.ert_RefCounter.0
lea edi, [esi - 0xe4]
mov ecx, edi
mov byte [esp + 0x18], 4
call fcn.10019760
mov dword [edi], vtable.ert_RefCounter.0
lea edi, [esi - 0x224]
push edi
mov byte [esp + 0x1c], 3
call fcn.1002ce10
mov dword [edi + 0x30], vtable.ert_RefCounter.0
lea edi, [esi - 0x25c]
push edi
mov byte [esp + 0x1c], 2
call fcn.1002ce10
lea ecx, [esi - 0x288]
mov dword [edi + 0x30], vtable.ert_RefCounter.0
mov byte [esp + 0x18], 1
call fcn.10063be0
add esi, 0xfffffd6c
mov ecx, esi
mov byte [esp + 0x18], 0
call fcn.10063be0
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.10036f50
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x10169f70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10192412
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 8], 0
mov dword [esi + 4], 0x101e5bb4
mov eax, 1
mov dword [esi + 0x30], vtable.ert_RefCounter.0
mov dword [esi + 0x34], eax
mov ecx, dword [esi + 4]
mov dword [esi], vtable.ebs_Object.1.0
mov edx, dword [ecx + 4]
mov dword [edx + esi + 4], vtable.ebs_Object.0
mov ecx, dword [esi + 4]
mov dword [esi], vtable.evc_Cue.0
mov edx, dword [ecx + 4]
mov dword [esp + 8], eax
mov dword [edx + esi + 4], vtable.evc_Cue.1.0
mov dword [esp + 0x14], eax
mov ecx, dword [esi + 4]
mov dword [esi], vtable.vfh_BitCue.0
mov edx, dword [ecx + 4]
push eax
lea ecx, [esi + 0xc]
mov dword [edx + esi + 4], vtable.vfh_BitCue.1.0
call fcn.1005eca0
mov eax, esi
mov byte [esp + 0x14], 2
call fcn.1003dbd0
mov ecx, dword [esp + 0x20]
mov eax, dword [esi]
mov edx, dword [eax]
push ecx
mov ecx, esi
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8

Function at 0x1016b400
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10195151
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esi - 0x7c]
mov dword [esi - 0x80], 0x101e5f4c
mov ecx, dword [eax + 4]
mov dword [ecx + esi - 0x7c], 0x101e5f84
lea edi, [esi - 0x34]
push edi
mov dword [esp + 0x1c], 2
call fcn.1002cfc0
mov dword [edi + 0x2c], vtable.ert_RefCounter.0
lea edi, [esi - 0x6c]
push edi
mov byte [esp + 0x1c], 1
call fcn.1002ce10
add esi, 0xffffff88
mov ecx, esi
mov dword [edi + 0x30], vtable.ert_RefCounter.0
mov byte [esp + 0x18], 0
call fcn.10063be0
mov ecx, esi
call fcn.10141130
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x1016c090
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test bl, 0x1f
mov eax, 0
setg al
mov ecx, ebx
sar ecx, 5
push ebp
push edi
xor ebp, ebp
add eax, ecx
mov edi, eax
test edi, edi
jle 0x1016c108
push esi
mov esi, dword [esp + 0x14]
sub esi, edx
mov ecx, dword [esi + edx]
xor ecx, dword [edx]
add edx, 4
mov eax, ecx
and ecx, 0x55555555
shr eax, 1
and eax, 0x55555555
add eax, ecx
mov ecx, eax
shr ecx, 2
and ecx, 0x33333333
and eax, 0x33333333
add ecx, eax
mov eax, ecx
shr eax, 4
add eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 8
add eax, ecx
mov ecx, eax
shr ecx, 0x10
add ecx, eax
and ecx, 0x3f
add ebp, ecx
sub edi, 1
jne 0x1016c0b8
pop esi
sub ebx, ebp
mov dword [esp + 0x10], ebx
fild dword [esp + 0x10]
pop edi
pop ebp
pop ebx
fidiv dword [esp + 8]
fstp dword [esp + 8]
fld dword [esp + 8]
ret
Function at 0x1016f440
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10198817
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov eax, dword [edi - 0x110]
mov dword [edi - 0x114], 0x101e6e3c
mov ecx, dword [eax + 4]
mov dword [ecx + edi - 0x110], 0x101e6eb0
lea esi, [edi - 0x40]
push esi
mov dword [esp + 0x1c], 3
call fcn.1002ce10
mov dword [esi + 0x30], vtable.ert_RefCounter.0
lea esi, [edi - 0x4c]
mov ecx, esi
mov byte [esp + 0x18], 2
call fcn.10064940
mov dword [esi], vtable.ert_RefCounter.0
lea esi, [edi - 0xac]
mov byte [esp + 0x18], 1
call fcn.10002000
mov dword [esi + 0x1c], vtable.ert_RefCounter.0
lea esi, [edi - 0xd0]
mov ecx, esi
mov byte [esp + 0x18], 0
call fcn.1006bc70
mov ecx, esi
mov dword [esi + 0x1c], vtable.ert_RefCounter.0
mov dword [esp + 0x18], 0xffffffff
call fcn.10036f50
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x10171620
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1019f629
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
mov dword [esp + 0xc], 0
mov dword [edi + 4], 0x101e7330
mov dword [edi + 0x564], 0x101aaeb8
mov dword [edi + 0x568], 1
mov eax, dword [edi + 4]
mov dword [edi], vtable.ebs_Object.1.0
mov ecx, dword [eax + 4]
mov dword [esp + 0xc], 1
mov dword [ecx + edi + 4], vtable.ebs_Object.0
mov dword [esp + 0x18], 1
mov edx, dword [edi + 4]
mov dword [edi], vtable.vgc_LogLossGaborFeature.0
mov eax, dword [edx + 4]
push 1
lea ecx, [edi + 0xc]
mov dword [eax + edi + 4], vtable.vgc_LogLossGaborFeature.1.0
call fcn.10052570
push 1
lea ecx, [edi + 0x30]
call fcn.10060510
push 1
lea ecx, [edi + 0x54]
call fcn.10013d80
push 1
lea ecx, [edi + 0x78]
push ecx
mov byte [esp + 0x20], 4
call fcn.1000a870
lea edx, [edi + 0x178]
push edx
mov byte [esp + 0x1c], 5
call fcn.10130490
push 1
lea esi, [edi + 0x318]
call fcn.10130b40
lea eax, [edi + 0x44c]
call fcn.10074380
lea esi, [edi + 0x484]
call fcn.1012f500
push 1
lea ecx, [edi + 0x540]
call fcn.10060510
mov byte [esp + 0x18], 0xa
call fcn.10171410
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x10172720
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101a1c90
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 8]
push ebx
call fcn.101781f0
lea eax, [esp + 0x1c]
call fcn.10067d70
mov dword [esp + 0x38], 0
cmp dword [ebx + 0xc], 2
je 0x101727c8
sub esp, 0x18
mov eax, esp
mov ecx, 0x10223cf0
mov dword [esp + 0x30], esp
call fcn.10062a10
lea eax, [esp + 0x3c]
call fcn.10089c40
mov edi, eax
mov byte [esp + 0x50], 2
mov ecx, ebx
lea esi, [esp + 0x34]
call fcn.10067f30
push eax
mov byte [esp + 0x54], 3
call fcn.10068050
mov esi, dword [esp + 0x14]
lea ecx, [esi + 8]
mov eax, ebx
mov byte [esp + 0x38], 0
call fcn.1005bb50
lea ecx, [esi + 0xc]
mov eax, ebx
call fcn.1005bb50
jmp 0x10172843
mov edi, str.enn_MlpLearnParam_version_
call fcn.1005b870
mov ecx, ebx
lea esi, [esp + 0x1c]
call fcn.10067f30
sub esp, 0x18
mov eax, esp
mov ecx, 0x10223cf0
mov dword [esp + 0x30], esp
call fcn.10062a10
lea eax, [esp + 0x3c]
call fcn.10089c40
mov ecx, esi
push ecx
mov edi, eax
mov byte [esp + 0x54], 4
call fcn.10068050
mov edi, str.learn_factor_
mov byte [esp + 0x38], 0
call fcn.1005b870
mov esi, dword [esp + 0x14]
lea ecx, [esi + 8]
mov eax, ebx
call fcn.1005bb50
mov edi, str.decay_factor_
call fcn.1005b870
lea ecx, [esi + 0xc]
mov eax, ebx
call fcn.1005bb50
mov edi, str.momentum_factor_
call fcn.1005b870
lea ecx, [esi + 0x10]
mov eax, ebx
call fcn.1005bb50
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x101775f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101a1fe0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.1001ba30
mov eax, dword [edi + 0x18]
test eax, eax
je 0x1017765b
mov ecx, dword [edi + 0xc]
cmp eax, ecx
je 0x1017765b
push ecx
push eax
push str.esm_OutStream_enn_MlpLayer::write__esm_OutStream_outA___const:_nodeArrE.size____i___outNodesE__i
lea eax, [esp + 0x28]
call fcn.100595b0
add esp, 0xc
push 0x102051a0
lea eax, [esp + 0x20]
push eax
call fcn.1017d044
cmp dword [esi + 0xc], 2
je 0x101776d4
lea eax, [esp + 0x1c]
call fcn.10177330
push eax
mov dword [esp + 0x3c], 0
call fcn.10067e80
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [edi + 8]
push ecx
mov ecx, esi
call fcn.1005c2e0
mov edx, dword [edi + 0xc]
push edx
mov ecx, esi
call fcn.1005c2e0
mov ebx, dword [edi + 0x18]
push ebx
mov ecx, esi
mov dword [esp + 0x1c], ebx
call fcn.1005c2e0
test ebx, ebx
jle 0x101777c2
mov eax, dword [esp + 0x18]
xor ebx, ebx
mov dword [esp + 0x18], eax
mov ecx, dword [edi + 0x14]
mov edx, dword [ecx + ebx]
mov eax, dword [edx + 0xc]
add ecx, ebx
push esi
call eax
add ebx, 0x64
sub dword [esp + 0x18], 1
jne 0x101776b7
jmp 0x101777c2
lea eax, [esp + 0x24]
call fcn.10177330
push eax
mov dword [esp + 0x3c], 1
call fcn.10067e80
mov edi, eax
mov ebx, str._innodes_
call fcn.1005c0c0
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
push eax
mov ecx, edi
call fcn.1005c2e0
mov ebx, str._outnodes_
call fcn.1005c0c0
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0xc]
push eax
mov ecx, edi
call fcn.1005c2e0
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.10067db0
cmp dword [ebx + 0x18], 0
mov edi, esi
jne 0x10177744
mov ebx, str._prenatal_n
call fcn.1005c0c0
jmp 0x101777c2
mov ebx, 0x101aad90
call fcn.1005c0c0
mov edx, dword [esp + 0x10]
xor eax, eax
cmp dword [edx + 0x18], eax
mov dword [esp + 0x14], eax
jle 0x101777c2
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x14]
add eax, dword [esp + 0x18]
mov ebx, str.node
mov edi, esi
mov dword [esp + 0x1c], eax
call fcn.1005c0c0
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, esi
call fcn.1005c2e0
mov ebx, 0x101ac934
call fcn.1005c0c0
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push esi
call eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
push 0xa
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add dword [esp + 0x18], 0x64
add eax, 1
cmp eax, dword [ecx + 0x18]
mov dword [esp + 0x14], eax
jl 0x10177761
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x101781f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101a01a0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10218460]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push ebx
call fcn.1005e6c0
lea eax, [esp + 0x14]
call fcn.10067d70
mov dword [esp + 0x30], 0
cmp dword [ebx + 0xc], 2
je 0x10178272
sub esp, 0x18
mov eax, esp
mov ecx, 0x10223c90
mov dword [esp + 0x28], esp
call fcn.10062a10
lea eax, [esp + 0x34]
call fcn.10089c40
mov edi, eax
mov byte [esp + 0x48], 2
mov ecx, ebx
lea esi, [esp + 0x2c]
call fcn.10067f30
push eax
mov byte [esp + 0x4c], 3
jmp 0x101782ad
mov edi, str.enn_LearnParam_version_
call fcn.1005b870
mov ecx, ebx
lea esi, [esp + 0x14]
call fcn.10067f30
sub esp, 0x18
mov eax, esp
mov ecx, 0x10223c90
mov dword [esp + 0x28], esp
call fcn.10062a10
lea eax, [esp + 0x34]
call fcn.10089c40
mov ecx, esi
mov byte [esp + 0x48], 4
push ecx
mov edi, eax
call fcn.10068050
mov eax, ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10178e24
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10218460]
jne 0x10178e2e
repz ret
jmp fcn.1017bbc6
Function at 0x1017bddb
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10218470]
je 0x1017bdf6
inc edi
cmp edi, 0x17
jb 0x1017bde7
cmp edi, 0x17
jae 0x1017bf76
push ebp
push 3
call fcn.101832e7
cmp eax, 1
pop ecx
je 0x1017bf42
push 3
call fcn.101832e7
test eax, eax
pop ecx
jne 0x1017be2a
cmp dword [0x1021eb60], 1
je 0x1017bf42
cmp ebx, 0xfc
je 0x1017bf75
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x1021eef8
push ebp
call fcn.10180360
add esp, 0xc
test eax, eax
je 0x1017be60
push esi
push esi
push esi
push esi
push esi
call fcn.1017e6f4
add esp, 0x14
push 0x104
mov esi, 0x1021ef11
push esi
push 0
mov byte [0x1021f015], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1017bea4
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.10180360
add esp, 0xc
test eax, eax
je 0x1017bea4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1017e6f4
add esp, 0x14
push esi
call fcn.10180240
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1017bee9
push esi
call fcn.10180240
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1021f20c
push 0x101a98dc
sub ecx, eax
push ecx
push eax
call fcn.10183234
add esp, 0x14
test eax, eax
je 0x1017bee9
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1017e6f4
add esp, 0x14
jmp 0x1017beeb
xor esi, esi
push 0x101a98d8
push ebx
push ebp
call fcn.101831c3
add esp, 0xc
test eax, eax
je 0x1017bf0b
push esi
push esi
push esi
push esi
push esi
call fcn.1017e6f4
add esp, 0x14
push dword [edi*8 + 0x10218474]
push ebx
push ebp
call fcn.101831c3
add esp, 0xc
test eax, eax
je 0x1017bf2d
push esi
push esi
push esi
push esi
push esi
call fcn.1017e6f4
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10183006
add esp, 0xc
jmp 0x1017bf75
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1017bf75
cmp ebp, 0xffffffff
je 0x1017bf75
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10218474]
push dword [esi]
call fcn.10180240
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret