joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009cd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x10045010]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [0x1006dc88]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push dword [0x1006dcb8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
movd xmm1, eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x30]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x30]
mov ecx, edi
sub ecx, dword [0x1006dcc0]
mov esi, dword [esp + 0x34]
mov edx, esi
sbb edx, dword [0x1006dcc4]
call fcn.10035e10
mov edx, dword [0x1006dccc]
mov ecx, dword [0x1006dcc8]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x28], xmm0
call fcn.10035e10
movss xmm1, dword [esp + 0x28]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x1006dcc4], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x1006dcc0], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xf1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xf2], al
call esi
mov ecx, dword [0x1006dc88]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xf4], 0
mov byte [ebx + 0xf3], al
cmp byte [ecx + 0x36f], 0
lea esi, [ecx + 0xd8]
je 0x10009e0a
cvttss2si eax, dword [esi]
mov dword [esp + 0x28], eax
cvttss2si eax, dword [ecx + 0xdc]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
push dword [0x1006dcb8]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [0x1006dcb8]
jne 0x10009e64
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10009e64
lea eax, [esp + 0x10]
push eax
push dword [0x1006dcb8]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x10009e64
movd xmm0, dword [esp + 0x10]
movd xmm1, dword [esp + 0x14]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [ebx + 0xf0], 0
je 0x10009e72
or eax, 0xffffffff
jmp 0x10009e7d
mov eax, dword [0x1006dc88]
mov eax, dword [eax + 0x1bd4]
cmp dword [0x1004634c], eax
je 0x10009e8f
mov dword [0x1004634c], eax
call fcn.10009bb0
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10034b20
mov esp, ebp
pop ebp
ret
Function at 0x1000b6f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1006dd0c], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x1000b7aa
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x1006dd08], eax
inc ebx
cmp ebx, 0x100
jb 0x1000b710
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x1000b7d6
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1006dd08]
sub edi, 1
jne 0x1000b7b5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1000b808
nop dword [eax]
cmp cl, 0x23
jne 0x1000b7ef
cmp byte [esi], cl
jne 0x1000b7ef
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1006dd08]
test cl, cl
jne 0x1000b7e0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x1000bcf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000bd02
mov dword [edi], 0
mov edx, 0x10041d24
call fcn.1000bbc0
mov esi, eax
test esi, esi
jne 0x1000bd16
pop edi
pop esi
pop ebp
ret
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1000bdb0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1000bdb0
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1000bdb0
inc dword [0x1006dcbc]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x1000bdb0
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x1000bd99
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp + 8]
dec dword [0x1006dcbc]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x1000bda8
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10011670
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x1006dc88]
mov eax, ecx
mov dword [ebp - 0xc], eax
mov dword [esi + 0x2b64], 0
test eax, eax
je 0x10011788
push ebx
lea ebx, [esi + 0x2b68]
mov dword [esi + 0x2b64], 0
mov ecx, dword [ebx + 4]
push edi
test ecx, ecx
jns 0x10011707
mov eax, ecx
xor edi, edi
cdq
sub eax, edx
sar eax, 1
add eax, ecx
test eax, eax
cmovg edi, eax
cmp edi, ecx
jle 0x10011707
inc dword [0x1006dcbc]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [ebx + 8]
add esp, 4
mov dword [ebp - 8], eax
test ecx, ecx
je 0x10011701
push dword [ebx]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 8]
add esp, 0xc
test eax, eax
je 0x100116f4
dec dword [0x1006dcbc]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 8]
add esp, 4
mov dword [ebx + 8], eax
mov dword [ebx + 4], edi
lea eax, [ebp - 1]
mov dword [ebx], 0
push eax
mov ecx, ebx
mov byte [ebp - 1], 0
call fcn.10025060
cmp dword [esi + 0x2b74], 0
mov dword [ebp - 8], 0
jle 0x10011755
xor edi, edi
nop
mov eax, dword [esi + 0x2b7c]
add eax, edi
push ebx
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 8]
add esp, 0xc
inc eax
add edi, 0x18
mov dword [ebp - 8], eax
cmp eax, dword [esi + 0x2b74]
jl 0x10011730
mov edi, dword [ebx]
mov edx, 0x10041d28
mov ecx, dword [ebp - 0xc]
dec edi
mov ebx, dword [esi + 0x2b70]
call fcn.1000bbc0
mov esi, eax
test esi, esi
je 0x10011786
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10030cf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100364f6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10045010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 2
mov eax, 0x3f
mov dword [esi + 4], 0x3f800000
mov word [esi + 0x3c], ax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.10030e20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10032280
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10032430
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1003234d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x100322ca
mov eax, dword [ebp - 4]
cmp eax, dword [0x10045004]
ja 0x100322ca
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003229a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100322f0
jmp 0x1003234d
cmp dword [ebp - 0x14], 0x10000
jne 0x10032333
cmp dword [ebp - 0x18], 0x10000
jb 0x10032333
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10032326
mov eax, dword [ebp - 8]
jmp 0x1003234f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10032348
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10032430
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003229a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10032360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10032460
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10032425
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x100323a5
mov eax, dword [ebp - 4]
cmp eax, dword [0x10045004]
ja 0x100323a5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10032375
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100323cb
jmp 0x10032425
cmp dword [ebp - 0x14], 0x10000
jne 0x1003240e
cmp dword [ebp - 0x18], 0x10000
jb 0x1003240e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10032401
mov eax, dword [ebp - 8]
jmp 0x10032427
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10032420
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10032460
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10032375
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10004764
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea edi, [eax + eax]
mov dword [esp + 0x450], ecx
mov ecx, dword [esp + 0x10]
cmp edx, edi
jg 0x10004780
neg edx
cmp edx, eax
jle 0x10004822
mov edi, eax
shr edi, 1
je 0x1000629f
xor ecx, ecx
lea edx, [ebx + eax]
mov dword [esp + 0x43c], esi
mov edx, 1
jmp 0x100047f5

Function at 0x10004796
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x454], edi
mov dword [esp + 0x42c], eax
mov dword [esp + 0x430], ebx
mov esi, ecx
mov ebx, dword [esp + 0x450]
lea eax, [ecx*4]
neg eax
inc ecx
movsx edi, byte [esi + edx]
mov word [ebx + eax], di
movsx edi, byte [esi + edx - 1]
add esi, 0xfffffffe
mov word [ebx + eax - 2], di
cmp ecx, dword [esp + 0x454]
jb 0x100047ad
mov eax, dword [esp + 0x42c]
lea edx, [ecx + ecx + 1]
mov ebx, dword [esp + 0x430]
Function at 0x100047ee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 0xfffffff8
inc esi
mov ecx, dword [esp + 0x450]
lea eax, [esp + 0x22c]
mov ebx, dword [eax + 0x830]
mov edx, 0x208
add ebx, dword [ecx + esi*4 - 4]
call fcn.100041b0
mov eax, ebx
push eax
call fcn.10003e88
mov ecx, eax
test eax, eax
je 0x100048de
cmp eax, 6
jbe 0x10004822
mov dword [esp + 0x10], ecx
lea edx, [eax + ebx]
neg edx
lea ecx, [esp + eax*2 + 0x224]
add edx, ecx
mov esi, dword [esp + 0x43c]
lea ecx, [edx - 1]
cmp ecx, eax
jae 0x10004815
lea ecx, [ebx + eax]
sub ecx, edx
add edx, edx
neg edx
movsx edi, byte [ecx + 1]
mov ecx, dword [esp + 0x450]
mov word [edx + ecx + 2], di
lea edx, [eax + 1]
sub eax, edx
lea ecx, [eax + 1]
jmp 0x100048de
mov edx, eax
shr edx, 1
mov dword [esp + 0x458], edx
je 0x1000652d
test dl, bh
sbb al, 0
invalid
xor edx, edx
lea ecx, [esp + eax*2 + 0x224]
mov dword [esp + 0x434], ecx
lea edi, [ebx + eax]
mov dword [esp + 0x42c], eax
xor ecx, ecx
mov dword [esp + 0x430], ebx
mov dword [esp + 0x43c], esi
cmp al, 4
add byte [eax], al
mov eax, dword [esp + 0x434]
movsx esi, byte [ecx + edi]
lea ebx, [edx*4]
neg ebx
inc edx
mov word [eax + ebx], si
movsx esi, byte [ecx + edi - 1]
add ecx, 0xfffffffe
mov word [eax + ebx - 2], si
cmp edx, dword [esp + 0x458]
jb 0x10004864
mov eax, dword [esp + 0x42c]
lea ecx, [edx + edx]
neg ecx
lea edi, [edx + edx + 1]
mov ebx, dword [esp + 0x430]
add ecx, eax
mov esi, dword [esp + 0x43c]
lea edx, [edi - 1]
cmp edx, eax
jae 0x100048de
lea ecx, [ebx + eax]
sub ecx, edi
movsx edx, byte [ecx + 1]
mov ecx, eax
sub ecx, edi
add edi, edi
neg edi
mov dword [esp + 0x438], edx
lea edx, [esp + eax*2 + 0x224]
mov eax, dword [esp + 0x438]
mov word [edi + edx + 2], ax
movsx edx, byte [ecx + ebx]
mov word [esp + ecx*2 + 0x224], dx
push eax
lea eax, [esp + 0x228]
call fcn.10003ec0
mov edx, eax
test edx, edx
jbe 0x1000495f
mov eax, dword [esp + 0xca0]
xor ecx, ecx
mov ebx, dword [eax + 0x11c]
mov eax, edx
shr eax, 1
je 0x100062a9
mov dword [esp + 0x43c], esi
xor edi, edi
imul ecx, ebx
movzx esi, word [esp + edi*4 + 0x224]
add ecx, esi
imul ecx, ebx
movzx esi, word [esp + edi*4 + 0x226]
inc edi
add ecx, esi
cmp edi, eax
jb 0x1000491f
mov esi, dword [esp + 0x43c]
lea edi, [edi + edi + 1]
lea eax, [edi - 1]
cmp eax, edx
jae 0x10004961
imul ebx, ecx
movzx ecx, word [esp + edi*2 + 0x222]
add ecx, ebx
jmp 0x10004961
xor ecx, ecx
mov eax, dword [esp + 0x440]
mov edx, dword [esp + 0x444]
movzx ebx, word [eax + esi*2 - 2]
mov eax, dword [esp + 0xa54]
add eax, dword [edx + ebx*4]
cmp ecx, dword [esp + 0x44c]
jne 0x10004711
mov dword [esp + 0x860], eax
mov ebx, dword [esp + 0xca0]
push 0x80
push 0x40
call dword [esp + 0xc9c]
mov dword [esp + 0xc98], eax
mov edi, 1
jmp 0x10004949
mov edi, 1
jmp 0x100048ac

Function at 0x1000482e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test dl, bh
sbb al, 0
add byte [ebx], dh
ror byte [ebp + 0x224448c], cl
add byte [eax], al

Function at 0x10004962
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test byte [eax + eax*2], ah
add al, 0
add byte [ebx + 0x4442494], cl
add byte [eax], al
Function at 0x100049ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [esp + 0xc5c]
mov eax, dword [ebx + 0xf0]
mov dword [esp + 0x654], eax
mov edx, dword [esi + 0x3c]
mov dword [esp + 0xca0], ebx
mov ecx, dword [edx + esi + 0x78]
mov edx, dword [ecx + esi + 0x20]
mov edi, dword [ecx + esi + 0x1c]
add edx, esi
mov ecx, dword [ecx + esi + 0x24]
add edi, esi
add ecx, esi
xor esi, esi
mov dword [esp + 0x648], ecx
mov dword [esp + 0x64c], edi
mov dword [esp + 0x650], edx
xchg esp, eax
and al, 0x50
push es
add byte [eax], al

Function at 0x100049f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [esp + 0xc5c]
mov eax, dword [ebx + 0xf0]
mov dword [esp + 0x654], eax
mov edx, dword [esi + 0x3c]
mov dword [esp + 0xca0], ebx
mov ecx, dword [edx + esi + 0x78]
mov edx, dword [ecx + esi + 0x20]
mov edi, dword [ecx + esi + 0x1c]
add edx, esi
mov ecx, dword [ecx + esi + 0x24]
add edi, esi
add ecx, esi
xor esi, esi
mov dword [esp + 0x648], ecx
mov dword [esp + 0x64c], edi
mov dword [esp + 0x650], edx
xchg esp, eax
and al, 0x50
push es
add byte [eax], al
Function at 0x10004c99
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or byte [eax], al
add byte [ecx - 0x6b74cbb0], cl
and al, 0x4c
or byte [eax], al
add byte [ecx - 0x6b74afb0], cl
and al, 0x60
or byte [eax], al
add byte [ecx - 0x6b74c3b0], cl
and al, 0x44
or byte [eax], al
add byte [ecx - 0x6b74b3b0], cl

Function at 0x10004cbf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x50
or byte [eax], al
add byte [ecx - 0x6b74cfb0], cl
and al, 0x3c
or byte [eax], al
add byte [ecx + 0x548b6c50], cl
and al, 0x18

Function at 0x10004d03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [eax + 0x64], edx
mov edx, dword [esi + 0x3c]
mov ebx, dword [esp + 0xca0]
mov eax, dword [ebx + 0x6c]
mov ecx, dword [edx + esi + 0x78]
mov dword [esp + 0x870], eax
mov edx, dword [ecx + esi + 0x20]
mov edi, dword [ecx + esi + 0x1c]
add edx, esi
mov ecx, dword [ecx + esi + 0x24]
dec esp
xor dword [ebx + eax], esp
inc byte [ebx]
into
xor esi, esi
mov dword [esp + 0x864], ecx
mov dword [esp + 0x868], edi
mov dword [esp + 0x86c], edx

Function at 0x10004d9a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea edi, [eax + eax]
mov dword [esp + 0x84c], ecx
mov ecx, dword [esp + 0x10]
cmp edx, edi
jg 0x10004db6
neg edx
cmp edx, eax
jle 0x10004e52
mov edi, eax
shr edi, 1
je 0x100062c7
xor ecx, ecx
lea edx, [ebx + eax]
mov dword [esp + 0x848], esi
mov dword [esp + 0x850], edi
mov dword [esp + 0x18], eax
inc esp
and al, 0x18
mov dword [esp + 0x83c], ebx
mov esi, ecx
mov ebx, dword [esp + 0x84c]
lea eax, [ecx*4]
neg eax
inc ecx
movsx edi, byte [esi + edx]
mov word [ebx + eax], di
invalid
invalid

Function at 0x10004e3b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc esp
and al, 0x18
mov eax, dword [esp + 0x18]
lea edx, [ecx + ecx + 1]
mov ebx, dword [esp + 0x83c]
mov esi, dword [esp + 0x848]
lea ecx, [edx - 1]
cmp ecx, eax
jae 0x10004e45
lea ecx, [ebx + eax]
sub ecx, edx
add edx, edx
neg edx
movsx edi, byte [ecx + 1]
mov ecx, dword [esp + 0x84c]
and al, 0x4c
or byte [eax], al
add byte [esi - 0x77], ah
jl 0x10004e4e
invalid
lea edx, [eax + 1]
sub eax, edx
lea ecx, [eax + 1]
jmp 0x10004f08
Function at 0x10004e63
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, edx
lea ecx, [esp + eax*2 + 0x634]
mov dword [esp + 0x840], ecx
lea edi, [ebx + eax]
mov dword [esp + 0x18], eax
xor ecx, ecx
mov dword [esp + 0x83c], ebx
mov dword [esp + 0x848], esi
and al, 0x48
or byte [eax], al
add byte [ebx + 0x8402484], cl
add byte [eax], al
movsx esi, byte [ecx + edi]
lea ebx, [edx*4]
neg ebx
inc edx
mov word [eax + ebx], si
movsx esi, byte [ecx + edi - 1]
add ecx, 0xfffffffe
mov word [eax + ebx - 2], si
cmp edx, dword [esp + 0x854]
jb 0x10004e91
mov eax, dword [esp + 0x18]
lea ecx, [edx + edx]
neg ecx
lea edi, [edx + edx + 1]
mov ebx, dword [esp + 0x83c]
add ecx, eax
mov esi, dword [esp + 0x848]
lea edx, [edi - 1]
cmp edx, eax
jae 0x10004f08
lea ecx, [ebx + eax]
sub ecx, edi
movsx edx, byte [ecx + 1]
mov ecx, eax
sub ecx, edi
add edi, edi
neg edi
mov dword [esp + 0x844], edx
lea edx, [esp + eax*2 + 0x634]
xor al, 6
add byte [eax], al
mov eax, dword [esp + 0x844]
mov word [edi + edx + 2], ax

Function at 0x10004e85
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, edx
lea ecx, [esp + eax*2 + 0x634]
mov dword [esp + 0x840], ecx
lea edi, [ebx + eax]
mov dword [esp + 0x18], eax
xor ecx, ecx
mov dword [esp + 0x83c], ebx
mov dword [esp + 0x848], esi
and al, 0x48
or byte [eax], al
add byte [ebx + 0x8402484], cl
add byte [eax], al
movsx esi, byte [ecx + edi]
lea ebx, [edx*4]
neg ebx
inc edx
mov word [eax + ebx], si
movsx esi, byte [ecx + edi - 1]
add ecx, 0xfffffffe
mov word [eax + ebx - 2], si
cmp edx, dword [esp + 0x854]
jb 0x10004e91
mov eax, dword [esp + 0x18]
lea ecx, [edx + edx]
neg ecx
lea edi, [edx + edx + 1]
mov ebx, dword [esp + 0x83c]
add ecx, eax
mov esi, dword [esp + 0x848]
lea edx, [edi - 1]
cmp edx, eax
jae 0x10004f08
lea ecx, [ebx + eax]
sub ecx, edi
movsx edx, byte [ecx + 1]
mov ecx, eax
sub ecx, edi
add edi, edi
neg edi
mov dword [esp + 0x844], edx
lea edx, [esp + eax*2 + 0x634]
xor al, 6
add byte [eax], al
mov eax, dword [esp + 0x844]
mov word [edi + edx + 2], ax

Function at 0x10004ef8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edx, edx
lea ecx, [esp + eax*2 + 0x634]
mov dword [esp + 0x840], ecx
lea edi, [ebx + eax]
mov dword [esp + 0x18], eax
xor ecx, ecx
mov dword [esp + 0x83c], ebx
mov dword [esp + 0x848], esi
and al, 0x48
or byte [eax], al
add byte [ebx + 0x8402484], cl
add byte [eax], al
movsx esi, byte [ecx + edi]
lea ebx, [edx*4]
neg ebx
inc edx
mov word [eax + ebx], si
movsx esi, byte [ecx + edi - 1]
add ecx, 0xfffffffe
mov word [eax + ebx - 2], si
cmp edx, dword [esp + 0x854]
jb 0x10004e91
mov eax, dword [esp + 0x18]
lea ecx, [edx + edx]
neg ecx
lea edi, [edx + edx + 1]
mov ebx, dword [esp + 0x83c]
add ecx, eax
mov esi, dword [esp + 0x848]
lea edx, [edi - 1]
cmp edx, eax
jae 0x10004f08
lea ecx, [ebx + eax]
sub ecx, edi
movsx edx, byte [ecx + 1]
mov ecx, eax
sub ecx, edi
add edi, edi
neg edi
mov dword [esp + 0x844], edx
lea edx, [esp + eax*2 + 0x634]
xor al, 6
add byte [eax], al
mov eax, dword [esp + 0x844]
mov word [edi + edx + 2], ax
Function at 0x10004f0e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 0xfffffff8
inc esi
mov ecx, dword [esp + 0x874]
add byte [ebp + 0x63c2484], cl
add byte [eax], al
mov ebx, dword [eax + 0x420]
mov edx, 0x208
add ebx, dword [ecx + esi*4 - 4]
call fcn.100041b0
mov eax, ebx
push eax
call fcn.10003e88
mov ecx, eax
test eax, eax
je 0x10004f08
invalid
mov dword [ecx], eax
add byte [eax], al
cmp eax, 6
jbe 0x10004e52
mov dword [esp + 0x10], ecx
lea edx, [eax + ebx]
neg edx
lea ecx, [esp + eax*2 + 0x634]
add edx, ecx
mov edx, eax
shr edx, 1
mov dword [esp + 0x854], edx
je 0x10006519
movsx edx, byte [ecx + ebx]
mov word [esp + ecx*2 + 0x634], dx
xchg esp, eax
dec esp
xor al, 6
add byte [eax], al
push eax
lea eax, [esp + 0x638]
call fcn.10003ec0
mov ecx, eax
test ecx, ecx
jbe 0x10004f89
mov edx, dword [esp + 0xca0]
xor eax, eax
mov ebx, dword [edx + 0x11c]
mov edx, ecx
shr edx, 1
je 0x100062d1
invalid
mov ah, 0x24
dec eax
or byte [eax], al
lea edi, [edi + edi + 1]
lea edx, [edi - 1]
cmp edx, ecx
jae 0x10004f8b
imul ebx, eax
movzx eax, word [esp + edi*2 + 0x632]
add eax, ebx
jmp 0x10004f8b
mov edx, dword [esp + 0x864]
mov ecx, dword [esp + 0x868]
movzx ebx, word [edx + esi*2 - 2]
mov edx, dword [esp + 0xa54]
or al, byte [eax]
add byte [ebx], al
adc al, 0x99
cmp eax, dword [esp + 0x870]
jne 0x10004d47
mov eax, dword [esp + 0xc98]
mov esi, dword [esp + 0xa54]
mov ebx, dword [esp + 0xca0]
mov dword [eax + 0x58], edx
mov edx, dword [esi + 0x3c]
mov eax, dword [ebx + 0x12c]
mov dword [esp + 0xa64], eax
mov ecx, dword [edx + esi + 0x78]
mov edx, dword [ecx + esi + 0x20]
mov edi, dword [ecx + esi + 0x1c]
add edx, esi
mov ecx, dword [ecx + esi + 0x24]
add edi, esi
add ecx, esi
xor esi, esi
mov dword [esp + 0xa58], ecx
mov dword [esp + 0xa5c], edi

Function at 0x10004f2a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, byte [0x3300000c]
ror byte [ebx + 0x11c9a], 0
mov edi, 1
jmp 0x10004f73

Function at 0x10004f46
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ebx], dh
dec dword [edi]
scasd eax, dword es:[edi]
ret

Function at 0x10004f5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
imul eax, ebx
movzx esi, word [esp + edi*4 + 0x634]
add eax, esi
imul eax, ebx
movzx esi, word [esp + edi*4 + 0x636]
mov esp, 0x636
mov esp, 0x636
inc edi
add eax, esi
cmp edi, edx
jb 0x10004f49
mov esi, dword [esp + 0x848]