joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000eaa0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10084a98
push 0x1004c110
mov eax, dword fs:[0]
push eax
add esp, 0xffffffb8
mov eax, dword [0x1008a020]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
push 0x1007c41c
jmp fcn.103e4fe6

Function at 0x10010a60
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069100
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1008a020]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x1007c87c
jmp loc.10302382

Function at 0x10011540
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069308
mov eax, dword fs:[0]
push eax
sub esp, 0x1ec
mov eax, dword [0x1008a020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1007caf0
jmp loc.103501c6

Function at 0x100119a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100693a8
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x1008a020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1007cb64
jmp loc.102ab6ef

Function at 0x10027910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1008a020]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x49
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x66
mov byte [ebp - 8], 0x61
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.100147c0
push eax
push ebp
call fcn.102e1292
push eax
call fcn.101ec3cb
Function at 0x10028180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006aca5
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x1008a020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov byte [ebp - 0x30], 0x56
mov byte [ebp - 0x2f], 0x45
mov byte [ebp - 0x2e], 0x6e
mov byte [ebp - 0x2d], 0x67
mov byte [ebp - 0x2c], 0x69
mov byte [ebp - 0x2b], 0x6e
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x43
mov byte [ebp - 0x28], 0x6c
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], 0x65
mov byte [ebp - 0x25], 0x6e
mov byte [ebp - 0x24], 0x74
mov byte [ebp - 0x23], 0x30
mov byte [ebp - 0x22], 0x31
mov byte [ebp - 0x21], 0x34
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x67
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x2e
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0x6c
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x30]
push edx
lea ecx, [ebp - 0x60]
call fcn.10014a60
mov dword [ebp - 4], 0
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x1c]
push edx
lea ecx, [ebp - 0x48]
call fcn.10014a60
mov byte [ebp - 4], 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x64]
call fcn.10028370
mov dword [0x1018e590], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.100148e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.100148e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10035189
mov esp, ebp
pop ebp
ret

Function at 0x10028370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1008a020]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x49
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x66
mov byte [ebp - 8], 0x61
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0
mov eax, 1
imul ecx, eax, 0
lea edx, [ebp + ecx - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.100147c0
push eax
push edi
call fcn.101cbca0
push eax
push edx
call fcn.1043e433
mov dword [ebp - 0x18], eax
push 0
mov ecx, dword [ebp + 0xc]
call fcn.100147c0
push eax
call dword [ebp - 0x18]
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10035189
mov esp, ebp
pop ebp
ret 8

Function at 0x10028410
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100284d2
cmp dword [ebp - 4], 1
je 0x1002842f
jmp 0x1002857c
push 0x1007d878
jmp fcn.1025d53f
push 0x1007d8c0
jmp fcn.101d3e32
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10033010
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 4]
call eax
movzx ecx, al
test ecx, ecx
je 0x1003303c
mov ecx, dword [ebp - 4]
call fcn.10033120
movzx edx, al
test edx, edx
je 0x10033040
xor al, al
jmp 0x10033090
mov eax, dword [ebp - 4]
mov byte [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], 0
mov edx, dword [ebp - 4]
add edx, 4
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x10033160
mov ecx, dword [ebp + 8]
push ecx
push 0
call fcn.10050446
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
je 0x10033086
mov dword [ebp - 8], 1
jmp 0x1003308d
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x10196a60
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10196b6c
test eax, eax
je 0x10196b6c
push esi
push edi
mov ecx, 0x10
mov esi, 0x101b1f58
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x10196b53
lea edi, [eax + 4]
jmp 0x10196ab7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10196acc
mov dword [ebp - 4], 2
jmp 0x10196aed
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10196ae3
mov dword [ebp - 4], 1
jmp 0x10196aed
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10196b63
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10196b26
mov byte [ecx], 0x3d
jmp 0x10196b32
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x10196b3d
mov byte [ecx], 0x3d
jmp 0x10196b43
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10196ab4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10196aa7
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10196b6c
test eax, eax
je 0x10196b6c
push esi
push edi
mov ecx, 0x10
mov esi, 0x101b1f58
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x10196b53
lea edi, [eax + 4]
jmp 0x10196ab7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10196acc
mov dword [ebp - 4], 2
jmp 0x10196aed
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10196ae3
mov dword [ebp - 4], 1
jmp 0x10196aed
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10196b63
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10196b26
mov byte [ecx], 0x3d
jmp 0x10196b32
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x10196b3d
mov byte [ecx], 0x3d
jmp 0x10196b43
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10196ab4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a3cc
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40a3ea
mov eax, 0x4da46c
push eax
push 1
mov ebx, 0x415820
call fcn.00415379
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40a414
mov eax, 0
jmp 0x40a488
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x40a475
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40a45e
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40a44d
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40a43e
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x40a586
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40a5a9
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x40a5a9
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40a5b3
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x40a5f5
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40a657
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40a652
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40a63d
test dl, dl
je 0x40a639
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40a63d
add ecx, 2
add eax, 2
test dl, dl
jne 0x40a61d
xor eax, eax
jmp 0x40a642
sbb eax, eax
or eax, 1
test eax, eax
je 0x40a663
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x40a60a
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x40a6e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40a70b
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x40a70b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40a715
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x40a757
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40a7b9
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40a7b4
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40a79f
test dl, dl
je 0x40a79b
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40a79f
add ecx, 2
add eax, 2
test dl, dl
jne 0x40a77f
xor eax, eax
jmp 0x40a7a4
sbb eax, eax
or eax, 1
test eax, eax
je 0x40a7c5
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x40a76c
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x40a857
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40a87a
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x40a87a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40a884
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x40a8c6
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40a928
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40a923
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40a90e
test dl, dl
je 0x40a90a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40a90e
add ecx, 2
add eax, 2
test dl, dl
jne 0x40a8ee
xor eax, eax
jmp 0x40a913
sbb eax, eax
or eax, 1
test eax, eax
je 0x40a934
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x40a8db
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x40a9c1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40a9e4
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x40a9e4
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40a9ee
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x40aa30
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40aa92
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40aa8d
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40aa78
test dl, dl
je 0x40aa74
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40aa78
add ecx, 2
add eax, 2
test dl, dl
jne 0x40aa58
xor eax, eax
jmp 0x40aa7d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40aa9e
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x40aa45
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x40ab37
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40ab5a
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x40ab5a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40ab64
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x40aba6
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40ac08
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40ac03
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40abee
test dl, dl
je 0x40abea
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40abee
add ecx, 2
add eax, 2
test dl, dl
jne 0x40abce
xor eax, eax
jmp 0x40abf3
sbb eax, eax
or eax, 1
test eax, eax
je 0x40ac14
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x40abbb
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x40aca8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40accb
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x40accb
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40acd5
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x40ad17
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40ad79
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40ad74
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40ad5f
test dl, dl
je 0x40ad5b
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40ad5f
add ecx, 2
add eax, 2
test dl, dl
jne 0x40ad3f
xor eax, eax
jmp 0x40ad64
sbb eax, eax
or eax, 1
test eax, eax
je 0x40ad85
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x40ad2c
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x40ae17
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40ae3a
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x40ae3a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40ae44
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x40ae86
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40aee8
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40aee3
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40aece
test dl, dl
je 0x40aeca
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40aece
add ecx, 2
add eax, 2
test dl, dl
jne 0x40aeae
xor eax, eax
jmp 0x40aed3
sbb eax, eax
or eax, 1
test eax, eax
je 0x40aef4
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x40ae9b
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8