joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020c90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1006df68
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1008c288]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x84]
mov ebp, dword [esp + 0x60]
mov ebx, dword [esp + 0x80]
mov edi, ecx
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x1c], eax
call fcn.100015d0
mov esi, dword [esi + 0x10]
push eax
push esi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x3c]
push ecx
push edi
mov dword [esp + 0x70], 0
call fcn.1001ec50
push eax
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.MSVCR80.dll__strtoui64]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x4c]
add esp, 0x24
test eax, eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x58], 0xffffffff
je 0x10020d79
push 0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.10029ea3
mov eax, dword [edi + 4]
test eax, eax
jbe 0x10020d57
cmp eax, 0xffffffff
jae 0x10020d57
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x1c]
and esi, edi
call fcn.10029ec4
test esi, esi
je 0x10020d79
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edi, dword [esp + 0x68]
jne 0x10020dba
test edi, edi
je 0x10020db3
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x10020d9f
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x10020d9f
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10020da8
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x10020db3
mov byte [esp + 0x6d], al
jmp 0x10020db5
xor edi, edi
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x78], 0
mov esi, dword [esp + 0x74]
jne 0x10020df0
test esi, esi
je 0x10020dee
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x10020de0
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x10020de0
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10020de9
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x10020df0
xor esi, esi
test edi, edi
jne 0x10020dfa
test esi, esi
je 0x10020dfe
jmp 0x10020e01
test esi, esi
je 0x10020e01
or dword [ebx], 1
lea eax, [esp + 0x2c]
cmp dword [esp + 0x14], eax
je 0x10020e1e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [eax], ecx
mov dword [eax + 4], edx
jmp 0x10020e21
or dword [ebx], 2
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x6c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.10028d90
add esp, 0x48
ret 0x28
Function at 0x10021060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1006dfc8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x1008c288]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebp
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
mov ebp, dword [esp + 0x80]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
mov esi, ecx
mov ecx, dword [esp + 0x9c]
push eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], 0
call fcn.100015d0
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
mov dword [esp + 0x90], 0
call fcn.1001f120
add esp, 0x14
push eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.1002a8ec
fstp qword [esp + 0x38]
mov edi, dword [esp + 0x30]
add esp, 0x10
test edi, edi
mov dword [esp + 0x78], 0xffffffff
je 0x1002115e
push 0
lea ecx, [esp + 0x1c]
call fcn.10029ea3
mov eax, dword [edi + 4]
test eax, eax
jbe 0x1002113c
cmp eax, 0xffffffff
jae 0x1002113c
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x18]
and esi, edi
call fcn.10029ec4
test esi, esi
je 0x1002115e
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x8c], 0
mov edi, dword [esp + 0x88]
jne 0x100211ab
test edi, edi
je 0x100211a1
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x1002118a
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x1002118a
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10021193
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x100211a1
mov byte [esp + 0x8d], al
jmp 0x100211a3
xor edi, edi
mov byte [esp + 0x8c], 1
cmp byte [esp + 0x98], 0
mov esi, dword [esp + 0x94]
jne 0x100211e7
test esi, esi
je 0x100211e5
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x100211d7
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x100211d7
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x100211e0
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x100211e7
xor esi, esi
test edi, edi
jne 0x10021210
test esi, esi
je 0x10021214
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x30]
cmp dword [esp + 0x24], ecx
je 0x1002121d
cmp dword [esp + 0x14], 0
jne 0x1002121d
fld qword [esp + 0x28]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x10021220
test esi, esi
je 0x100211ef
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x100211f3
or dword [eax], 2
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x8c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.10028d90
add esp, 0x6c
ret 0x28
Function at 0x10021260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1006dfc8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x1008c288]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebp
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
mov ebp, dword [esp + 0x80]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
mov esi, ecx
mov ecx, dword [esp + 0x9c]
push eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], 0
call fcn.100015d0
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
mov dword [esp + 0x90], 0
call fcn.1001f120
add esp, 0x14
push eax
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.1002a953
fstp qword [esp + 0x38]
mov edi, dword [esp + 0x30]
add esp, 0x10
test edi, edi
mov dword [esp + 0x78], 0xffffffff
je 0x1002135e
push 0
lea ecx, [esp + 0x1c]
call fcn.10029ea3
mov eax, dword [edi + 4]
test eax, eax
jbe 0x1002133c
cmp eax, 0xffffffff
jae 0x1002133c
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x18]
and esi, edi
call fcn.10029ec4
test esi, esi
je 0x1002135e
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x8c], 0
mov edi, dword [esp + 0x88]
jne 0x100213ab
test edi, edi
je 0x100213a1
mov eax, dword [edi + 0x20]
cmp dword [eax], 0
je 0x1002138a
mov ecx, dword [edi + 0x30]
cmp dword [ecx], 0
jle 0x1002138a
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x10021393
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x100213a1
mov byte [esp + 0x8d], al
jmp 0x100213a3
xor edi, edi
mov byte [esp + 0x8c], 1
cmp byte [esp + 0x98], 0
mov esi, dword [esp + 0x94]
jne 0x100213e7
test esi, esi
je 0x100213e5
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x100213d7
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x100213d7
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x100213e0
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x100213e7
xor esi, esi
test edi, edi
jne 0x10021410
test esi, esi
je 0x10021414
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x30]
cmp dword [esp + 0x24], ecx
je 0x1002141d
cmp dword [esp + 0x14], 0
jne 0x1002141d
fld qword [esp + 0x28]
mov edx, dword [esp + 0x1c]
fstp qword [edx]
jmp 0x10021420
test esi, esi
je 0x100213ef
mov eax, dword [esp + 0x10]
or dword [eax], 1
jmp 0x100213f3
or dword [eax], 2
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x8c]
mov dword [ebp], eax
mov dword [ebp + 4], edi
mov dword [ebp + 8], ecx
mov eax, ebp
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.10028d90
add esp, 0x6c
ret 0x28
Function at 0x10021460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1006df38
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1008c288]
xor eax, esp
mov dword [esp + 0x40], eax
push ebp
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x84]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
mov esi, ecx
mov ecx, dword [esp + 0x80]
push eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 0
call fcn.100015d0
push eax
push 0x800
lea ecx, [esp + 0x7c]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x40]
push eax
push esi
mov dword [esp + 0x74], 0
call fcn.1001ec50
mov ebp, eax
mov eax, dword [esp + 0x3c]
add esp, 0x18
test eax, eax
mov dword [esp + 0x5c], 0xffffffff
je 0x10021547
push 0
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.10029ea3
mov eax, dword [edi + 4]
test eax, eax
jbe 0x10021521
cmp eax, 0xffffffff
jae 0x10021521
add eax, 0xffffffff
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x1c]
and esi, edi
call fcn.10029ec4
test esi, esi
je 0x10021543
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push ebp
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.1002a693
mov ebp, dword [esp + 0x7c]
add esp, 0x10
cmp byte [esp + 0x70], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
jne 0x100215ad
test ebp, ebp
je 0x100215a6
mov eax, dword [ebp + 0x20]
cmp dword [eax], 0
je 0x10021591
mov ecx, dword [ebp + 0x30]
cmp dword [ecx], 0
jle 0x10021591
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x1002159b
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
mov ecx, ebp
call edx
cmp eax, 0xffffffff
je 0x100215a6
mov byte [esp + 0x71], al
jmp 0x100215a8
xor ebp, ebp
mov byte [esp + 0x70], 1
cmp byte [esp + 0x7c], 0
mov esi, dword [esp + 0x78]
jne 0x100215e3
test esi, esi
je 0x100215e1
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x100215d3
mov ecx, dword [esi + 0x30]
cmp dword [ecx], 0
jle 0x100215d3
mov edx, dword [eax]
movzx eax, byte [edx]
jmp 0x100215dc
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x100215e3
xor esi, esi
test ebp, ebp
jne 0x100215ed
test esi, esi
je 0x100215f1
jmp 0x100215f4
test esi, esi
je 0x100215f4
or dword [edi], 1
lea eax, [esp + 0x30]
cmp dword [esp + 0x2c], eax
je 0x10021611
cmp dword [esp + 0x18], 0
jne 0x10021611
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov dword [edx], ecx
jmp 0x10021614
or dword [edi], 2
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x70]
mov dword [eax], ecx
mov dword [eax + 4], ebp
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.10028d90
add esp, 0x50
ret 0x28
Function at 0x10025030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1006e518
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1008c288]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
mov dl, byte [0x1007850c]
mov esi, dword [esp + 0x70]
mov ebx, ecx
mov ecx, dword [0x10078508]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x40], dl
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], eax
mov byte [esp + 0x24], al
mov dword [esp + 0x50], eax
mov al, byte [esp + 0x78]
test al, al
jne 0x100250a8
mov al, byte [esp + 0x74]
jmp 0x100250b0
mov cl, byte [esp + 0x74]
mov byte [esp + 0x3f], cl
mov byte [esp + 0x3e], al
mov edi, 0x10
lea esp, [esp]
push 0
push edi
lea ecx, [esp + 0x28]
call fcn.10005b10
cmp dword [esp + 0x38], 0x10
mov eax, dword [ebx + 8]
mov ecx, dword [esp + 0x24]
jae 0x100250de
lea ecx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x38]
push esi
lea edx, [esp + 0x44]
push edx
push eax
push ecx
call dword [sym.imp.MSVCR80.dll__Strftime]
mov ebp, eax
add esp, 0x14
test ebp, ebp
ja 0x100250fe
add edi, edi
jmp 0x100250c0
cmp dword [esp + 0x38], 0x10
mov ecx, dword [esp + 0x24]
jae 0x1002510d
lea ecx, [esp + 0x24]
sub ebp, 1
mov esi, dword [esp + 0x64]
mov eax, 0xfffffffe
mov dword [esp + 0x18], eax
mov edi, ecx
je 0x1002516a
add edi, 1
test esi, esi
je 0x10025160
mov ecx, dword [esi + 0x24]
cmp dword [ecx], 0
mov dl, byte [edi]
je 0x1002514e
mov eax, dword [esi + 0x34]
cmp dword [eax], 0
jle 0x1002514e
add dword [eax], 0xffffffff
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
lea ebx, [ecx + 1]
mov dword [eax], ebx
mov byte [ecx], dl
movzx eax, dl
jmp 0x1002515b
mov eax, dword [esi]
movzx ecx, dl
mov edx, dword [eax + 4]
push ecx
mov ecx, esi
call edx
cmp eax, 0xffffffff
jne 0x10025165
mov byte [esp + 0x60], 1
sub ebp, 1
jne 0x10025121
cmp dword [esp + 0x38], 0x10
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [edi + 8], esi
jb 0x10025192
mov edx, dword [esp + 0x24]
push edx
call fcn.10029d5b
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10028d90
add esp, 0x40
ret 0x24
Function at 0x10028d90
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1008c288]
jne 0x10028d9a
repz ret
jmp fcn.100297c5

Function at 0x1002b579
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x1006ebe3
call fcn.1002976c
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x1002b68b
cmp byte [esi + 0x42], bl
je 0x1002b68b
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp ax, di
jne 0x1002b5b5
xor al, al
jmp 0x1002b68d
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.10006070
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100223a0
mov ecx, eax
call fcn.10022050
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100223a0
mov ecx, eax
call fcn.10022050
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x1002b625
dec eax
je 0x1002b629
dec eax
dec eax
je 0x1002b687
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100029a0
mov al, bl
jmp 0x1002b68d
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100223a0
mov ecx, eax
call fcn.10022050
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x1002b669
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100223a0
mov ecx, eax
call fcn.10022050
push dword [esi + 0x4c]
push edi
push 1
push eax
call sub.MSVCR80.dll_fwrite
add esp, 0x10
cmp edi, eax
jne 0x1002b613
cmp byte [esi + 0x42], 0
je 0x1002b687
test edi, edi
jne 0x1002b5c3
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10005b10
jmp 0x1002b5c3
mov bl, 1
jmp 0x1002b615
mov al, 1
call fcn.100297b6
ret
Function at 0x1002b693
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x1006ec10
call fcn.1002976c
mov edi, dword [ebp + 8]
cmp di, 0xffff
mov esi, ecx
jne 0x1002b6b6
xor ax, ax
call fcn.100297b6
ret 4
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x1002b6e1
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x1002b6e1
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x1002b6ae
mov eax, dword [esi + 0x4c]
cmp eax, ebx
jne 0x1002b6ee
or ax, 0xffff
jmp 0x1002b6ae
cmp dword [esi + 0x3c], ebx
jne 0x1002b70a
push eax
push edi
call fcn.1002b20b
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x1002b6ae
mov eax, 0xffff
jmp 0x1002b6ae
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
call fcn.10006070
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.100223a0
mov ecx, eax
call fcn.10022050
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100223a0
mov ecx, eax
call fcn.10022050
lea edx, [ebp - 0x38]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x1002b7fb
cmp eax, 1
jg 0x1002b836
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100223a0
mov ecx, eax
call fcn.10022050
mov edi, dword [ebp - 0x38]
sub edi, eax
je 0x1002b7a0
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100223a0
mov ecx, eax
call fcn.10022050
push dword [esi + 0x4c]
push edi
push 1
push eax
call sub.MSVCR80.dll_fwrite
add esp, 0x10
cmp edi, eax
jne 0x1002b81d
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x3c], eax
mov byte [esi + 0x42], 1
jne 0x1002b857
test edi, edi
ja 0x1002b7c6
cmp dword [ebp - 0x18], 0x20
jae 0x1002b81d
push 0
push 8
lea ecx, [ebp - 0x2c]
call fcn.10005b10
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100223a0
mov ecx, eax
call fcn.10022050
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100223a0
mov ecx, eax
call fcn.10022050
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x40]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x3c]
push edx
lea edx, [ebp - 0x2e]
push edx
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x1002b757
or si, 0xffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100029a0
mov ax, si
jmp 0x1002b6ae
cmp eax, 3
jne 0x1002b81d
push dword [esi + 0x4c]
push dword [ebp - 0x30]
call fcn.1002b20b
test al, al
movzx esi, word [ebp + 8]
pop ecx
pop ecx
jne 0x1002b822
mov esi, 0xffff
jmp 0x1002b822
mov si, word [ebp + 8]
jmp 0x1002b822
Function at 0x1003bac0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1006fdd6
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x18], ebp
xor edi, edi
lea esi, [ebp + 4]
mov dword [ebp], 0x100790f8
mov dword [esp + 0x2c], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [esp + 0x38]
push eax
lea ecx, [ebp + 0x14]
mov byte [esp + 0x30], 1
call fcn.1003b860
mov ebx, dword [esp + 0x34]
mov ecx, dword [ebx + 4]
cmp ecx, edi
mov byte [esp + 0x2c], 2
jne 0x1003bb2c
xor eax, eax
jmp 0x1003bb34
mov eax, dword [ebx + 8]
sub eax, ecx
sar eax, 3
sub esp, 8
mov ecx, esp
mov dword [ecx], edi
mov dword [esp + 0x40], esp
mov dword [ecx + 4], edi
push eax
mov ecx, esi
call fcn.10049e20
mov ecx, ebx
mov dword [esp + 0x38], edi
call fcn.1003b170
test eax, eax
jbe 0x1003bc50
mov eax, dword [esp + 0x38]
mov ecx, dword [ebx + 4]
mov esi, dword [ebp + 8]
add eax, eax
add eax, eax
add eax, eax
mov ecx, dword [eax + ecx]
mov edx, dword [ecx]
add esi, eax
mov eax, dword [edx + 4]
call eax
mov edi, eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], 0
push edi
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 3
call fcn.100388d0
mov edx, dword [eax]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x20], edx
mov dword [eax], ecx
mov eax, dword [esp + 0x34]
test eax, eax
je 0x1003bbda
mov ecx, eax
mov dword [esp + 0x14], ecx
add eax, 4
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x1003bbda
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov ecx, dword [esp + 0x14]
lea eax, [ecx + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x1003bbda
mov eax, dword [ecx]
mov edx, dword [eax + 8]
call edx
push edi
lea eax, [esp + 0x20]
push edi
push eax
call fcn.1000f830
mov eax, dword [esp + 0x28]
mov ecx, dword [esi]
mov edx, dword [esp + 0x2c]
mov dword [esi], eax
mov edi, dword [esi + 4]
add esp, 0xc
test edi, edi
mov byte [esp + 0x2c], 2
mov dword [esp + 0x1c], ecx
mov dword [esi + 4], edx
mov dword [esp + 0x20], edi
je 0x1003bc36
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bc36
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bc36
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
mov esi, dword [esp + 0x38]
add esi, 1
mov ecx, ebx
mov dword [esp + 0x38], esi
call fcn.1003b170
cmp esi, eax
jb 0x1003bb5d
mov eax, ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 8
Function at 0x1003e1a0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x100703d2
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1008c288]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
xor ebx, ebx
push 1
mov edi, 0xf
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
push 0x10076a28
mov byte [esi + 4], bl
call fcn.100036b0
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], ebx
mov dword [esp + 0x1c], ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x6c], edi
mov dword [esi + 0x68], ebx
mov byte [esi + 0x58], bl
lea ecx, [esi + 0x70]
push 0xb
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.LC_MESSAGES
mov byte [esp + 0x24], 3
mov byte [ecx + 4], bl
call fcn.100036b0
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xb0], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret