joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000192d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
leave
ret

Function at 0x100026f1
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
movzx eax, byte [eax + 2]
leave
ret

Function at 0x10008c37
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push ebp
mov ebp, esp
jmp 0x10008c50
nop
cld
xor edx, edx
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x10008c6f
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x10008c66
cmp edi, 0x6a4abc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x10008c5e
mov eax, ebx
leave
ret

Function at 0x10008cb1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 4
mov esp, ebp
pop ebp
jmp 0x10008cd3
nop
pop edx
pop eax
pop ecx
push edx
pushal
mov ebx, eax
mov edi, ecx
xor al, al
scasb al, byte es:[edi]
jne 0x10008cdf
dec edi
sub edi, ecx
xchg ecx, edi
mov eax, dword [ebx + 0x3c]
mov esi, dword [ebx + eax + 0x78]
lea esi, [esi + ebx + 0x18]
lodsd eax, dword [esi]
xchg edx, eax
lodsd eax, dword [esi]
push eax
lodsd eax, dword [esi]
xchg ebp, eax
lodsd eax, dword [esi]
xchg ebp, eax
add eax, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ecx
dec edx
je 0x10008d2e
mov esi, dword [eax + edx*4]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
je 0x10008d1a
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
jmp 0x10008d04
shl edx, 1
add ebp, edx
movzx eax, word [ebp + ebx]
shl eax, 2
add eax, dword [esp]
mov eax, dword [ebx + eax]
add eax, ebx
pop ecx
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x10009d25
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push 8
call fcn.1007a138
add esp, 4
mov dword [ebp - 0x2c], eax
mov edi, eax
mov esi, 0x10110831
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
jmp 0x10009db4
jmp loc.101e9aed
Function at 0x1000d5d3
Capabilities:
Packed with generic packer

Disassembly:
daa
retf
xchg ebx, eax
aad 0
adc ah, ah
mov byte [ebx], ch
inc edx
std
daa
cmp al, 0xec
and byte [eax], bl
jne 0x1000d5a0
xchg byte [eax + 0x4c1ecb0f], al
lea esp, [esp + 4]
jmp 0x1000d60e
jbe 0x1000d607
add bl, dh
push 0xffffffffffffff85
xor al, 0x27
dec esi
call fcn.1000d5d3
cmp ecx, esp
inc ebp
or byte [esp + edi], ch
loope 0x1000d5bc
jge 0x1000d674
adc al, 0xf8
and dword [esi], esp
salc
add byte [eax], dl
in al, 0x41
ret
push ds
adc al, ch
push eax
scasd eax, dword es:[edi]
sbb al, 0
push 0x101e646d
call fcn.101d855e
cmp dword [ebp + 0x59], edi
clc
and dword [ebp - 0x1befff2a], edx
dec ecx
call 0xda3a7833
daa
pop esp
sub al, 0x12
in al, dx
jge 0x1000d5e0
js 0x1000d635
add byte [esi + esi*4], bh
adc bh, byte [esi + ebx + 0xf]
xchg byte [eax], bl
jne 0x1000d668
jl 0x1000d655
jbe 0x902d4b55
adc byte [edi - 0x1654952d], 0xd
jbe 0x1000d66a
xchg edi, eax
shr dword [edx - 0x55], cl
jmp 0x10264c53
add ch, dl
rep movsb byte es:[edi], byte [esi]
jmp 0x10265260
mov cl, 0x78
or byte [eax], al
cmp al, 0x69
adc dh, byte [ebp - 0x10]
jbe 0x902da17c
xchg edi, eax
ror dword [ebx + ebp*8 + 0x7c], cl
cmp esp, ebp
jl 0x1000d6a3
in al, dx
jge 0x1000d6c6
inc esp
mov fs, word [edi]
mov dl, 0xb2
clc
and eax, esi
salc
add byte [eax], dl
in al, 0xca
xchg esp, eax
pop es
cmp dword [eax + eax*4], ebp
xchg edi, eax
shr edx, cl
rep movsb byte es:[edi], byte [esi]
jmp 0x1026600b
invalid
sbb esp, dword [edi]
inc ebp
pop es
cmp al, 0x92
jge 0x1000d6f1
or al, 0x2c
cmp al, 0xb2
invalid
xchg byte [eax], bl
and al, bh
and dword [ebp - 0x2a], edi
add byte [eax], dl
in al, 0xdd
sub al, 0x3f
push es
mov byte [esp], dl
lea esp, [esp + 4]
push 0x101e6510
call fcn.101d855e
push ecx
lea esp, [esp + 4]
jmp 0x101ff6c4
and dword [ecx], eax
add eax, dword [eax]
add byte [ebp], 0xf8
and dword [edx], ebp
xlatb
add byte [eax], dl
in al, 0xae
mov ecx, 0xffcde898
invalid
int 0xff
invalid
Function at 0x10012ff3
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
in al, 0x5b
mov dl, byte [ecx]
and dword [edi], 0x597d187c
in al, 0xf3
nop
jmp loc.102f1780
push ax
call fcn.10012d1b
daa
cmp al, 0x39
and byte [eax], bl
jne 0x10012f5d
xchg edi, eax
or byte [edi], 0x66
and dword [eax - 0x1beffed1], edi
xchg ebp, eax
add al, 0xb7
sahf
push 0x10012f41
call fcn.101d855e
daa
or ecx, dword [esi - 0x496dbbbd]
pop ecx
loope 0x10013029
mov dl, 0x66
and dword [ecx - 0x1befdf44], esi
push ebx
retf 0x9465
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x10013013
jmp 0x10012f7b
adc ah, ah
or al, 0x9f
out 0x39, al
inc ebp
add al, 0xb1
clc
and dword [esi - 0x31], ecx
and byte [eax], dl
in al, 0x68
mov esp, dword [edx]
pop ebp
cmp dword [ebp - 8], edi
and dword [edi + 0x33], ebp
add dword [eax], edx
in al, 0x8d
sbb al, 0x6f
jbe 0x10013084
inc ebp
sar al, 0x21
fcmove st(0), st(5)
and byte [eax], dl
in al, 0xe2
sbb eax, 0x1e5c396c
and dword [esi + edi + 0x18], ebp
adc al, bh
cmp al, 0x43
clc
and dword [ecx - 0x31], esi
and byte [eax], dl
in al, 0x76
popal
mov al, byte [0xc44539e3]
clc
and dword [edi], eax
iretd
dec cl
push 0x2157
add byte [eax], al
xchg edi, eax
and dword [edi], ebx
shl byte [eax], 1
adc ah, ah
imul edi, dword [ecx], 0x1821f8f0
xor al, byte [ecx]
adc ah, ah
loop 0x100130bd
insb byte es:[edi], dx
jg 0x100130fa
and dword [eax], eax
add byte [eax], al
add byte [ebp - 0xc], al
sbb byte [edx + esi*4], bh
xchg edi, eax
and dword [ebx], esi
shl dword [eax], cl
adc ah, ah
stosb byte es:[edi], al
lds esi, [edi + 0x57]
and dword [eax], eax
add byte [eax], al
add byte [edi + 0x20d16421], dl
adc ah, ah
push edi
and dword [eax], eax
add byte [eax], al
add byte [ebp - 0xc], al
sbb byte [ebx + eax*2], bh
xchg edi, eax
and dword [edx], edi
aam 0x20
adc ah, ah
fidiv dword [0x21575724]
add byte [eax], al
add byte [eax], al
xchg edi, eax
and dword [edi], ecx
shl dword [eax], 1
adc ah, ah
push edi
and dword [eax], eax
add byte [eax], al
add byte [ebp - 0xc], al
sbb byte [edi], bh
xchg edi, eax
and dword [edi - 0x1befdf2b], edi
jbe 0x1001315d
mov al, byte [0x2157e3]
add byte [eax], al
add byte [ebp - 0xc], al
xchg edi, eax
and dword [esi - 0x1befdf2c], edx
iretd
invalid

Function at 0x100260cd
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 8]
call fcn.1002603a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100260f5
mov eax, 0
jmp 0x1002615a
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x1002614c
add eax, 8
mov ebx, eax
mov esi, eax
mov edi, dword [ebp + 8]
mov edi, dword [edi]
mov edi, dword [edi + 4]
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
mov al, byte [esi]
inc esi
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x10026135
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x10026124
xor ecx, eax
xor edx, ebx
dec edi
jne 0x10026113
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
leave
ret 4
mov esp, ebp
pop ebp
ret 4

Function at 0x10026393
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], bh
lea esp, [esp + 4]
jmp fcn.1025cc36
Function at 0x100374e7
Capabilities:
Contain obfuscated stackstrings
Decode data using base64 via vbmi lookup table
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x98]
push esi
xor ecx, ecx
xor esi, esi
xor edx, edx
push edi
mov dword [esp + 0xc], 0x7f7f7f7f
mov dword [esp + 0x10], 0x7f7f7f7f
mov dword [esp + 0x14], 0x7f7f7f7f
mov dword [esp + 0x18], 0x7f7f7f7f
mov dword [esp + 0x1c], 0x7f7f7f7f
mov dword [esp + 0x20], 0x7f7f7f7f
mov dword [esp + 0x24], 0x7f7f7f7f
mov dword [esp + 0x28], 0x7f7f7f7f
mov dword [esp + 0x2c], 0x7f7f7f7f
mov dword [esp + 0x30], 0x7f7f7f7f
mov dword [esp + 0x34], 0x3e7f7f7f
mov dword [esp + 0x38], 0x3f7f7f7f
mov dword [esp + 0x3c], 0x37363534
mov dword [esp + 0x40], 0x3b3a3938
mov dword [esp + 0x44], 0x7f7f3d3c
mov dword [esp + 0x48], 0x7f7f407f
mov dword [esp + 0x4c], 0x201007f
mov dword [esp + 0x50], 0x6050403
mov dword [esp + 0x54], 0xa090807
mov dword [esp + 0x58], 0xe0d0c0b
mov dword [esp + 0x5c], 0x1211100f
mov dword [esp + 0x60], 0x16151413
mov dword [esp + 0x64], 0x7f191817
mov dword [esp + 0x68], 0x7f7f7f7f
mov dword [esp + 0x6c], 0x1c1b1a7f
mov dword [esp + 0x70], 0x201f1e1d
mov dword [esp + 0x74], 0x24232221
mov dword [esp + 0x78], 0x28272625
mov dword [esp + 0x7c], 0x2c2b2a29
mov dword [esp + 0x80], 0x302f2e2d
mov dword [esp + 0x84], 0x7f333231
mov dword [esp + 0x88], 0x7f7f7f7f
test ebx, ebx
je 0x10037734
mov edi, dword [esp + 0x9c]
mov edi, edi
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x10037631
cmp byte [edx + edi], 0xd
jne 0x10037631
cmp byte [edx + edi + 1], 0xa
je 0x1003766a
mov al, byte [edx + edi]
cmp al, 0xa
je 0x1003766a
cmp al, 0x3d
jne 0x10037646
inc ecx
cmp ecx, 2
ja 0x10037742
cmp al, 0x7f
ja 0x10037742
movzx eax, al
mov al, byte [esp + eax + 0xc]
cmp al, 0x7f
je 0x10037742
cmp al, 0x40
jae 0x10037669
test ecx, ecx
jne 0x10037742
inc esi
inc edx
cmp edx, ebx
jb 0x1003761b
test esi, esi
je 0x10037734
mov ecx, dword [esp + 0x98]
lea eax, [esi + esi*2]
mov esi, dword [esp + 0x94]
lea eax, [eax*2 + 7]
shr eax, 3
test esi, esi
je 0x10037753
cmp dword [ecx], eax
jb 0x10037753
xor eax, eax
xor ebx, ebx
push ebp
mov ebp, 3
mov dword [esp + 0x90], eax
test edx, edx
je 0x10037723
lea esp, [esp]
mov al, byte [edi]
cmp al, 0xd
je 0x1003771f
cmp al, 0xa
je 0x1003771f
movzx eax, al
mov cl, byte [esp + eax + 0x10]
xor eax, eax
cmp cl, 0x40
sete al
shl ebx, 6
sub ebp, eax
movzx eax, cl
mov ecx, dword [esp + 0x90]
and eax, 0x3f
inc ecx
or ebx, eax
mov dword [esp + 0x90], ecx
cmp ecx, 4
jne 0x1003771f
xor eax, eax
mov dword [esp + 0x90], eax
test ebp, ebp
je 0x1003770a
mov eax, ebx
shr eax, 0x10
mov byte [esi], al
inc esi
cmp ebp, 1
jbe 0x10037717
mov eax, ebx
shr eax, 8
mov byte [esi], al
inc esi
cmp ebp, 2
jbe 0x1003771f
mov byte [esi], bl
inc esi
inc edi
dec edx
jne 0x100376bb
sub esi, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
pop ebp
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0x84
ret 0x10
pop edi
pop esi
mov dword [ecx], eax
or eax, 0xffffffff
pop ebx
add esp, 0x84
ret 0x10
Function at 0x10042cb1
Capabilities:
Encode data using xor

Disassembly:
pushal
pop dword [esp + 0xa]
lea esp, [esp + 0x20]
jmp fcn.102ad552
jmp 0x10042c29

Function at 0x100469b2
Capabilities:
Packed with generic packer

Disassembly:
pushal
not ax
jmp 0x1004698c
mov dl, 0x3f
mov edi, dword [esp]
popal
push esp
lea esp, [esp]
push esp
jmp fcn.102bcc06
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
jmp 0x100469d9
jmp 0x10046982

Function at 0x10047cfc
Capabilities:
Packed with generic packer

Disassembly:
pushal
popal
push sp
push dx
jmp 0x10047b41
lea esp, [esp + 4]
jmp int.102c9248
push ebp
mov ebp, esp
sub esp, 0xa0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x10047d31
jmp 0x10047abe

Function at 0x10047fe3
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
jmp loc.101e7d1b
push word [esp]
push word [esp + 2]
jmp 0x10047f86

Function at 0x1004bf60
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
jmp loc.102d6f18

Function at 0x1004df93
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp loc.101e81e1

Function at 0x1004e00a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 4]
mov eax, dword [0x10184318]
mov dword [ebp - 0x18], eax
jmp 0x1004dff4
mov dword [ebp - 0x1c], 0x235c
jmp 0x1004e02e
push word [esp]
xchg byte [esp + 4], ah
jmp 0x1004dfde
push ecx
call fcn.1004e014
lea esp, [esp + 4]
mov ecx, dword [ebp - 8]
mov ax, word [esp]
bswap eax
jmp 0x1004e091
mov ecx, dword [ecx]
push eax
lea esp, [esp + 4]
mov eax, dword [ebp - 0xc]
jmp 0x1004e07b

Function at 0x1004e014
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
push edx
jmp 0x1004e04a
fld dword [ebp - 4]
not cx
mov ecx, dword [esp]
not ah
pushfd
jmp 0x1004e034

Function at 0x1004e100
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1004df93
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x1004e143
jmp 0x1004dfd9

Function at 0x1005076b
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp loc.102ec42c
pushfd
jmp 0x100505de
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
jmp 0x10050784
jmp 0x1005060a

Function at 0x10051149
Capabilities:
Packed with generic packer

Disassembly:
call fcn.10051036
pop ecx
mov ds, ebx
and dword [esp + ecx*8 + 0x2e], esi
adc byte [eax], bl
cmp al, 0x8e
sbb byte [ecx], ah
popal
invalid
push ebp
mov ebp, esp
sub esp, 4
jmp 0x1005115b
jmp 0x100510fe
Function at 0x10054743
Capabilities:
Packed with generic packer

Disassembly:
call fcn.101ddfb7
mov dword [ebp - 4], eax
call 0x10054743
imul esp, dword [esi - 1], 0x8d602434
and al, 2
jmp 0x10054787
push dword [ebp - 4]
jmp 0x1005492b
lea esp, [esp + 0x24]
push 0xb1c0
pushal
lea esp, [esp + 0x20]
jmp 0x10054771
inc ecx
mov eax, dword [ebp - 8]
mov cl, ah
xor ecx, ecx
jmp fcn.100546c7
call fcn.101ddfea
neg cl
rol cx, cl
mov dword [ebp - 0xc], eax
jmp 0x10054797
push ax
lea esp, [esp + 2]
push 0xaa0
push dword [ebp - 4]
jmp 0x100547b8
call fcn.101ddfe8
stc
mov dword [ebp - 8], eax
stc
jmp 0x100547f3

Function at 0x1005e29c
Capabilities:
Packed with generic packer

Disassembly:
mov ebx, 0x451ea95d
popal
call fcn.1005e220
insb byte es:[edi], dx
pushal
jmp 0x1005e214
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x1005e2bc
jmp 0x1005e23a
Function at 0x1006757c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x1006759f
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x1006759f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100675a9
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100675eb
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1006764d
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10067648
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10067633
test dl, dl
je 0x1006762f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10067633
add ecx, 2
add eax, 2
test dl, dl
jne 0x10067613
xor eax, eax
jmp 0x10067638
sbb eax, eax
or eax, 1
test eax, eax
je 0x10067659
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10067600
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100676de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10067701
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10067701
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x1006770b
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x1006774d
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100677af
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100677aa
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10067795
test dl, dl
je 0x10067791
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10067795
add ecx, 2
add eax, 2
test dl, dl
jne 0x10067775
xor eax, eax
jmp 0x1006779a
sbb eax, eax
or eax, 1
test eax, eax
je 0x100677bb
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10067762
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x1006784d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10067870
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10067870
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x1006787a
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100678bc
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1006791e
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10067919
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10067904
test dl, dl
je 0x10067900
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10067904
add ecx, 2
add eax, 2
test dl, dl
jne 0x100678e4
xor eax, eax
jmp 0x10067909
sbb eax, eax
or eax, 1
test eax, eax
je 0x1006792a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100678d1
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100679b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100679da
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100679da
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100679e4
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10067a26
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10067a88
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10067a83
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10067a6e
test dl, dl
je 0x10067a6a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10067a6e
add ecx, 2
add eax, 2
test dl, dl
jne 0x10067a4e
xor eax, eax
jmp 0x10067a73
sbb eax, eax
or eax, 1
test eax, eax
je 0x10067a94
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10067a3b
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x10067b2d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10067b50
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10067b50
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10067b5a
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10067b9c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10067bfe
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10067bf9
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10067be4
test dl, dl
je 0x10067be0
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10067be4
add ecx, 2
add eax, 2
test dl, dl
jne 0x10067bc4
xor eax, eax
jmp 0x10067be9
sbb eax, eax
or eax, 1
test eax, eax
je 0x10067c0a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10067bb1
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8