joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6db7bc60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6db7be1e
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.6db237c7
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x6db7bc9a
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x6db7bcc3
lea eax, [0x6dc53580]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call fcn.6db0b110
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x24], ecx
lea edi, [esp + 0x38]
mov ebx, eax
xor eax, eax
call fcn.6db237c7
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x54], ecx
movzx ecx, word [esp + 0x6c]
movzx edx, word [esp + 0x70]
shl edx, 0xb
movzx ebx, word [esp + 0x78]
or ebx, edx
movzx edx, byte [esp + 0x75]
test dl, dl
je 0x6db7bd0b
or ebx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x6db7bd1a
or ebx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x6db7bd29
or ebx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x6db7bd38
or ebx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x6db7bd47
or ebx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x6db7bd53
or ebx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x6db7bd5f
or ebx, 0x10
mov word [esp + 0x46], cx
mov word [esp + 0x48], bx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x3c]
lea ecx, [eax + 0xc]
mov edx, dword [esp + 0x40]
mov ebx, dword [esp + 0x38]
cmp edx, ecx
jae 0x6db7bdca
mov dword [esp + 0x24], eax
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0xc
lea eax, [0x6dc53580]
mov dword [esp + 0x10], eax
call fcn.6db0b1d0
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
add eax, ebx
mov dword [esp], eax
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xc
call fcn.6db23ec0
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x38]
call fcn.6db23c86
add esp, 0x5c
ret
call fcn.6db22180
jmp fcn.6db7bc60
Function at 0x6db943a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6db94513
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x6db94439
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x6db943d8
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x6db94445
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x6db94403
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x6db94445
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x6db94445
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.6db94180
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.6db9b690
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call fcn.6db22180
jmp fcn.6db943a0
Function at 0x6dbccfb0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6dbcd058
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x6dbcd00b
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x6dbcd042
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.6db22180
jmp fcn.6dbccfb0
Function at 0x6dbd0890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6dbd0a75
add esp, 0xffffff80
lea edi, [esp + 0x30]
mov esi, dword [esp + 0x84]
call fcn.6db23c7c
lea eax, [esp + 0x30]
mov dword [esp], eax
call fcn.6dbd0320
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea edi, [esp + 0x58]
xor eax, eax
call fcn.6db237c6
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ecx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x88]
xor ecx, ecx
jmp 0x6dbd0942
mov edx, dword [esp + 0xc]
lea ecx, [edx + 1]
cmp ecx, 5
jge 0x6dbd0a10
mov dword [esp + 0xc], ecx
imul edx, ecx, 0x33
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1d
add edx, ebx
mov dword [esp + 0x1c], edx
and edx, 0xfffffff8
sub ebx, edx
cmp ebx, 0x20
sbb edx, edx
lea esi, [ebx - 0x20]
mov dword [esp + 0x18], esi
cmp esi, 0x20
sbb edi, edi
mov dword [esp + 0x14], edi
xchg esi, ebx
neg ebx
xchg esi, ebx
cmp esi, 0x20
sbb ebp, ebp
mov dword [esp + 0x10], ebp
lea edi, [esp + ecx*8 + 0x58]
mov ebp, dword [edi]
mov dword [esp + 8], ebp
mov edi, dword [edi + 4]
mov ecx, ebx
shl ebp, cl
and ebp, edx
xchg ebp, eax
mov byte [esp + 0x20], al
xchg ebp, eax
shl edi, cl
and edi, edx
mov ecx, esi
mov edx, dword [esp + 8]
mov ebx, edx
shr edx, cl
mov esi, dword [esp + 0x10]
and edx, esi
or edx, edi
mov ecx, dword [esp + 0x18]
shl ebx, cl
mov esi, dword [esp + 0x14]
and ebx, esi
or ebx, edx
mov edx, ebp
shr ebp, 8
mov esi, ebx
shl ebx, 0x18
or ebp, ebx
xchg ebp, eax
mov byte [esp + 0x21], al
xchg ebp, eax
mov ebx, edx
shr edx, 0x10
mov ebp, esi
shl esi, 0x10
or esi, edx
xchg esi, eax
mov byte [esp + 0x22], al
xchg esi, eax
mov edx, ebp
shl ebp, 8
shr ebx, 0x18
or ebx, ebp
mov byte [esp + 0x23], bl
mov dword [esp + 0x24], edx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x6dbd0a43
test byte [eax], al
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], 0x20
mov dword [esp + 0x94], 0x20
sub esp, 0xffffff80
ret
movzx esi, byte [eax + edx]
or esi, ebx
xchg esi, ebx
mov byte [eax + edx], bl
xchg esi, ebx
inc ecx
mov edx, ebp
cmp ecx, 8
jge 0x6dbd093b
movzx ebx, byte [esp + ecx + 0x28]
mov ebp, edx
sar edx, 3
add edx, ecx
cmp edx, 0x20
jge 0x6dbd093b
test byte [eax], al
cmp edx, 0x20
jb 0x6dbd0a33
mov eax, edx
mov ecx, 0x20
call fcn.6db23630
nop
call fcn.6db22180
jmp fcn.6dbd0890
Function at 0x6dbd2920
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6dbd2b36
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x6dbd29b9
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x6dbd2b17
cmp ecx, 0xe
jne 0x6dbd2a32
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x6dbd2b17
cmp ecx, 0xf
jne 0x6dbd2aa8
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x6dbd2b17
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.6db22180
jmp fcn.6dbd2920
Function at 0x6dbd7e70
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 8]
cmp eax, dword [ecx + 8]
jbe 0x6dbd7f63
sub esp, 0x88
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0
lea edi, [esp + 0x2c]
xor eax, eax
call fcn.6db237b9
nop
mov dword [esp + 0x2c], 0x67452301
mov dword [esp + 0x30], 0xefcdab89
mov dword [esp + 0x34], 0x98badcfe
mov dword [esp + 0x38], 0x10325476
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
lea ecx, [esp + 0x2c]
mov dword [esp], ecx
mov edx, dword [esp + 0x8c]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x90]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x94]
mov dword [esp + 0xc], edx
call fcn.6dbd7990
lea ecx, [esp + 0x2c]
mov dword [esp], ecx
call fcn.6dbd7c70
lea edi, [esp + 0x1c]
lea esi, [esp + 4]
call fcn.6db23cb8
lea edi, [esp + 0x98]
lea esi, [esp + 0x1c]
call fcn.6db23cb8
add esp, 0x88
ret
call fcn.6db22180
jmp fcn.6dbd7e70
Function at 0x6dbef790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6dbef8fa
sub esp, 0x68
mov eax, dword [esp + 0x6c]
mov ecx, dword [eax + 0x78]
mov dword [esp], 0
mov dword [esp + 4], ecx
call fcn.6dac6a50
movzx eax, byte [esp + 8]
test al, al
jne 0x6dbef8f6
mov eax, dword [esp + 0x6c]
lea ecx, [eax + 0xe4]
mov dword [esp + 0x3c], ecx
mov dword [esp], ecx
call fcn.6db29180
mov eax, dword [esp + 0x6c]
mov ecx, dword [eax + 0xc]
mov dword [esp], ecx
mov byte [esp + 4], 0
call fcn.6dbeafc0
mov eax, dword [esp + 0x6c]
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 8]
mov ebx, dword [ecx + 0x8c]
add ebx, dword [ecx + 0x74]
cmp dword [ecx + 0x30], ebx
jle 0x6dbef838
cmp dword [ecx + 0x38], ebx
jle 0x6dbef838
mov dword [esp + 0x30], edx
nop
mov ecx, dword [eax + 0x8c]
mov dword [esp], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 4], ecx
call fcn.6dac6a00
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x30]
mov ecx, eax
mov eax, edx
mov ebx, 0xf4240
mul ebx
mov dword [esp + 0x38], edx
mov dword [esp + 0x34], eax
mov dword [esp], ecx
call fcn.6dbede50
mov ecx, dword [esp + 0x3c]
mov dword [esp], ecx
call fcn.6db29500
call fcn.6db5a560
lea edi, [esp + 0x54]
lea esi, [esp]
call fcn.6db23cae
lea edi, [esp]
lea esi, [esp + 0x54]
call fcn.6db23cae
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], ecx
call fcn.6db59b20
lea edi, [esp + 0x40]
lea esi, [esp + 0x1c]
call fcn.6db23cae
lea ecx, [0x6dc56c00]
mov dword [esp], ecx
call fcn.6dacc6f0
mov ecx, dword [esp + 4]
lea edx, [0x6dbf2f40]
mov dword [ecx], edx
mov edx, dword [0x6ddaa8e0]
test edx, edx
jne 0x6dbef8cb
mov eax, dword [esp + 0x6c]
mov dword [ecx + 4], eax
jmp 0x6dbef8d7
lea edi, [ecx + 4]
mov eax, dword [esp + 0x6c]
call fcn.6db235b0
mov eax, dword [0x6dd84098]
mov dword [esp], eax
mov dword [esp + 4], ecx
lea edi, [esp + 8]
lea esi, [esp + 0x40]
call fcn.6db23cae
call fcn.6dbf2650
add esp, 0x68
ret
call fcn.6db22180
jmp fcn.6dbef790
Function at 0x6dbf5620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 8]
cmp eax, dword [ecx + 8]
jbe 0x6dbf589a
sub esp, 0x88
mov eax, 0
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov byte [esp + 0x2f], 0
mov eax, dword [esp + 0x8c]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.6db584e0
mov eax, dword [esp + 0x8c]
mov ecx, dword [eax + 8]
mov edx, dword [esp + 8]
mov dword [esp + 0x40], edx
mov ebx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 4], ecx
mov dword [esp], ebx
call fcn.6db584e0
mov eax, dword [esp + 8]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
lea ecx, [0x6dbf58f0]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x50], ecx
lea edx, [esp + 0x4c]
mov dword [esp + 0x84], edx
mov byte [esp + 0x2f], 1
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
lea edx, [0x6dbf58b0]
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], eax
lea edx, [esp + 0x44]
mov dword [esp + 0x80], edx
mov byte [esp + 0x2f], 3
jmp 0x6dbf570a
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov edx, dword [ecx]
mov ebx, dword [eax]
mov ebp, dword [esp + 0x8c]
mov esi, dword [ebp + 0x2c]
lea edi, [esp + 0x68]
xor eax, eax
call fcn.6db237ca
mov dword [esp + 0x78], edx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x68], esi
lea ecx, [esp + 0x68]
mov dword [esp], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov byte [esp + 0x14], 1
call fcn.6db07e70
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x6dbf5867
cmp ecx, 1
jne 0x6dbf57c3
mov eax, dword [esp + 0x8c]
lea ecx, [eax + 0x88]
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 8], 0
call fcn.6db27b40
movzx eax, byte [esp + 0xc]
test al, al
jne 0x6dbf5702
mov eax, dword [esp + 0x8c]
lea ecx, [eax + 0x18]
mov dword [esp], ecx
call fcn.6db27ba0
mov eax, dword [esp + 4]
test eax, eax
jle 0x6dbf5702
jmp 0x6dbf5831
mov ecx, dword [esp + 0x8c]
mov edx, dword [ecx + 8]
mov edx, dword [edx]
lea edi, [esp + 0x54]
xor eax, eax
call fcn.6db237cb
mov byte [esp + 0x54], dl
mov byte [esp + 0x55], 3
mov ecx, dword [esp + 0x40]
mov edx, dword [ecx]
mov ebx, dword [esp + 0x8c]
mov dword [esp], ebx
lea edi, [esp + 4]
lea esi, [esp + 0x54]
call fcn.6db23cae
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], 0
call fcn.6dbf5f70
nop
mov ecx, dword [esp + 0x8c]
mov edx, dword [ecx + 0x1c]
mov dword [esp], edx
lea edx, [esp + 0x2f]
mov dword [esp + 4], edx
call fcn.6dac6a00
jmp 0x6dbf5702
mov eax, dword [esp + 0x8c]
mov dword [esp], eax
call fcn.6dbf4740
mov byte [esp + 0x2f], 1
mov edx, dword [esp + 0x80]
mov eax, dword [edx]
call eax
mov byte [esp + 0x2f], 0
mov edx, dword [esp + 0x84]
mov eax, dword [edx]
call eax
add esp, 0x88
ret
mov byte [esp + 0x2f], 1
mov edx, dword [esp + 0x80]
mov eax, dword [edx]
call eax
mov byte [esp + 0x2f], 0
mov edx, dword [esp + 0x84]
mov eax, dword [edx]
call eax
add esp, 0x88
ret
call fcn.6db22180
jmp fcn.6dbf5620
Function at 0x6dbf7340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x10]
cmp eax, dword [ecx + 8]
jbe 0x6dbf7594
sub esp, 0x90
mov eax, 0
mov dword [esp + 0x8c], eax
mov byte [esp + 0x2f], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov eax, dword [esp + 0x94]
test byte [eax], al
lea ecx, [eax + 0x50]
mov dword [esp], ecx
call fcn.6db27990
mov eax, dword [esp + 4]
mov esi, dword [esp + 8]
lea ecx, [0x6dc73f80]
cmp eax, ecx
jne 0x6dbf73b8
lea edi, [esp + 0x78]
call fcn.6db23cae
jmp 0x6dbf73c7
lea edi, [esp + 0x78]
mov edx, eax
xor eax, eax
call fcn.6db237cb
mov eax, edx
lea edi, [esp + 0x64]
lea esi, [esp + 0x78]
call fcn.6db23cae
lea ecx, [0x6dc73f80]
cmp eax, ecx
jne 0x6dbf74af
lea edi, [esp + 0x3c]
lea esi, [esp + 0x78]
call fcn.6db23cae
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
test edx, 0x80000000
je 0x6dbf7423
shl edx, 1
mov ebx, ecx
shr ecx, 0x1f
or ecx, edx
mov edx, ebx
shl ebx, 1
mov ebp, ecx
shl ecx, 1
shr ebx, 0x1f
or ecx, ebx
shr ebp, 0x1f
add ecx, 0xd7b17f80
adc ebp, 0xd
jmp 0x6dbf7431
mov edx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
mov eax, edx
mov edx, ecx
mov ecx, eax
test ebp, ebp
sete bl
test ecx, ecx
sete cl
and ebx, ecx
test bl, bl
je 0x6dbf744f
test edx, 0x3fffffff
jne 0x6dbf744f
xor eax, eax
xor ecx, ecx
jmp 0x6dbf74b3
lea edi, [esp]
lea esi, [esp + 0x64]
call fcn.6db23cae
call fcn.6db5a090
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.6db581e0
mov eax, dword [esp + 8]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
lea ecx, [0x6dbf75a0]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x8c], ecx
mov byte [esp + 0x2f], 1
mov eax, dword [eax]
mov ecx, 1
jmp 0x6dbf74b3
xor eax, eax
xor ecx, ecx
mov byte [esp + 0x2e], cl
mov dword [esp + 0x30], eax
mov edx, dword [esp + 0x94]
mov ebx, dword [edx + 4]
mov ebx, dword [ebx + 8]
mov ebx, dword [ebx]
mov ebp, dword [edx]
lea edi, [esp + 0x50]
xor eax, eax
call fcn.6db237cb
mov byte [esp + 0x50], bl
mov byte [esp + 0x51], 4
mov dword [esp + 0x54], ebp
lea ecx, [0x6dc5cd60]
mov dword [esp], ecx
call fcn.6dacc6f0
mov ecx, dword [esp + 4]
nop
mov edx, dword [esp + 0x98]
mov dword [ecx], edx
mov edx, dword [esp + 0x94]
mov ebx, dword [edx + 4]
mov ebx, dword [ebx + 8]
mov ebx, dword [ebx + 0x20]
mov dword [ecx + 4], ebx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], 8
mov dword [esp + 0x60], 8
mov ecx, dword [edx + 4]
mov dword [esp], ecx
lea edi, [esp + 4]
lea esi, [esp + 0x50]
call fcn.6db23cae
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0
call fcn.6dbf5f70
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa0], edx
movzx ecx, byte [esp + 0x2e]
test cl, 1
je 0x6dbf7581
and ecx, 0xfffffffe
mov byte [esp + 0x2f], cl
mov edx, dword [esp + 0x8c]
mov eax, dword [edx]
call eax
add esp, 0x90
ret
call fcn.6db22180
jmp fcn.6dbf7340
Function at 0x6dc11590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x6dc116dd
sub esp, 0x60
lea eax, [esp + 0x3c]
mov dword [esp], eax
lea eax, [0x6dc766b3]
mov dword [esp + 4], eax
mov dword [esp + 8], 4
mov eax, dword [esp + 0x64]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x10], eax
lea eax, [0x6dc77ca9]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0xb
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x20], eax
lea eax, [0x6dc76317]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 1
call fcn.6db0ed50
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
xor edx, edx
jmp 0x6dc11665
mov dword [esp + 0x38], edx
mov ebx, dword [esp + 0x74]
lea ebp, [ebx + edx*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
lea eax, [0x6dc76317]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 1
call fcn.6db0ec00
mov eax, dword [esp + 0x38]
lea edx, [eax + 1]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x78]
cmp ebx, edx
jg 0x6dc11617
mov dword [esp + 0x34], ecx
mov dword [esp + 0x5c], eax
mov dword [esp], 0
lea edx, [0x6dc7d348]
mov dword [esp + 4], edx
mov dword [esp + 8], 0x19
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
call fcn.6db0eb60
mov eax, dword [0x6dd847a4]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.6dc026c0
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
call fcn.6dc11070
mov eax, dword [esp + 8]
mov dword [esp], eax
call fcn.6dc111d0
add esp, 0x60
ret
call fcn.6db22180
jmp fcn.6dc11590

Function at 0x6dc12690
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
sub esp, 0x10
mov dword [0x6ddae538], eax
test eax, eax
je 0x6dc126d8
mov dword [esp], 0x6ddae53c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
sub esp, 4
add esp, 0x1c
ret
mov dword [esp], 2
call dword [0x6dc3e99c]
mov dword [esp + 8], 0x3d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.runtime:_failed_to_create_runtime_initialization_wait_event._n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
lea esi, [esi]