joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008b6e0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
cmp byte [0x100d01ef], 1
jne 0x1008b6ff
cmp byte [0x100d01ee], 0
jne 0x1008b71e
jmp 0x1008b74b
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100d01ef], 1
test eax, eax
setne byte [0x100d01ee]
je 0x1008b74b
mov edi, dword [fcn.1008b180]
push 2
call edi
add esp, 4
push ebx
push esi
push str.libunwind:___unw_get_proc_info_cursor_p__info_p__n
push eax
call fcn.10083670
add esp, 0x10
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x24]
mov ecx, edi
call dword [0x100c3964]
mov ecx, esi
push ebx
call edi
xor ecx, ecx
cmp dword [ebx + 4], 0
mov eax, 0xffffe66b
cmovne eax, ecx
pop esi
pop edi
pop ebx
ret

Function at 0x1008b770
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp byte [0x100d01ef], 1
jne 0x1008b78a
cmp byte [0x100d01ee], 0
jne 0x1008b7a9
jmp 0x1008b7d5
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100d01ef], 1
test eax, eax
setne byte [0x100d01ee]
je 0x1008b7d5
mov edi, dword [fcn.1008b180]
push 2
call edi
add esp, 4
push esi
push str.libunwind:___unw_resume_cursor_p__n
push eax
call fcn.10083670
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x28]
mov ecx, edi
call dword [0x100c3964]
mov ecx, esi
call edi
mov eax, 0xffffe674
pop esi
pop edi
ret

Function at 0x1008b7f0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp byte [0x100d01ef], 1
jne 0x1008b814
cmp byte [0x100d01ee], 0
jne 0x1008b833
jmp 0x1008b861
push str.LIBUNWIND_PRINT_APIS
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100d01ef], 1
test eax, eax
setne byte [0x100d01ee]
je 0x1008b861
mov edi, dword [fcn.1008b180]
push 2
call edi
add esp, 4
push ebp
push ebx
push esi
push str.libunwind:___unw_get_proc_name_cursor_p__buf_p__bufLen_lu__n
push eax
call fcn.10083670
add esp, 0x14
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
mov eax, dword [esi]
mov edi, dword [eax + 0x30]
mov ecx, edi
call dword [0x100c3964]
mov ecx, esi
push dword [esp + 0x20]
push ebp
push ebx
call edi
xor ecx, ecx
test al, al
mov eax, 0xffffe674
cmovne eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1008c280
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x100d01ed], 1
jne 0x1008c294
cmp byte [0x100d01ec], 0
setne al
ret
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
test eax, eax
setne al
setne byte [0x100d01ec]
mov byte [0x100d01ed], 1
ret
Function at 0x1008f510
Capabilities:
Enumerate process modules
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1014
call fcn.1008aa54
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push 0x1000
push edx
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1008f64e
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, 0
cmp ecx, 4
jb 0x1008f6bb
shr ecx, 2
mov dword [esp + 8], ecx
jmp 0x1008f573
mov edx, dword [esp + 0xc]
inc edx
xor eax, eax
mov ecx, dword [esp + 8]
cmp edx, ecx
je 0x1008f6bb
mov dword [esp + 0xc], edx
mov esi, dword [esp + edx*4 + 0x14]
mov eax, dword [esi + 0x3c]
movzx ecx, word [esi + eax + 0x14]
mov edx, dword [esp + 0x102c]
mov dword [edx], esi
mov dword [esp + 4], esi
movzx ebx, word [esi + eax + 6]
test ebx, ebx
je 0x1008f560
add eax, dword [esp + 4]
lea ebp, [eax + ecx]
add ebp, 0x18
mov dword [esp], 0
xor ecx, ecx
jmp 0x1008f5ee
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esp + 0x1028]
cmp eax, ecx
mov eax, esi
movzx esi, al
mov eax, esi
mov edx, 1
cmova eax, edx
cmp edi, ecx
mov ecx, eax
cmova ecx, esi
test cl, 1
je 0x1008f5e4
mov eax, dword [esp]
and al, 1
jne 0x1008f66a
add ebp, 0x28
dec ebx
je 0x1008f560
mov esi, ecx
mov edi, dword [ebp + 0xc]
add edi, dword [esp + 4]
push 8
push str..text
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x1008f5b0
push 8
push str..eh_frame
push ebp
call sub.msvcrt.dll_strncmp
add esp, 0xc
test eax, eax
je 0x1008f630
mov ecx, esi
test cl, 1
jne 0x1008f5d9
jmp 0x1008f5e4
mov ecx, dword [esp + 0x102c]
mov dword [ecx + 4], edi
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
mov al, 1
mov dword [esp], eax
mov ecx, esi
test cl, 1
jne 0x1008f5d9
jmp 0x1008f5e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp byte [0x100d01ed], 1
jne 0x1008f66e
cmp byte [0x100d01ec], 0
jne 0x1008f68d
jmp 0x1008f6b9
mov al, 1
jmp 0x1008f6bb
push str.LIBUNWIND_PRINT_UNWINDING
call sub.msvcrt.dll_getenv
add esp, 4
mov byte [0x100d01ed], 1
test eax, eax
setne byte [0x100d01ec]
je 0x1008f6b9
mov edi, dword [fcn.1008b180]
push 2
call edi
add esp, 4
push esi
push str.libunwind:_findUnwindSections:_EnumProcessModules_failed__returned_error__d_n
push eax
call fcn.10083670
add esp, 0xc
push 2
call edi
add esp, 4
push eax
call sub.msvcrt.dll_fflush
add esp, 4
xor eax, eax
add esp, 0x1014
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x41daf4
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0041dca4
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], pe_nt_image_headers32
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x41dbf2
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x41db95
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x41dbd8
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x41dbac
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x41dbc7
test al, 0x40
je 0x41dbbe
mov ecx, dword [edi + 0x20]
jmp 0x41dbc5
test al, 0x80
je 0x41dbd8
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x41dbd8
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x41db64
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x420ff8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x421016
mov eax, 0x51e643
push eax
push 1
mov ebx, 0x472c30
call fcn.004725d4
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x421040
mov eax, 0
jmp 0x4210b4
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x4210a1
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x42108a
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x421079
xor ecx, eax
xor edx, ebx
dec edi
jne 0x42106a
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x42929c
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x4294e9
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x4293e6
cmp byte [edx + edi], 0xd
jne 0x4293e6
cmp byte [edx + edi + 1], 0xa
je 0x42941f
mov al, byte [edx + edi]
cmp al, 0xa
je 0x42941f
cmp al, 0x3d
jne 0x4293fb
inc ecx
cmp ecx, 2
ja 0x4294f7
cmp al, 0x7f
ja 0x4294f7
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x4294f7
cmp al, 0x40
jae 0x42941e
test ecx, ecx
jne 0x4294f7
inc esi
inc edx
cmp edx, ebx
jb 0x4293d0
test esi, esi
je 0x4294e9
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x429508
cmp dword [ecx], eax
jb 0x429508
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x4294d8
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x4294d4
cmp al, 0xa
je 0x4294d4
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x4294d4
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x4294bf
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x4294cc
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x4294d4
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x429470
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x42de84
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x42e0d1
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x42dfce
cmp byte [edx + edi], 0xd
jne 0x42dfce
cmp byte [edx + edi + 1], 0xa
je 0x42e007
mov al, byte [edx + edi]
cmp al, 0xa
je 0x42e007
cmp al, 0x3d
jne 0x42dfe3
inc ecx
cmp ecx, 2
ja 0x42e0df
cmp al, 0x7f
ja 0x42e0df
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x42e0df
cmp al, 0x40
jae 0x42e006
test ecx, ecx
jne 0x42e0df
inc esi
inc edx
cmp edx, ebx
jb 0x42dfb8
test esi, esi
je 0x42e0d1
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x42e0f0
cmp dword [ecx], eax
jb 0x42e0f0
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x42e0c0
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x42e0bc
cmp al, 0xa
je 0x42e0bc
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x42e0bc
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x42e0a7
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x42e0b4
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x42e0bc
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x42e058
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x442773
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x4427ba
cmp ebx, 0x20
je 0x4427ba
cmp ebx, 0xffffffe0
je 0x4427ba
jne 0x4427c3
add eax, 1
cmp esi, eax
je 0x4427d0
jne 0x44279f
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x4427d4
jne 0x44279b
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x4427e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x44282d
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x442833
add eax, 4
pop esi
dec esi
push esi
jne 0x442815
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8
Function at 0x4446ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x44470f
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x44470f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x444719
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x44475b
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4447bd
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x4447b8
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4447a3
test dl, dl
je 0x44479f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4447a3
add ecx, 2
add eax, 2
test dl, dl
jne 0x444783
xor eax, eax
jmp 0x4447a8
sbb eax, eax
or eax, 1
test eax, eax
je 0x4447c9
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x444770
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x44484e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x444871
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x444871
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x44487b
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x4448bd
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x44491f
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x44491a
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x444905
test dl, dl
je 0x444901
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x444905
add ecx, 2
add eax, 2
test dl, dl
jne 0x4448e5
xor eax, eax
jmp 0x44490a
sbb eax, eax
or eax, 1
test eax, eax
je 0x44492b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x4448d2
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x4449bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4449e0
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4449e0
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4449ea
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x444a2c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x444a8e
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x444a89
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x444a74
test dl, dl
je 0x444a70
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x444a74
add ecx, 2
add eax, 2
test dl, dl
jne 0x444a54
xor eax, eax
jmp 0x444a79
sbb eax, eax
or eax, 1
test eax, eax
je 0x444a9a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x444a41
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x444b27
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x444b4a
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x444b4a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x444b54
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x444b96
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x444bf8
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x444bf3
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x444bde
test dl, dl
je 0x444bda
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x444bde
add ecx, 2
add eax, 2
test dl, dl
jne 0x444bbe
xor eax, eax
jmp 0x444be3
sbb eax, eax
or eax, 1
test eax, eax
je 0x444c04
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x444bab
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x444c9d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x444cc0
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x444cc0
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x444cca
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x444d0c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x444d6e
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x444d69
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x444d54
test dl, dl
je 0x444d50
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x444d54
add ecx, 2
add eax, 2
test dl, dl
jne 0x444d34
xor eax, eax
jmp 0x444d59
sbb eax, eax
or eax, 1
test eax, eax
je 0x444d7a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x444d21
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8