joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b606
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call fcn.1001b749
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fsub qword [0x1008556a]
fstp qword [ebp - 0x18]
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 8]
push eax
push 0x40
push 0x12
fld qword [ebp - 0x18]
call fcn.10001b62
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1001b677
push 0x3f
push 0x4014192
push 6
call fcn.10069544
add esp, 0xc
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fsub qword [0x1008556a]
fstp qword [ebp - 0x18]
push 0x12
fld qword [ebp - 0x18]
call fcn.10001b62
push eax
call fcn.10006676
mov dword [ebp - 0x1c], eax
mov eax, 0x10085572
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.1000343e
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x1001b6c3
push ebx
call fcn.1006953e
add esp, 4
mov eax, dword [ebp - 0x24]
xor ecx, ecx
test eax, eax
je 0x1001b6cf
mov ecx, dword [eax + 4]
push ecx
add eax, 8
push eax
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
test eax, eax
je 0x1001b6e0
mov ebx, dword [eax + 4]
add eax, 8
push eax
cmp ebx, ecx
mov eax, 1
jne 0x1001b6f7
dec eax
test ecx, ecx
je 0x1001b6f7
call fcn.1001b188
add esp, 0xc
test eax, eax
mov eax, 0
sete al
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1001b717
push ebx
call fcn.1006953e
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x1001b727
push ebx
call fcn.1006953e
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x1001b73b
mov eax, 0
jmp 0x1001b745
mov eax, 1
jmp 0x1001b745
mov esp, ebp
pop ebp
ret
Function at 0x1001ee3d
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 1
push closesocket
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.taskkill__im_explorer.exe__f
push 3
mov ebx, 0x2c0
call fcn.1006cb60
add esp, 0x28
push 0x80000301
push 0
push 0x258
push 1
mov ebx, 0x67c
call fcn.1006ba90
add esp, 0x10
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.1006a7d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1001eed6
push ebx
call fcn.1006953e
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.1001efeb
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 1
push 0
push 0x24
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1001ef26
push 0x12d
push 0x40155cd
push 6
call fcn.10069544
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1001ef4d
mov eax, str.C:WINDOWS
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1001ef49
push ebx
call fcn.1006953e
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.1006b880
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push str.explorer.exe
push str.Open
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1001efb1
push 0x1da
push 0x40155cd
push 6
call fcn.10069544
add esp, 0xc
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1001efc4
push ebx
call fcn.1006953e
add esp, 4
cmp dword [ebp - 0x10], 2
mov eax, 0
setne al
jmp 0x1001efd5
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1001efe6
push ebx
call fcn.1006953e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x10027377
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.10027527
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x10027475
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10027418
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x1002745b
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x1002742f
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x1002744a
test al, 0x40
je 0x10027441
mov ecx, dword [edi + 0x20]
jmp 0x10027448
test al, 0x80
je 0x1002745b
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x1002745b
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x100273e7
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x10029eb6
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 4], esp
je 0x10029eeb
push 0x24
push 0x4010faa
push 6
call fcn.10069544
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10029fb1
mov dword [ebp - 4], esp
xor eax, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10029f21
push 0x6d
push 0x4010faa
push 6
call fcn.10069544
add esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [0x100b9e0c]
cmp dword [ebp - 0xc], eax
jne 0x10029fb1
cmp dword [0x100b9fe0], 0
jne 0x10029f60
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [0x100b9fe0], eax
mov eax, 1
jmp 0x10029fbb
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fild dword [0x100b9fe0]
fstp qword [ebp - 0x14]
fsub qword [ebp - 0x14]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fsub qword [0x100854cf]
fcomp qword [0x10084b4e]
fnstsw ax
test ah, 0x41
jne 0x10029fb1
mov dword [0x100b9fe0], 0
mov eax, 0
jmp 0x10029fbb
mov esp, ebp
pop ebp
ret 4
Function at 0x1002fc7a
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1002fcc2
push 0x19
push 0x40155cc
push 6
call fcn.10069544
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x25
je 0x1002fd44
cmp dword [ebp + 8], 0x26
je 0x1002fd44
cmp dword [ebp + 8], 0x27
je 0x1002fd44
cmp dword [ebp + 8], 0x28
je 0x1002fd44
cmp dword [ebp + 8], 0x21
je 0x1002fd44
cmp dword [ebp + 8], 0x22
je 0x1002fd44
cmp dword [ebp + 8], 0x23
je 0x1002fd44
cmp dword [ebp + 8], 0x24
je 0x1002fd44
cmp dword [ebp + 8], 0x2d
je 0x1002fd44
cmp dword [ebp + 8], 0x2e
je 0x1002fd44
cmp dword [ebp + 8], 0x6f
je 0x1002fd44
cmp dword [ebp + 8], 0x90
je 0x1002fd44
xor eax, eax
jmp 0x1002fd49
mov eax, 1
test eax, eax
je 0x1002fd7c
push 0x80000301
push 0
push pe_nt_image_headers32
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.1006b860
add esp, 0x1c
mov dword [ebp - 4], eax
push 0x80000301
push 0
push pe_nt_image_headers32
push 1
mov ebx, 0x184
call fcn.1006a7d0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1002fdb1
push ebx
call fcn.1006953e
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x10
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x9f8
call fcn.1006b960
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push pe_nt_image_headers32
push dword [ebp - 8]
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1002fe14
push 0x262
push 0x40155cc
push 6
call fcn.10069544
add esp, 0xc
push 0x1008224f
push dword [ebp - 8]
call fcn.10002b89
add esp, 8
cmp eax, 0
jne 0x1002fea5
cmp dword [ebp + 8], 1
jne 0x1002fe46
mov eax, 0x100b290f
jmp 0x1002fec6
cmp dword [ebp + 8], 2
jne 0x1002fe5f
mov eax, 0x100b2918
jmp 0x1002fec6
cmp dword [ebp + 8], 4
jne 0x1002fe78
mov eax, 0x100b2921
jmp 0x1002fec6
cmp dword [ebp + 8], 5
jne 0x1002fe91
mov eax, 0x100b292a
jmp 0x1002fec6
cmp dword [ebp + 8], 6
jne 0x1002fea5
mov eax, 0x100b2933
jmp 0x1002fec6
mov eax, dword [ebp - 8]
test eax, eax
je 0x1002fec1
push eax
mov ebx, eax
call fcn.10001534
inc eax
push eax
call fcn.10069538
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1002fec6
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1002fed7
push ebx
call fcn.1006953e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1003b0c1
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
fild dword [0x100b9e3c]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fild dword [ebp + 8]
fstp qword [ebp - 0x10]
fadd qword [ebp - 0x10]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.10001b62
mov dword [ebp + 8], eax
fild dword [0x100b9e40]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fild dword [ebp + 0xc]
fstp qword [ebp - 0x10]
fadd qword [ebp - 0x10]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.10001b62
mov dword [ebp + 0xc], eax
mov ebx, dword [ebp + 0x10]
cmp dword [ebx], 0x2d7
jne 0x1003b140
cmp dword [0x100ba0c4], 0xffffffff
je 0x1003b140
mov eax, dword [0x100ba0c4]
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [0x100ba0c4], 0xffffffff
fild dword [ebp + 0xc]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fadd qword [0x100848e0]
fstp qword [ebp - 0x10]
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
call fcn.1002b643
mov dword [ebp - 0x18], eax
push 1
push 0xf
push 1
push 0x40400000
push dword [ebp - 0x18]
push 0x41800000
push 0x41800000
fld qword [ebp - 0x10]
fstp dword [ebp - 0x1c]
push dword [ebp - 0x1c]
fild dword [ebp + 8]
fstp dword [ebp - 0x20]
push dword [ebp - 0x20]
call fcn.1002e522
mov dword [ebp - 4], esp
push 1
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 4], esp
je 0x1003b1cb
push 0x24e
push 0x4011230
push 6
call fcn.10069544
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1003b320
push dword [ebp + 8]
call fcn.10036bc4
test eax, eax
je 0x1003b24f
push dword [ebp + 0xc]
call fcn.10036c32
test eax, eax
je 0x1003b24f
fild dword [ebp + 8]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x1008511e]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.10001b62
push eax
call fcn.10036bfb
test eax, eax
je 0x1003b24f
fild dword [ebp + 0xc]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fadd qword [0x1008511e]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
call fcn.10001b62
push eax
call fcn.10036c69
test eax, eax
je 0x1003b24f
mov eax, 1
jmp 0x1003b254
mov eax, 0
test eax, eax
je 0x1003b320
cmp dword [0x100ba0c8], 0
jne 0x1003b28e
and dword [0x100ba0cc], 1
xor dword [0x100ba0cc], 1
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [0x100ba0c8], eax
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fild dword [0x100ba0c8]
fstp qword [ebp - 0x14]
fsub qword [ebp - 0x14]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fsub qword [0x100854cf]
fcomp qword [0x10084b4e]
fnstsw ax
test ah, 0x41
jne 0x1003b2fa
and dword [0x100ba0cc], 1
xor dword [0x100ba0cc], 1
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [0x100ba0c8], eax
cmp dword [0x100ba0cc], 0
je 0x1003b320
mov eax, dword [ebp + 8]
mov dword [0x100ba0d0], eax
mov eax, dword [ebp + 0xc]
mov dword [0x100ba0d4], eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], 0x2d7
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10056831
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10056854
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10056854
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x1005685e
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100568a0
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10056902
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100568fd
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100568e8
test dl, dl
je 0x100568e4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100568e8
add ecx, 2
add eax, 2
test dl, dl
jne 0x100568c8
xor eax, eax
jmp 0x100568ed
sbb eax, eax
or eax, 1
test eax, eax
je 0x1005690e
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100568b5
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x10056993
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100569b6
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100569b6
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100569c0
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10056a02
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10056a64
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10056a5f
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10056a4a
test dl, dl
je 0x10056a46
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10056a4a
add ecx, 2
add eax, 2
test dl, dl
jne 0x10056a2a
xor eax, eax
jmp 0x10056a4f
sbb eax, eax
or eax, 1
test eax, eax
je 0x10056a70
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10056a17
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x10056b02
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10056b25
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10056b25
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10056b2f
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10056b71
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10056bd3
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10056bce
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10056bb9
test dl, dl
je 0x10056bb5
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10056bb9
add ecx, 2
add eax, 2
test dl, dl
jne 0x10056b99
xor eax, eax
jmp 0x10056bbe
sbb eax, eax
or eax, 1
test eax, eax
je 0x10056bdf
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10056b86
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x10056c6c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10056c8f
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10056c8f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10056c99
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10056cdb
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10056d3d
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10056d38
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10056d23
test dl, dl
je 0x10056d1f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10056d23
add ecx, 2
add eax, 2
test dl, dl
jne 0x10056d03
xor eax, eax
jmp 0x10056d28
sbb eax, eax
or eax, 1
test eax, eax
je 0x10056d49
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10056cf0
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x10056de2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10056e05
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10056e05
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10056e0f
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10056e51
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10056eb3
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10056eae
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10056e99
test dl, dl
je 0x10056e95
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10056e99
add ecx, 2
add eax, 2
test dl, dl
jne 0x10056e79
xor eax, eax
jmp 0x10056e9e
sbb eax, eax
or eax, 1
test eax, eax
je 0x10056ebf
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10056e66
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x10056f53
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10056f76
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10056f76
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10056f80
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10056fc2
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10057024
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x1005701f
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1005700a
test dl, dl
je 0x10057006
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1005700a
add ecx, 2
add eax, 2
test dl, dl
jne 0x10056fea
xor eax, eax
jmp 0x1005700f
sbb eax, eax
or eax, 1
test eax, eax
je 0x10057030
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10056fd7
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100570c2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100570e5
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100570e5
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100570ef
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10057131
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10057193
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x1005718e
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10057179
test dl, dl
je 0x10057175
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10057179
add ecx, 2
add eax, 2
test dl, dl
jne 0x10057159
xor eax, eax
jmp 0x1005717e
sbb eax, eax
or eax, 1
test eax, eax
je 0x1005719f
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10057146
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8