joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46da00
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x46da09
mov eax, dword [ebp - 4]
add esp, 0xfffffc90
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4374], edx
mov dword [ebp - 0x4370], edx
mov dword [ebp - 0x436c], edx
mov dword [ebp - 0x4368], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46dbf3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0041a620
lea edi, [ebp - 0x4008]
mov dword [ebp - 8], 0x4000
lea eax, [ebp - 8]
push eax
push edi
call sub.iphlpapi.dll_GetAdaptersInfo_1
test eax, eax
jne 0x46dbd5
test edi, edi
je 0x46dbd5
mov eax, dword [edi + 0x1a0]
cmp eax, 6
je 0x46da90
cmp eax, 0x47
je 0x46da90
mov edi, dword [edi]
jmp 0x46dbcd
mov eax, dword [edi + 0x19c]
mov dword [ebp - 0x4164], eax
lea eax, [ebp - 0x4364]
push eax
call sub.iphlpapi.dll_GetIfEntry
test eax, eax
lea esi, [edi + 0x1d4]
test esi, esi
je 0x46dafa
lea eax, [ebp - 0x4368]
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.00404708
cmp dword [ebp - 0x4368], 0
je 0x46daf4
lea eax, [ebp - 0x436c]
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.00404708
mov edx, dword [ebp - 0x436c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov esi, dword [esi]
test esi, esi
jne 0x46dab4
lea esi, [edi + 0x1ac]
test esi, esi
je 0x46dbcb
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x46d580]
call fcn.0041a2d8
mov ebx, eax
lea edx, [ebx + 0x1c]
lea eax, [edi + 0x194]
mov ecx, 6
call fcn.00402c40
mov eax, dword [edi + 0x19c]
mov dword [ebx + 0x14], eax
lea eax, [ebx + 0x10]
lea edx, [edi + 8]
mov ecx, 0x104
call fcn.00404708
lea eax, [ebx + 0xc]
lea edx, [edi + 0x10c]
mov ecx, 0x84
call fcn.00404708
lea eax, [ebp - 0x4370]
lea edx, [esi + 4]
mov ecx, 0x10
call fcn.00404708
mov edx, dword [ebp - 0x4370]
mov eax, dword [0x47c6a4]
call fcn.0046dde8
mov dword [ebx + 0x18], eax
lea eax, [ebp - 0x4374]
lea edx, [esi + 0x14]
mov ecx, 0x10
call fcn.00404708
mov edx, dword [ebp - 0x4374]
mov eax, dword [0x47c6a4]
call fcn.0046dde8
mov dword [ebx + 0x24], eax
mov byte [ebx + 0x23], 1
cmp dword [ebp - 0x4144], 5
sete al
mov byte [ebx + 0x22], al
mov byte [ebx + 0x28], 0
mov byte [ebx + 0x29], 0
mov byte [ebx + 0x2a], 0
mov esi, dword [esi]
test esi, esi
jne 0x46db08
mov edi, dword [edi]
test edi, edi
jne 0x46da79
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46dbfa
lea eax, [ebp - 0x4374]
mov edx, 4
call fcn.004044bc
ret

Function at 0x46dc04
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
add esp, 0x190
ret
Function at 0x46ded8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov esi, ecx
test ebx, ebx
jle 0x46df0f
mov eax, dword [ebp + 8]
push eax
push ebx
push esi
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_recv
test eax, eax
jg 0x46df05
or edi, 0xffffffff
jmp 0x46df0f
add esi, eax
sub ebx, eax
add edi, eax
test ebx, ebx
jg 0x46deed
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x46df1c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov esi, ecx
test ebx, ebx
jle 0x46df53
mov eax, dword [ebp + 8]
push eax
push ebx
push esi
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x46df49
or edi, 0xffffffff
jmp 0x46df53
add esi, eax
sub ebx, eax
add edi, eax
test ebx, ebx
jg 0x46df31
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x46df60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 8], eax
test edi, edi
jle 0x46e019
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_WSASend
inc eax
jne 0x46dfa7
mov dword [ebp - 8], 0xffffffff
jmp 0x46e019
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x46dfbf
cmp eax, dword [esp]
seta al
jmp 0x46dfc2
setg al
add esp, 8
sub edi, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
test al, al
je 0x46e011
jmp 0x46dfdd
mov eax, dword [ebx]
sub dword [ebp - 0xc], eax
dec esi
add ebx, 8
cmp dword [ebp - 0xc], 0
jbe 0x46e000
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x46dffc
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x46dfd4
jmp 0x46e000
pop edx
pop eax
jle 0x46dfd4
cmp dword [ebp - 0xc], 0
jbe 0x46e011
mov eax, dword [ebp - 0xc]
add dword [ebx + 4], eax
mov eax, dword [ebp - 0xc]
sub dword [ebx], eax
test edi, edi
jg 0x46df81
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46f2ac
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov ebp, ecx
mov edi, edx
mov ebx, eax
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 4], esi
inc esi
jne 0x46f305
push 2
mov dword [esp + 0x14], 0x7d1
mov dword [esp + 0x18], 1
mov eax, dword [0x47ce24]
mov eax, dword [eax]
call fcn.0046cd84
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x14]
mov edx, 2
mov eax, ebx
call fcn.0046f6ec
mov esi, eax
jmp 0x46f3c6
mov word [esp], 2
mov eax, dword [0x47ce38]
mov eax, dword [eax]
mov edx, edi
call fcn.0046dde8
mov dword [esp + 4], eax
push ebp
call sub.wsock32.dll_htons
mov word [esp + 2], ax
push 0x10
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x46f381
push 2
mov dword [esp + 0x14], 0x7d1
mov dword [esp + 0x18], 2
mov eax, dword [0x47ce24]
mov eax, dword [eax]
call fcn.0046cd84
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x14]
mov edx, 2
mov eax, ebx
call fcn.0046f6ec
mov esi, eax
mov eax, dword [0x47ce38]
mov eax, dword [eax]
mov edx, dword [ebx + 4]
call fcn.0046dc20
jmp 0x46f3c6
mov eax, dword [0x47ce38]
mov eax, dword [eax]
mov ecx, 1
mov edx, dword [ebx + 4]
call fcn.0046ddc8
mov eax, dword [0x47ce38]
mov eax, dword [eax]
mov ecx, 0x40000
mov edx, dword [ebx + 4]
call fcn.0046dda0
mov eax, dword [0x47ce38]
mov eax, dword [eax]
mov ecx, 0x40000
mov edx, dword [ebx + 4]
call fcn.0046dd78
mov eax, ebx
call fcn.0046ea24
mov esi, eax
mov eax, esi
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x475528
Capabilities:
Get disk size

Disassembly:
add esp, 0xfffffff0
mov eax, 0x4755a8
call fcn.0040a584
test al, al
je 0x475559
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0x4755ac
call sub.kernel32.dll_GetDiskFreeSpaceA
jmp 0x475577
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push 0x4755b0
call sub.kernel32.dll_GetDiskFreeSpaceA
mov eax, dword [esp + 4]
imul dword [esp]
test eax, eax
jne 0x475587
mov eax, 0x1000
mov edx, eax
test edx, edx
jns 0x475593
add edx, 0x1ff
sar edx, 9
mov dword [0x47cc18], edx
add esp, 0x10
ret
Function at 0x475b44
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x475d4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x34
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x38], ebx
test ebx, ebx
setne al
mov edx, dword [ebp - 4]
mov byte [edx + 0x31], al
xor edx, edx
push ebp
push 0x475d1d
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x475d13
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
call fcn.0040acc0
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], ebx
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
push eax
call sub.version.dll_GetFileVersionInfoA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 0x31], al
mov eax, dword [ebp - 4]
add eax, 0x48
push eax
mov eax, dword [ebp - 4]
add eax, 0x44
push eax
push 0x475d5c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x48]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x44]
mov eax, dword [ebp - 4]
add eax, 0x68
call fcn.00407388
mov eax, dword [ebp - 4]
add eax, 0x48
push eax
mov eax, dword [ebp - 4]
add eax, 0x44
push eax
push 0x475d60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov eax, dword [eax]
mov edx, eax
and edx, 0xffff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4c], edx
and eax, 0xffff0000
shr eax, 0x10
and eax, 0xffff
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], eax
lea ecx, [ebp - 0x108]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov edx, 4
call fcn.0040a174
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
mov ecx, 0xff
call fcn.00404750
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 4]
add eax, 0x5d
mov cl, 4
call fcn.00402fac
lea ecx, [ebp - 0x10c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
mov edx, 4
call fcn.0040a174
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x104]
mov ecx, 0xff
call fcn.00404750
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 4]
add eax, 0x62
mov cl, 4
call fcn.00402fac
mov eax, dword [ebp - 4]
lea edx, [eax + 0x5d]
lea eax, [ebp - 0x118]
call fcn.00402fa0
mov eax, dword [ebp - 4]
lea edx, [eax + 0x62]
lea eax, [ebp - 0x118]
mov cl, 8
call fcn.00402f70
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
add eax, 0x54
mov cl, 8
call fcn.00402fac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x475d2f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475d54
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.004044bc
ret
Function at 0x4763b8
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404964
mov eax, dword [ebp - 8]
call fcn.00404964
mov eax, dword [ebp - 0xc]
call fcn.00404964
xor eax, eax
push ebp
push 0x476573
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x29], 0
lea eax, [ebp - 0x20]
call fcn.00404498
lea eax, [ebp - 0x24]
call fcn.00404498
push 0xffffffffffffffff
lea eax, [ebp - 0x28]
push eax
push 0
call sub.iphlpapi.dll_GetIpForwardTable
not eax
cmp eax, 0x6f
je 0x47654b
mov eax, dword [ebp - 0x28]
call fcn.00409c8c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x476524
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.iphlpapi.dll_GetIpForwardTable
test eax, eax
jne 0x47650e
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
dec ebx
test ebx, ebx
jl 0x47650e
inc ebx
xor esi, esi
mov eax, esi
shl eax, 3
sub eax, esi
mov edx, dword [ebp - 0x10]
push esi
lea esi, [edx + eax*8 + 4]
lea edi, [ebp - 0x64]
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
pop esi
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x64]
call fcn.004760f8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00404ab8
test eax, eax
jle 0x476506
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x60]
call fcn.004760f8
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x58]
call fcn.004760f8
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0
lea edx, [ebp - 0x6c]
xor ecx, ecx
mov eax, 0x47658c
call fcn.0040b19c
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0
lea edx, [ebp - 0x6c]
xor ecx, ecx
mov eax, 0x47658c
call fcn.0040b19c
mov byte [ebp - 0x29], 1
lea eax, [ebp - 0x64]
push eax
call sub.iphlpapi.dll_DeleteIpForwardEntry
jmp 0x47650e
inc esi
dec ebx
jne 0x476473
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47652b
mov eax, dword [ebp - 0x10]
call fcn.004029fc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47657a
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004044bc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004044bc
ret
Function at 0x1000c15b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ecx
or bl, al
ror bl, cl
xor bl, 0xe0
rol bl, 1
xchg ebp, eax
xor bl, dl
mov eax, ebp
inc bl
cmc
sar bl, 6
rcl bl, cl
mov bl, 1
test bx, 0x5548
cmp edx, 0xe80d6225
stc
xchg dword [esp + 0x24], esi
movzx si, cl
bsf esi, ecx
pop esi
pushal
mov esi, edi
push dword [esp]
sub esi, eax
call fcn.10017e74

Function at 0x1000c199
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
cmp ebx, 1
jmp 0x1000d602
rol bh, 6
test dh, bl
mov bx, word [esi]
call fcn.10019ca7
cmp esp, 0xf8f50f44
test al, 0xda
clc
not dl
pushal
cmc
bt ecx, 2
push word [esp + 0x20]
popf
pushal
jmp 0x1000e518
adc dl, dl
push ebp
mov byte [esp], ah
pushfd
push dword [esp + 0x4a]
ret 0x4e
pushfd
lea esp, [esp + 0x3c]
je 0x1001c34f
stc
jmp 0x1001a1ad
inc esi
mov byte [esp], dh
jmp 0x1000cf18
call fcn.1000f287
push ecx
push dword [esp]
push dword [esp + 4]
lea esp, [esp + 0xc]
je 0x1000cd3d
push 0xb782cff2
cmp ebx, 3
pushal
lea esp, [esp + 0x24]
je 0x1000f07e
push ebp
lea esp, [esp + 4]
jmp 0x100195d9
bsf bx, ax
mov bx, word [esi]
push 0xc99e6b07
pushal
and ebx, 0xfff
test bl, 0xca
jmp 0x100195d3
mov byte [esp], al
lea esp, [esp + 4]
je 0x1000f07e
pushal
lea esp, [esp + 0x20]
jmp 0x100195d9
jmp 0x1000f021
add dword [ebx + edi], edx
add esp, 0x24
clc
clc
add esi, 2
jmp 0x1000e723
cmp ebx, 2
jb 0x1000f807
pushfd
mov byte [esp], 0xab
push esi
lea esp, [esp + 8]
je 0x1000cd3d
cmc
clc
cmc
cmp ebx, 3
pushfd
jmp 0x1000f270
pushal
sbb bl, 0xa2
mov bx, word [esi]
test si, di
mov byte [esp], al
and ebx, 0xfff
cmc
push 0xc38d3b09
add word [ebx + edi], ax
push dword [esp + 0xc]
mov word [esp], 0x53ef
mov byte [esp], cl
mov byte [esp], 0x60
lea esp, [esp + 0x28]
jmp 0x100195d9

Function at 0x1000c369
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
pushfd
mov dword [esp + 8], 0x566f4fdd
lea esp, [esp + 0xc]
je 0x10017efe
or cx, sp
add edx, eax
movsx cx, cl
dec cx
bsr cx, bx
mov ecx, dword [esi + 0x7c]
bt ecx, 6
test dl, 0x92
pushfd
cmp ah, ah
add ecx, edx
mov byte [esp], 0xf2
jmp 0x1001c795
cmp ecx, 0xffff
mov byte [esp], ah
push eax
call fcn.1000d940
mov esi, dword [ebp + 0xc]
bsf cx, bp
mov ecx, dword [ebp + 0x14]
jmp 0x1000efd5
pushal
push dword [esp]
mov dword [ebp - 0x10], ecx
shrd ecx, esi, cl
mov ecx, dword [ebp + 0xc]
test dh, 0x6e
cmp bl, 0x7f
jmp 0x1001996a

Function at 0x1000d940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
setp bl
movsx cx, al
add edi, eax
clc
sub bh, bh
bts cx, 0xf
btc bx, 5
mov ebx, dword [edx + 0x20]
sbb ch, cl
bsr cx, dx
test cl, 0xf6
add ebx, eax
ror ch, 1
bsf cx, dx
mov dword [ebp - 8], 0
pushfd
xor cx, dx
add cl, 0xee
movzx cx, cl
mov ecx, dword [edx + 0x18]
mov byte [esp], 0x1e
jmp 0x1000f050
lea esp, [esp + 0x30]
jbe 0x1001f3e0
dec di
pushfd
xor di, bp
rol bl, 6
mov edi, dword [edx + 0x24]
add esp, 4
jb 0x1000ccbc
movsx bx, dl
inc cx
add edi, eax
not cl
mov ebx, dword [edx + 0x20]
shr cl, 7
jmp 0x1000dace
test eax, 0xf4416ebc
cmp ecx, dword [ebp - 8]
pushfd
push 0xb0d21
call fcn.1000de82
Function at 0x1000e04b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
lea esp, [esp + 0x10]
call fcn.1000e81b
push ebp
lea esp, [esp + 4]
jae 0x1001c751
pushfd
push dword [esp]
sub eax, eax
push esp
lea esp, [esp + 0xc]
call fcn.1000e81b
call fcn.10018f3e

Function at 0x1000efe9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x10017e79
lea esp, [esp + 4]
jae 0x10017f06
rol bx, 9
mov ebx, eax
pushal
shl edi, cl
bts cx, bx
clc
mov edi, eax
push esp
bsr cx, ax
adc cx, di
mov ecx, 0x104
lea esp, [esp + 0x24]
js 0x1001f3d3
clc
test al, cl
sub al, al
pushfd
repne scasb al, byte es:[edi]
pushal
lea esp, [esp + 0x24]
jne 0x10017efe
sar si, cl
not si
shrd cx, bx, 1
mov ecx, edi
shrd si, dx, cl
mov si, si
movsx si, cl
sub ecx, ebx
lea esi, [esp - 0x876fa0e]
mov esi, esp
stc
call fcn.1000f8bd
call fcn.1000ce91
test edx, ebx
sub al, al
cmc
pushal
repne scasb al, byte es:[edi]
call fcn.1001ab9e
clc
stc
cmp eax, 0xe50a578b
bt cx, bp
sub ecx, dword [edx + 0x10]
call fcn.1001c0bc
lea esp, [esp + 0x40]
jae 0x10017f06
mov bl, 0x95
mov ebx, eax
or cx, bx
clc
mov edi, eax
setns cl
adc cx, 0xfcb0
movzx cx, bl
bsf cx, si
mov ecx, 0x104
jmp 0x1001b7f3

Function at 0x1000f287
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
call fcn.1001928a
cmp eax, 0x7f
push 0x824035d0
lea esp, [esp + 4]
ja 0x10018deb
pushal
inc ecx
push 0xd9183e89
dec bl
call fcn.1000c15b
repne scasb al, byte es:[edi]
push ecx
jmp 0x1001817a
dec ecx
pushfd
lea esp, [esp + 8]
jns 0x1000dc16
push 0x2a42b449
lea esp, [esp + 4]
jne 0x1000c7c4
adc cx, 0xb4b7
stc
movzx cx, al
sar ecx, 8
mov ecx, dword [ebp - 4]
pushfd
pushfd
clc
cmp bx, 0x92d1
cmp dword [ebp + 0x14], ecx
mov word [esp], 0x5300
jmp 0x1001b9ec
jmp 0x1001ca31
lea esp, [esp + 8]
ja 0x1000ff98

Function at 0x10017f66
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ch, 0x17
xor ecx, ecx
call fcn.10017b76

Function at 0x10017fcd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
push dword [esp + 4]
lea esp, [esp + 0x48]
ja 0x1000e90f
sbb al, 0xbd
neg al
test bp, dx
sub ebx, edi
bt edx, 4
btr edi, 0x10
add ebx, esp
pushal
sal di, cl
dec edi
cmc
mov edi, ebx
rcl al, 5
dec al
adc al, 0x35
mov al, 0x2e
test bh, 0x43
repne scasb al, byte es:[edi]
pushal
lea esp, [esp + 0x40]
jne 0x1000e169
bswap ax
cwde
mov byte [edi - 1], 0
bswap ax
push ebx
push ecx
jmp 0x1001b856
pushal
cmp edi, ebx
jmp 0x1000e075
lahf
movsx eax, al
lea eax, [0x1000e63a]
lea esp, [esp + 4]
jl 0x1000c246
push edx
pushfd
mov word [esp], 0xa54f
mov dword [esp + 4], 0x1000c14f
push edi
jmp 0x1000d61a
Function at 0x100180aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x10019189
cmp bh, 0xe9
or di, dx
mov edi, dword [edx + 0x24]
bt si, di
jmp 0x1000e511
test dh, ah
jmp 0x100192f0
pushal
lea esp, [esp + 0x20]
jne 0x1000f84a
jb 0x1001ca2c
test dl, dh
cmp byte [edi - 1], 0
jmp 0x1000cc6f
pushfd
lea esp, [esp + 4]
jb 0x1001ca2c
clc
bt esp, 0xb
clc
cmp byte [edi - 1], 0
pushfd
push ebx
mov dword [esp + 4], 0xae785bf1
lea esp, [esp + 8]
jne 0x10019189
rcr di, cl
shr edi, 9
add di, ax
mov edi, dword [edx + 0x24]
call fcn.1000e86f
stc
call fcn.1000e21c
neg al
lea esp, [esp + 0x38]
jo 0x1000ff1a
add al, 0x6f
cmc
xor al, 0x64
pushal
cmp al, byte [edi]
push 0xb4b86b88
pop eax
lea edi, [edi + 1]
pop eax
not al
mov eax, dword [esp + 0x1c]
pushal
lea esp, [esp + 0x40]
ja 0x1000f2c8
jmp 0x1001bf8a
pushfd
lea esp, [esp + 4]
jb 0x1000e7d0
push edx
lea esp, [esp + 4]
jb 0x1001ca2c
test bl, cl
cmp byte [edi - 1], 0
push 0xff01cb25
mov word [esp], si
pushal
call fcn.1000e8ac

Function at 0x1001816f
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
pop esi
mov esi, 0xda058e56
mov word [esp], ax
mov esi, dword [esp + 0x28]
mov word [esp], bx
lea esp, [esp + 0x2c]
jmp 0x1000d97e
mov byte [esp], dl
pushfd
rep movsb byte es:[edi], byte [esi]
jmp 0x1000f81e
Function at 0x10018267
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
mov dword [esp + 4], eax
pushfd
pushal
lodsb al, byte [esi]
bt ax, 7
call fcn.1000e86a
push eax
invalid
xchg cx, di
shr esi, 1
mov ecx, dword [ebp - 8]
or di, 0x9058
xchg di, si
add ecx, dword [ebp - 4]
bswap si
shld esi, eax, 3
rcr esi, cl
movsx edi, al
shr ecx, 1
bswap esi
add di, 0xd9de
xadd di, si
mov edi, dword [ebx + ecx*4]
shl si, cl
rol si, 0xb
add edi, eax
not si
lea esi, [edi + 0x5f9c386a]
pushfd
mov esi, dword [ebp + 0xc]
jmp 0x1000d28d
lea esp, [esp + 0x30]
jo 0x100198b3
jbe 0x1001f3e0
movsx di, al
xor edi, ebp
mov edi, dword [edx + 0x24]
movzx bx, al
xadd bl, ch
jae 0x1001b2d6
add edi, eax
btc bx, bx
clc
mov ebx, dword [edx + 0x20]
and cl, 0x10
add ebx, eax
stc
jmp 0x1001ca21
lea esp, [esp + 0x10]
je 0x10017efe
bsr cx, cx
test ax, 0xf6e1
add edx, eax
btc cx, dx
sbb ecx, ebx
sub ch, ch
mov ecx, dword [esi + 0x7c]
cmp al, bh
pushal
push dword [esp + 0xc]
push 0x3164e069
add ecx, edx
pushfd
bt di, bx
mov dword [ebp - 0x10], ecx
not cl
mov ecx, dword [ebp + 0xc]
cmp al, ah
clc
stc
cmp ecx, 0xffff
push 0x52a39fc3
jmp 0x1000fb4f
jmp fcn.1000e96f
push ebp
pushfd
lea esp, [esp + 8]
jbe 0x10017efe
movzx esi, cl
neg si
sub ecx, 1
rcl si, cl
sal si, cl
sbb si, 0xdc25
or edi, 0xe59308dd
mov dword [ebp - 4], ecx
jmp 0x1000e232
test di, 0x770
shl ch, 4
neg bx
push 0x344be02c
add edi, eax
cmc
xadd cx, bx
btr cx, 0xd
mov ebx, dword [edx + 0x20]
rol ch, cl
add ebx, eax
sbb ch, 0x36
bswap cx
sar cl, 1
mov dword [ebp - 8], 0
rcr ecx, cl
neg cx
mov ecx, dword [edx + 0x18]
cmp bl, 0xe8
cmc
pushfd
stc
cmp ecx, dword [ebp - 8]
push dword [esp + 4]
pushal
lea esp, [esp + 0x2c]
jl 0x10019f62
pushfd
lea esp, [esp + 4]
jbe 0x10017efe
shld edi, eax, cl
shrd esi, ecx, cl
btc si, di
push 0x9d3b1732
sub ecx, 1
sal di, cl
bts esi, 0x1d
bt edi, 0x18
clc
mov dword [ebp - 4], ecx
rcr ch, cl
sar di, 5
mov ecx, dword [ebp - 8]
or di, dx
call fcn.1000e832
aaa
fmul dword [ecx]
jmp 0xa6b0c182
mov dword [ebp - 8], 0
cmc
mov ecx, dword [edx + 0x18]

Function at 0x100191fd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jl 0x10019630
pushfd
cmp cl, bh
cmp eax, dword [ebp - 0x10]
call fcn.10017288
jmp 0x1001a508
cmc
cmp eax, dword [ebp - 0x10]
jmp 0x1000eca4
pushal
pushfd
lea esp, [esp + 0x48]
jb 0x10017f06
jmp 0x1000e895

Function at 0x1001928a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp + 4], dx
lea esp, [esp + 8]
jne 0x1000c7c4
btr cx, 0xc
mov ecx, dword [ebp - 4]
bt bx, 3
stc
cmp dword [ebp + 0x14], ecx
push 0x4a650682
lea esp, [esp + 4]
ja 0x1000ff98
call fcn.1001fcd2

Function at 0x10019b1e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
mov word [esp], si
imul edx, edx, 0xa
sub esp, 0xfffffff8
cmp si, bp
cmc
add edx, eax
push ebp
push 0x8ab28c16
push 0xc6eaf0ae
push 0x49243c68
lea esp, [esp + 0x10]
jmp 0x1001abf3