joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10039447
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x3a8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1604], eax
jne 0x10039252
mov ecx, dword [ebp - 0x764]
mov dword [ebp - 0x3e0], ecx
jmp 0x1003951b
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1604]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1608], edx
cmp dword [ebp - 0x1608], 0
jne 0x10039284
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x3e0], eax
jmp 0x1003951b
mov ecx, dword [ebp - 0x3a8]
add ecx, dword [ebp - 0x1608]
mov dword [ebp - 0x758], ecx
jne 0x100392a9
mov edx, dword [ebp - 0x764]
mov dword [ebp - 0x3e0], edx
jmp 0x1003951b
mov eax, dword [ebp - 0x758]
mov ecx, dword [ebp - 0x3a8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19ec], ecx
mov edx, dword [ebp - 0x758]
mov eax, dword [ebp - 0x3a8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19f0], eax
mov ecx, dword [ebp - 0x758]
mov edx, dword [ebp - 0x3a8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19f4], edx
mov dword [ebp - 0x75c], 0
jmp 0x10039303
mov ecx, dword [ebp - 0x758]
mov edx, dword [ebp - 0x75c]
cmp edx, dword [ecx + 0x18]
jae 0x1003950f
mov eax, dword [ebp - 0x75c]
mov ecx, dword [ebp - 0x19ec]
mov edx, dword [ebp - 0x3a8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x760], edx
mov eax, dword [ebp - 0x75c]
mov ecx, dword [ebp - 0x19f0]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19f4]
mov ecx, dword [ebp - 0x3a8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x1d80], ecx
mov dword [ebp - 0x1c8], 0
jmp 0x10039373
mov edx, dword [ebp - 0x1c8]
add edx, 1
mov dword [ebp - 0x1c8], edx
mov eax, dword [ebp - 0x760]
add eax, dword [ebp - 0x1c8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10039425
mov edx, dword [ebp - 0x1c8]
movsx eax, byte [ebp + edx - 0x898]
test eax, eax
je 0x10039425
push edi
push edx
add esp, 4
and edi, 0x28e0
or edi, 0x15d1a
add edi, 0x140f7
call 0x100393c6
add byte [0x433a4037], dh
aaa
xor esi, dword ds:[ebx]
add esp, 4
pop edi
push eax
and eax, 0x10e72
pop eax
mov ecx, dword [ebp - 0x760]
add ecx, dword [ebp - 0x1c8]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1c8]
movsx ecx, byte [ebp + eax - 0x898]
cmp edx, ecx
je 0x10039417
mov edx, dword [ebp - 0x760]
add edx, dword [ebp - 0x1c8]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1c8]
movsx edx, byte [ebp + ecx - 0x898]
cmp eax, edx
jne 0x1003941e
jmp 0x10039364
jmp 0x10039425
push eax
sub eax, 0x1161
sub eax, 0x12d91
add eax, 0x184cf
pop eax
push eax
call 0x10039447
add byte [ecx + 0x41], cl
inc ebp
push eax
cmp al, 0x3e
xor al, 0x83
les eax, [ecx + eax*4]
loopne 0x100393e7
ret 0
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x3e0], eax
Function at 0x10039498
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x75c]
add eax, 1
mov dword [ebp - 0x75c], eax
add esp, 4
and esi, 0x10680
add esi, 0x1120f
pop esi
push edx
and edx, 0x9441
add edx, 0x140af
pop edx
mov ecx, dword [ebp - 0x760]
add ecx, dword [ebp - 0x1c8]
movsx edx, byte [ecx]
or edx, 0x20
mov eax, dword [ebp - 0x1c8]
movsx ecx, byte [ebp + eax - 0x898]
or ecx, 0x20
cmp edx, ecx
jge 0x100394e9
mov dword [ebp - 0xcbc], 0xffffffff
jmp 0x100394f3
mov dword [ebp - 0xcbc], 1
cmp dword [ebp - 0xcbc], 0
jne 0x1003950a
mov edx, dword [ebp - 0x1d80]
mov dword [ebp - 0x3e0], edx
jmp 0x1003951b
jmp 0x100392f4
Function at 0x10039650
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
push esi
add esp, 4
jmp 0x1003965b
pop ecx
push edx
or edx, 0xff59
pop edx
push ebx
push edx
add esp, 4
and ebx, 0x17fba
xor ebx, 0x8ac6
sub ebx, 0x17f64
and ebx, 0x13525
pop ebx
cmp dword [ebp - 0x160c], 0
jne 0x1003969a
mov dword [ebp - 0x2f0], 0
jmp 0x10039941
mov edx, dword [ebp - 0x160c]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xcc8], ecx
push eax
add eax, 0x1069c
pop eax
push edx
push edi
add esp, 4
and edx, 0xae5e
invalid

Function at 0x100396d4
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor edx, 0x1598d
pop edx
cmp dword [ebp - 0xcc8], 0
cmp bl, dh
invalid
inc dword [eax]
jne 0x100396f6
mov dword [ebp - 0x2f0], 0
jmp 0x10039941
mov edx, dword [ebp - 0xcc8]
mov dword [ebp - 0x508], edx

Function at 0x100397ff
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0xd7b3

Function at 0x10039815
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
les eax, [ecx + eax*4]
mov bl, 0xd7
add byte [eax], al
call 0x10039815
add byte [ecx + 0x39], cl
cmp dword [edi + 0x34], eax
cmp byte [esi], bh
add esp, 4
pop ebx
movzx ecx, word [ebp - 0x48]
test ecx, ecx
jne 0x10039836
movzx edx, word [ebp - 0x234]
movzx eax, word [ebp - 0x48]
sub edx, eax
mov dword [ebp - 0x1614], edx
jmp 0x10039890
movzx ecx, word [ebp - 0x234]
movzx edx, word [ebp - 0x48]
cmp ecx, edx
je 0x1003975e
movzx eax, word [ebp - 0x234]
xor eax, 0x20
movzx ecx, word [ebp - 0x48]
cmp eax, ecx
je 0x1003975e
movzx edx, word [ebp - 0x234]
movzx eax, word [ebp - 0x48]
cmp edx, eax
jge 0x1003987a
mov dword [ebp - 0x1610], 0xffffffff
jmp 0x10039884
mov dword [ebp - 0x1610], 1
mov ecx, dword [ebp - 0x1610]
mov dword [ebp - 0x1614], ecx
cmp dword [ebp - 0x1614], 0
jne 0x100398d9
push eax
push edi
add esp, 4
and eax, 0x2329
and eax, 0xa737
pop eax
push ebx
push esi
add esp, 4
add ebx, 0x58ef
add ebx, 0x15560
or ebx, 0x1688
pop ebx
push ebx
sub ebx, 0x741f
pop ebx
mov edx, dword [ebp - 0x508]
mov dword [ebp - 0x2f0], edx
jmp 0x10039941
push ecx
jmp 0x100398e0
or ecx, 0x16bdd
pop ecx
push ecx
and ecx, 0x18310
add ecx, 0x438
cmp byte [eax + eax], al
add byte [ecx + 0x18678e1], al
add al, ch
or byte [eax], al
add byte [eax], al
Function at 0x10039907
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp byte [eax + eax], al
add byte [ecx + 0x18678e1], al
add al, ch
or byte [eax], al
add byte [eax], al
add byte [ecx], bh
xor dh, byte ss:[0x834a443f]
les eax, [ecx + ebx*2]
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax]
mov dword [ebp - 0x508], ecx
mov edx, dword [ebp - 0x508]
cmp edx, dword [ebp - 0xcc8]
je 0x10039937
mov eax, dword [ebp - 0x508]
cmp dword [eax + 0x30], 0
jne 0x10039702
mov dword [ebp - 0x2f0], 0
push edx
push edx
add esp, 4
and edx, 0xb276
pop edx
push edx
add edx, 0x137f8
pop edx
push ebx
call 0x10039963
add byte [ecx + 0x44], al
inc edi
dec ebx
cmp byte [esi], bh
inc esp
add esp, 4
and ebx, 0xab42
sub ebx, 0xa2e6
pop ebx
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push edi
push ebx
add esp, 4
add edi, 0x2275
sub edi, 0x1114c
pop edi
push esi
xor esi, 0x58fb
xor esi, 0x17562
add esi, 0x176ed
pop esi
push edx
push edi
add esp, 4
and edx, 0x16695
add word [eax], ax

Function at 0x10039963
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cmp byte [eax + eax], al
add byte [ecx + 0x18678e1], al
add al, ch
or byte [eax], al
add byte [eax], al
add byte [ecx], bh
xor dh, byte ss:[0x834a443f]
les eax, [ecx + ebx*2]
mov eax, dword [ebp - 0x508]
mov ecx, dword [eax]
mov dword [ebp - 0x508], ecx
mov edx, dword [ebp - 0x508]
cmp edx, dword [ebp - 0xcc8]
je 0x10039937
mov eax, dword [ebp - 0x508]
cmp dword [eax + 0x30], 0
jne 0x10039702
mov dword [ebp - 0x2f0], 0
push edx
push edx
add esp, 4
and edx, 0xb276
pop edx
push edx
add edx, 0x137f8
pop edx
push ebx
call 0x10039963
add byte [ecx + 0x44], al
inc edi
dec ebx
cmp byte [esi], bh
inc esp
add esp, 4
and ebx, 0xab42
sub ebx, 0xa2e6
pop ebx
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x338], edx
push edi
push ebx
add esp, 4
add edi, 0x2275
sub edi, 0x1114c
pop edi
push esi
xor esi, 0x58fb
xor esi, 0x17562
add esi, 0x176ed
pop esi
push edx
push edi
add esp, 4
and edx, 0x16695
add word [eax], ax

Function at 0x10039a80
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
dec eax
and byte [ecx - 0x1a0773], cl
dec dword [ebx - 0x7676b]
dec dword [ebx - 0x3377b]
enter 0xfffffffffffffffc, 0xffffffffffffffff
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1a0c], eax
mov ecx, dword [ebp - 0x768]
mov edx, dword [ebp - 0x338]
add edx, dword [ecx + 0x1c]
invalid
xchg ebp, eax
invalid
Function at 0x1003a2c7
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x64
mov word [ebp - 0x177a], cx
mov edx, 0x6c
mov word [ebp - 0x1778], dx
mov eax, 0x6c
mov word [ebp - 0x1776], ax
xor ecx, ecx
mov word [ebp - 0x1774], cx
push edi
sub edi, 0xbb17
pop edi
push ecx
jmp 0x1003a2b1
xor ecx, 0x16922
call 0x1003a2c7
add byte [ecx + edi], dh
dec esi
inc esp
xor dh, byte [esi]
inc esi
dec esi
inc esp
inc eax
add esp, 4
sub ecx, 0x32e1
pop ecx
mov byte [ebp - 0x8a8], 0x4c
mov byte [ebp - 0x8a7], 0x6f
mov byte [ebp - 0x8a6], 0x61
mov byte [ebp - 0x8a5], 0x64
mov byte [ebp - 0x8a4], 0x4c
mov byte [ebp - 0x8a3], 0x69
mov byte [ebp - 0x8a2], 0x62
mov byte [ebp - 0x8a1], 0x72
mov byte [ebp - 0x8a0], 0x61
mov byte [ebp - 0x89f], 0x72
mov byte [ebp - 0x89e], 0x79
mov byte [ebp - 0x89d], 0x57
mov byte [ebp - 0x89c], 0
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1a24], edx
mov eax, dword [ebp - 0x1a24]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1a28], ecx
mov edx, dword [ebp - 0x1a28]
mov dword [ebp - 0x1630], edx
shr cl, 1
invalid
call dword [eax + 0x51]
add esp, 4
sub eax, 0xfcbd
pop eax
push ecx
and ecx, 0x16fce
pop ecx
push ebx
or ebx, 0x184c8
pop ebx
push esi
push edi
add esp, 4
jmp 0x1003a37d
pop esi
push esi
or esi, 0x739e
pop esi
cmp dword [ebp - 0x1630], 0
jne 0x1003a39e
mov dword [ebp - 0x778], 0
jmp 0x1003a645
mov eax, dword [ebp - 0x1630]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xce4], edx
push edx
push ebx
add esp, 4
add edx, 0xc8df
sub edx, 0x6632
add edx, 0x8b35
xor edx, 0x2376
pop edx
push esi
push ecx
add esp, 4
add esi, 0x5cea
pop esi
push eax
jmp 0x1003a3e1
pop eax
cmp dword [ebp - 0xce4], 0
jne 0x1003a3fa
mov dword [ebp - 0x778], 0
jmp 0x1003a645
mov eax, dword [ebp - 0xce4]
mov dword [ebp - 0x514], eax
Function at 0x1003a490
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp eax, 0x8b5e0000
test dword [ebx + esi*8], esp
invalid

Function at 0x1003a4d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec dword [ebx - 0xcdf7b]
inc dword [ebx - 0x7a76fd40]
and bl, dh
invalid

Function at 0x1003a510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push edi
add esp, 4
sub edi, 0x13337
pop edi
push edi
push edx
add esp, 4
jmp 0x1003a47b
pop edi
push esi
push ecx
add esp, 4
and esi, 0x30f5
sub esi, 0x1213d
or esi, 0x3d13
cmp eax, 0x8b5e0000
test dword [ebx + esi*8], esp
invalid
jmp dword [esi - 0x75]
or byte [esi - 0x77], ah
lea ebp, [edx - 0x74000011]
xchg ebp, eax
and al, 0xf3
invalid
inc dword [ebx - 0x6a76fd3e]
and al, 0xf3
invalid
invalid
jmp dword [esi - 0x75]
test dword [edx + 0x66ffffef], ebp
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0xce0]
mov dx, word [ecx]
mov word [ebp - 0x1058], dx
dec dword [ebx - 0xcdf7b]
inc dword [ebx - 0x7a76fd40]
and bl, dh
invalid
jmp dword [esi - 0x75]
lea ebp, [eax + 0x66ffffef]
mov dword [ebp - 0x50], ecx
push edi
and edi, 0x11153
add dword [eax], eax
pop edi
push esi
and esi, 0x182be
add esi, 0x11f8
call fcn.1003a510
add byte [ebx + eax*2], dh
dec edi
dec esp
push eax
dec ebp
inc edi
inc ebx
add esp, 4
jmp 0x1003a51c
pop esi
movzx edx, word [ebp - 0x50]
test edx, edx
jne 0x1003a53a
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
movzx edx, word [ebp - 0x23c]
movzx eax, word [ebp - 0x50]
cmp edx, eax
je 0x1003a462
movzx ecx, word [ebp - 0x23c]
xor ecx, 0x20
movzx edx, word [ebp - 0x50]
cmp ecx, edx
je 0x1003a462
movzx eax, word [ebp - 0x23c]
movzx ecx, word [ebp - 0x50]
cmp eax, ecx
jge 0x1003a57e
mov dword [ebp - 0x1634], 0xffffffff
jmp 0x1003a588
mov dword [ebp - 0x1634], 1
mov edx, dword [ebp - 0x1634]
mov dword [ebp - 0x1638], edx
Function at 0x1003c230
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
mov word [bp - 0xf63], es
add byte [eax], al
mov al, byte [bp - 0x5b]
push edi
push edi
test ch, al
add eax, 0x9ff3e782
add dword [ecx], eax
xor bh, 0xdc
daa
add al, byte [ecx]
add bh, 0xfc
rol byte [ecx], 1
pop edi
push edi
add bh, 0xb6
xchg edx, eax
add dword [ecx], eax
or bh, 0xef
dec ebx
add al, byte [ecx]
sub bh, 0x77
fiadd dword [ecx]
add dword [edx + 0x27f3bf7], eax
add dword [edi + 0x10], ebx
mov eax, 0xca86a54e
jbe 0x1003c28e
adc byte [eax + 0xfeb996], bh
add byte [eax], dl
mov eax, 0xd12ca546
mov dl, byte [esi + 0xea45]
in al, dx
pop ebx
adc byte [eax + 0xfeb98e], bh
mov eax, 0xfeb98e
add byte [eax], dl
mov eax, 0xcb3ca556
adc byte [ebp + 0x16], al
adc byte [eax + 0xfeb986], bh
add byte [ecx + esi*8 + 0x4eb81021], al
movsd dword es:[edi], dword [esi]
cmp al, 0xc2
adc byte [ebp + 0xff00], al
adc byte [eax + 0xfeb996], bh
add byte [eax], dl
mov eax, 0xd13ca546
movsd dword es:[edi], dword [esi]
cmp al, 0xd1
jle 0x1003c2d2
enter 0x4986, 0xffffffffffffffea
add byte [eax], al
add byte [eax], al
add byte [eax], al
in al, dx
or ecx, eax
xchg byte [ecx - 0x16], cl
add byte [eax], al
add al, byte [ecx]
add dword [ecx], eax
mov word [esi + 0xea49], cs
add byte [edx + 0xea458e], cl
add byte [esi + edi*4 + 0xea45], al
add dword [esi + 0x41], esi
push edi
pop eax
test ch, al
add eax, 0x75a0ef82
add al, byte [ecx]
pop edi
pop eax
cmp al, 0xd9
sbb dword [edx], eax
add dword [edx + 0x219e7c8], eax
add ecx, ebp
or eax, dword [ecx]
add dword [ecx], eax
add dword [esi + 0x35], ecx
dec ebp
dec esp
inc esp
aaa
cmp dword ds:[ebp - 0x7c], ecx
lds eax, [0x9fdbf082]
invalid
Function at 0x100d04c0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x101313ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x28]
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 8], eax
mov dword [esi], vtable.Module_Info.0
mov dword [esi + 4], ebp
mov eax, dword [ecx]
sub eax, 0x10
push edi
push eax
mov dword [esp + 0x14], esi
call fcn.10002370
add eax, 0x10
add esp, 4
mov dword [esi + 0xc], eax
xor ebx, ebx
mov dword [esp + 0x1c], ebx
call fcn.10111836
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
sub eax, 0x10
push eax
mov byte [esp + 0x20], 1
call fcn.10002370
add eax, 0x10
add esp, 4
mov dword [esi + 0x14], eax
lea edi, [esi + 0x18]
mov dword [edi], vtable.CArray_class_InterfaceObject__class_InterfaceObject__.0
mov dword [edi + 4], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], ebx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x44]
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0x3c]
or ecx, 0x1000
cmp ebp, ebx
mov byte [esp + 0x1c], 3
mov dword [esi + 0x30], edx
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], ecx
jne 0x100d0588
mov dword [esi + 4], 0x1008b660
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
mov ebp, eax
cmp ebp, ebx
je 0x100d05a7
mov eax, dword [ebp]
push edi
mov ecx, ebp
call dword [eax + 0x30]
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx]
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x24
Function at 0x100d09b0
Capabilities:
Get process heap flags
Get process heap force flags
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1013144e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 7
lea edi, [esi + 0x18]
push str.default
mov ecx, edi
call fcn.10002830
push 1
lea ecx, [esi + 0x14]
push 0x101456f4
call fcn.10002830
push 0xa
lea ebp, [esi + 0x24]
push str.Wave_Files
mov ecx, ebp
call fcn.10002830
push 3
lea ecx, [esi + 0x20]
push 0x10147e8c
call fcn.10002830
push 0xf
lea ebx, [esi + 0x30]
push str.SynthEdit_Files
mov ecx, ebx
call fcn.10002830
push 3
add edi, 0x14
push 0x10155bd8
mov ecx, edi
call fcn.10002830
push 0xa
lea edi, [esi + 0x3c]
push str.MIDI_Files
mov ecx, edi
call fcn.10002830
push 3
add ebp, 0x14
push 0x1014c948
mov ecx, ebp
call fcn.10002830
push 0xf
lea ebp, [esi + 0x48]
push str.SoundFont_Files
mov ecx, ebp
call fcn.10002830
push 3
add ebx, 0x14
push 0x10144554
mov ecx, ebx
call fcn.10002830
push 6
lea ebx, [esi + 0x54]
push str.Plugin
mov ecx, ebx
call fcn.10002830
push 3
add edi, 0x14
push 0x10144fec
mov ecx, edi
call fcn.10002830
push 8
lea edi, [esi + 0x60]
push str.VST_Bank
mov ecx, edi
call fcn.10002830
push 3
add ebp, 0x14
push 0x10145074
mov ecx, ebp
call fcn.10002830
push 8
lea ebp, [esi + 0x6c]
push str.VST_Inst
mov ecx, ebp
call fcn.10002830
push 3
add ebx, 0x14
push 0x10145070
mov ecx, ebx
call fcn.10002830
push 0xb
lea ebx, [esi + 0x78]
push str.Image_Files
mov ecx, ebx
call fcn.10002830
push 3
add edi, 0x14
push 0x101476cc
mov ecx, edi
call fcn.10002830
push 0xb
lea ecx, [esi + 0x84]
push str.Image_Files
call fcn.10002830
push 3
add ebp, 0x14
push 0x1014c9b4
mov ecx, ebp
call fcn.10002830
push 0x10
lea ecx, [esi + 0x90]
push str.Embeddable_Files
call fcn.10002830
push 1
lea ecx, [ebx + 0x14]
push 0x101456f4
call fcn.10002830
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.10002370
lea ebx, [eax + 0x10]
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], 0
lea edi, [esi + 0x1c]
mov ebp, 0xc
lea ecx, [edi - 8]
push ecx
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.100d0600
push eax
mov ecx, edi
mov byte [esp + 0x20], 1
call fcn.10002a30
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x1c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100d0ba7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add edi, 0xc
dec ebp
jne 0x100d0b67
add ebx, 0xfffffff0
mov dword [esp + 0x1c], 0xffffffff
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x100d0bcf
mov ecx, dword [ebx]
mov edx, dword [ecx]
push ebx
call dword [edx + 4]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x100e2be7
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
mov esi, pe_nt_image_headers32
cmp dword [esp + 0x10], esi
jae 0x100e2c0b
push eax
call fcn.100e69e9
push 2
call fcn.100e69d8
pop ecx
pop ecx
mov dword [edi], eax
push esi
push 0
push eax
call fcn.100f9e80
add esp, 0xc
pop edi
pop esi
ret

Function at 0x100e51aa
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
push 1
call fcn.100e68b4
mov esi, eax
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x100e51fe
push esi
call fcn.100e3035
push ebx
push esi
call fcn.100f91f4
add esp, 0xc
test eax, eax
je 0x100e5205
mov edi, dword [ebp - 8]
lea esi, [edi + 0xac]
push dword [esi]
push edi
call fcn.100e6a4e
push edi
mov dword [esi], ebx
call fcn.100e69e9
add esp, 0xc
xor eax, eax
jmp 0x100e5307
push dword [ebp + 0x20]
mov esi, dword [ebp - 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
call fcn.100e69b5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.100e6782
mov ecx, dword [ebp + 8]
mov edi, str.1.2.5
mov dword [ebp - 4], ecx
add esp, 0x20
sub dword [ebp - 4], edi
mov eax, edi
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax]
cmp dl, byte [eax]
je 0x100e5247
or byte [esi + 0x6e], 2
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100e5239
test byte [esi + 0x6e], 2
je 0x100e52c5
cmp ecx, ebx
je 0x100e529b
mov al, byte [ecx]
cmp al, byte [str.1.2.5]
jne 0x100e527b
cmp al, 0x31
jne 0x100e5271
mov dl, byte [ecx + 2]
cmp dl, byte [0x101580de]
jne 0x100e527b
cmp al, 0x30
jne 0x100e52c5
cmp byte [ecx + 2], 0x39
jge 0x100e52c5
cmp ecx, ebx
je 0x100e529b
push ecx
lea eax, [ebp - 0x58]
push str.Application_was_compiled_with_png.h_from_libpng__.20s
push eax
call fcn.100f70a2
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.100e6828
add esp, 0x14
push edi
lea eax, [ebp - 0x58]
push str.Application__is__running_with_png.c_from_libpng__.20s
push eax
call fcn.100f70a2
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.100e6828
push str.Incompatible_libpng_version_in_application_and_library
push esi
mov dword [esi + 0x6c], ebx
call fcn.100e679c
add esp, 0x1c
mov eax, 0x2000
push eax
push esi
mov dword [esi + 0xb0], eax
call fcn.100e69fa
push ebx
push ebx
push ebx
push esi
mov dword [esi + 0xac], eax
call fcn.100e65b9
push ebx
push ebx
push 1
push ebx
push esi
call fcn.100e4f96
push ebx
push esi
call fcn.100f91f4
add esp, 0x34
test eax, eax
je 0x100e5304
jmp 0x100f9ee0
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100e6a9d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x100e6aab
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x100e6b7f
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x10158c60]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x10158c60]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x10158c60]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x10158c60]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x10158c60]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x10158c60]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x10158c60]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x10158c60]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x100e6ac8
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x100e6b9f
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x10158c60]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x100e6b85
mov eax, esi
not eax
pop esi
pop ebp
ret