joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100555e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b6ac8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
push 0x17
lea ecx, [ebp - 0x18]
call fcn.10094df0
mov dword [ebp - 4], 0
lea edi, [esi + 0x5c]
mov edx, dword [ebp - 0x18]
cmp esi, edi
jae 0x10055642
mov ecx, edx
lea esp, [esp]
mov eax, dword [ebx]
lea ecx, [ecx + 4]
mov eax, dword [eax + esi]
add esi, 4
mov dword [ecx - 4], eax
cmp esi, edi
jb 0x10055630
mov ecx, dword [ebp + 8]
xor eax, eax
xor dword [edx + eax*4], ecx
inc eax
cmp eax, 0x17
jb 0x10055647
mov edi, dword [ebp + 0xc]
xor cl, cl
mov bl, byte [edi]
test bl, bl
je 0x1005567f
jmp 0x10055660
movzx eax, cl
lea esi, [edi + eax*2]
mov al, byte [esi + 1]
cmp al, 0x35
jae 0x100556bf
movzx eax, al
mov al, byte [eax + edx + 0x23]
cmp al, byte [esi + 2]
jne 0x100556bf
inc cl
cmp cl, bl
jb 0x10055660
mov bl, 1
mov dword [ebp - 4], 0xffffffff
test edx, edx
je 0x100556ab
push edx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor bl, bl
jmp 0x10055681
Function at 0x100984f0
Capabilities:
Hash data using fnv

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x811c9dc5
test edx, edx
je 0x1009851e
lea ecx, [ecx]
mov cl, byte [esi]
lea eax, [ecx - 0x61]
cmp al, 0x19
movsx eax, cl
ja 0x1009850f
sub eax, 0x20
movsx eax, al
inc esi
xor eax, edi
imul edi, eax, 0x1000193
dec edx
jne 0x10098500
mov eax, edi
pop edi
pop esi
ret

Function at 0x1009e430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ecx + 4]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0xc]
cmp edi, 6
jae 0x1009e497
mov edx, ecx
mov ebx, ecx
mov ecx, 6
sub edx, esi
sub ecx, edi
cmp edx, ecx
jbe 0x1009e45e
lea ebx, [esi + 6]
mov ecx, ebx
xor edx, edx
sub ecx, esi
cmp ebx, esi
sbb ebx, ebx
not ebx
and ebx, ecx
je 0x1009e494
mov edi, edi
mov ecx, eax
inc edx
shl ecx, 6
inc edi
xor eax, ecx
lea ecx, [eax*8]
not ecx
xor eax, ecx
mov dword [ebp + 8], eax
mov al, byte [esi]
inc esi
xor byte [ebp + 8], al
mov eax, dword [ebp + 8]
cmp edx, ebx
jne 0x1009e470
mov ecx, dword [ebp + 0xc]
cmp edi, 9
jae 0x1009e4ea
mov edx, ecx
mov ebx, ecx
mov ecx, 9
sub edx, esi
sub ecx, edi
cmp edx, ecx
jbe 0x1009e4b4
mov ebx, esi
sub ebx, edi
add ebx, 9
mov ecx, ebx
xor edx, edx
sub ecx, esi
cmp ebx, esi
sbb ebx, ebx
not ebx
and ebx, ecx
je 0x1009e4ea
lea ecx, [eax*4]
inc edx
xor eax, ecx
inc edi
lea ecx, [eax*8]
not ecx
xor eax, ecx
mov dword [ebp + 8], eax
mov al, byte [esi]
inc esi
xor byte [ebp + 8], al
mov eax, dword [ebp + 8]
cmp edx, ebx
jne 0x1009e4c4
mov ecx, dword [ebp + 0xc]
xor edx, edx
sub ecx, esi
cmp dword [ebp + 0xc], esi
sbb ebx, ebx
not ebx
and ebx, ecx
je 0x1009e51f
lea esp, [esp]
lea ecx, [eax*8]
inc edx
not ecx
lea esi, [esi + 1]
xor eax, ecx
mov dword [ebp + 8], eax
mov al, byte [esi - 1]
xor byte [ebp + 8], al
mov eax, dword [ebp + 8]
cmp edx, ebx
jne 0x1009e500
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], edi
pop edi
pop esi
mov dword [ecx], eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100adcd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bc7a8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, dl
mov esi, ecx
mov dword [ebp - 4], 0
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
sub edi, edx
je 0x100add82
dec edi
inc edx
shr edi, 1
inc edi
nop
movzx eax, byte [edx - 1]
mov cl, byte [edx]
cmp eax, 5
ja case.default.0x100add1b
jmp dword [eax*4 + 0x100addc4]
sub cl, bl
add byte [esi], cl
jmp case.default.0x100add1b
mov al, bl
sub al, cl
add byte [esi], al
jmp case.default.0x100add1b
xor byte [esi], cl
jmp case.default.0x100add1b
movzx eax, cl
and eax, 0x1f
and eax, 0x80000007
jns 0x100add46
dec eax
or eax, 0xfffffff8
inc eax
test al, al
jne 0x100add4e
mov al, byte [esi]
jmp 0x100add7a
movzx ecx, al
mov al, byte [esi]
rol al, cl
jmp 0x100add78
movzx eax, cl
and eax, 0x1f
and eax, 0x80000007
jns 0x100add69
dec eax
or eax, 0xfffffff8
inc eax
test al, al
jne 0x100add71
mov al, byte [esi]
jmp 0x100add7a
movzx ecx, al
mov al, byte [esi]
ror al, cl
mov byte [esi], al
mov byte [esi], al
add edx, 2
dec edi
jne 0x100add10
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
test eax, eax
je 0x100addaf
push eax
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
mov dword [ebp + 0x10], 0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x406e3f
pop dword [ebp - 0x2c]
mov eax, 0x613fb909
sub eax, 0x60ff4aca
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xed7e228
add dword [ebp - 0x3c], 0x3f7a6323
mov dword [ebp - 0x38], 0xfaae0727
sub dword [ebp - 0x38], 0xc87abae2
mov dword [ebp - 0x34], 0x73546d0e
add dword [ebp - 0x34], 0xd8f7d720
mov dword [ebp - 0x30], 0x36a24a3c
sub dword [ebp - 0x30], 0x36a24a3c
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x512e73e6
add eax, 0xaf122c26
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x6cd2dec7
add dword [ebp - 0x3c], 0x79f8a8f
mov dword [ebp - 0x38], 0x8b5f19ac
add dword [ebp - 0x38], 0xb60d47c9
mov dword [ebp - 0x34], 0xf6bcd959
add dword [ebp - 0x34], 0x6cb29313
mov dword [ebp - 0x30], 0xb7ba0e3a
sub dword [ebp - 0x30], 0xb7ba0e3a
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x390d9
push 0
call eax
mov ecx, 0x48ab
xor edi, edi
add edi, eax
mov ebx, 0x43be00
add ebx, dword [ebp - 0x2c]
mov edx, 0x4ced411a
add edx, 0x48caebe4
sub dword [ebp - 0x10], 0x9ac19df6
mov esi, dword [ebx]
xor dword [ebp - 8], eax
xor esi, edx
mov dword [ebp - 0x1c], 0xbf5bdf33
mov dword [edi], esi
sub dword [ebp - 0x14], edi
add edi, 0xe5fb10d0
add edi, 0x1a04ef34
add ebx, 0x18fc5f9c
add ebx, 0xe703a068
loop 0x406f52
add eax, 0xad8dc304
sub eax, 0xad8cad85
xor ebx, ebx
add ebx, eax
add eax, 0xeb732363
add eax, 0x148cdca2
mov ecx, 0xf2721f8f
sub ecx, 0xf2321f8f
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x56c26805
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..text_1
mov ebx, 0x42f314
nop
nop
mov ecx, 0x5ad50c0d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x402d20
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x403268
call fcn.00403068
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x404364
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x402b48
cmp eax, esi
jne 0x402b3b
xor esi, esi
inc esi
mov edi, esi
jmp 0x402b4b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402b1f
xor esi, esi
inc esi
cmp dword [0x404368], esi
jne 0x402b5d
push 0x1f
call fcn.00494000
pop ecx
jmp 0x402b97
cmp dword [0x404368], ebx
jne 0x402b91
mov dword [0x404368], esi
push 0x4010cc
push 0x4010c0
call fcn.00402c7c
pop ecx
pop ecx
test eax, eax
je 0x402b97
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402c6c
mov dword [0x404014], esi
cmp dword [0x404368], esi
jne 0x402bba
push 0x4010bc
push 0x4010b4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x404368], 2
test edi, edi
jne 0x402bc7
xor eax, eax
mov ecx, 0x404364
xchg dword [ecx], eax
cmp dword [0x40436c], 0
je 0x402bf3
push 0x40436c
call fcn.00402ec0
pop ecx
test eax, eax
je 0x402bf3
push ebx
push 2
push ebx
mov esi, dword [0x40436c]
mov ecx, esi
call dword [0x405140]
call esi
push dword [0x404020]
push dword [0x40401c]
push dword [0x404018]
call fcn.004027bb
add esp, 0xc
mov dword [0x404010], eax
cmp dword [0x404028], 0
jne 0x402c51
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x404014], 0
jne 0x402c65
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x404010]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00402fb5
jmp 0x402b03

Function at 0x402da4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x403288
call fcn.00403068
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x402e04
cmp eax, 0xffffffff
je 0x402e04
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x402dfd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x402dfd
cmp edx, 0x10000000
jae 0x402dfd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x402dfa
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x402e70
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x402eae
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x402ea6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x402eb0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x402e96
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10004b30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10026516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], vtable.CChartAxis.0
lea ecx, [edi + 0x54]
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
movzx eax, byte [esi + 0xc]
mov byte [edi + 0xc], al
movzx eax, byte [esi + 0xd]
mov byte [edi + 0xd], al
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
movzx eax, byte [esi + 0x14]
mov byte [edi + 0x14], al
movzx eax, byte [esi + 0x15]
mov byte [edi + 0x15], al
movsd xmm0, qword [esi + 0x18]
movsd qword [edi + 0x18], xmm0
movsd xmm0, qword [esi + 0x20]
movsd qword [edi + 0x20], xmm0
movsd xmm0, qword [esi + 0x28]
movsd qword [edi + 0x28], xmm0
movsd xmm0, qword [esi + 0x30]
movsd qword [edi + 0x30], xmm0
movzx eax, byte [esi + 0x38]
mov byte [edi + 0x38], al
movzx eax, byte [esi + 0x39]
mov byte [edi + 0x39], al
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
lea eax, [esi + 0x54]
movdqu xmm0, xmmword [esi + 0x44]
push eax
movdqu xmmword [edi + 0x44], xmm0
call fcn.10005300
mov dword [esp + 0x14], 0
lea ecx, [edi + 0x6c]
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
mov eax, dword [esi + 0x68]
mov dword [edi + 0x68], eax
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x6c]
push eax
call fcn.10003f70
mov byte [esp + 0x14], 1
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov eax, dword [esi + 0x88]
mov dword [edi + 0x88], eax
movzx eax, byte [esi + 0x8c]
mov byte [edi + 0x8c], al
mov eax, dword [esi + 0x90]
mov dword [edi + 0x90], eax
movzx eax, byte [esi + 0x94]
mov byte [edi + 0x94], al
movsd xmm0, qword [esi + 0x98]
movsd qword [edi + 0x98], xmm0
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x10004f30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1002654b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
lea ecx, [edi + 0x10]
mov dword [esp + 8], edi
push 0xffffffffffffffff
mov dword [edi], vtable.CChartSeries.0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x10]
push eax
call fcn.10003f70
mov dword [esp + 0x14], 0
movzx eax, byte [esi + 0x28]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x29]
mov byte [edi + 0x29], al
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
movdqu xmm0, xmmword [esi + 0x38]
movdqu xmmword [edi + 0x38], xmm0
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
movzx eax, byte [esi + 0x4c]
mov byte [edi + 0x4c], al
movzx eax, byte [esi + 0x4d]
mov byte [edi + 0x4d], al
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x100050d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1002656b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, ecx
lea ecx, [edi + 0x18]
mov dword [esp + 8], edi
push 0xffffffffffffffff
mov dword [edi], vtable.CChartLegend.0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
xor eax, eax
movdqu xmm0, xmmword [esi + 8]
push eax
movdqu xmmword [edi + 8], xmm0
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.10003f70
mov dword [esp + 0x14], 0
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
movzx eax, byte [esi + 0x34]
mov byte [edi + 0x34], al
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
movzx eax, byte [esi + 0x44]
mov byte [edi + 0x44], al
movzx eax, byte [esi + 0x45]
mov byte [edi + 0x45], al
movzx eax, byte [esi + 0x46]
mov byte [edi + 0x46], al
movzx eax, byte [esi + 0x47]
mov byte [edi + 0x47], al
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x10007300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1002697c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [esp + 8], edi
mov dword [edi], vtable.CChartSeries.0
mov dword [edi + 0x24], 7
mov dword [edi + 0x20], 0
mov word [edi + 0x10], ax
mov dword [esp + 0x14], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 4], eax
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov eax, dword [sym.ChartCtrl.dll_unsigned_int_CChartSeries::m_nNextFreeId]
mov dword [edi + 0x48], eax
inc dword [sym.ChartCtrl.dll_unsigned_int_CChartSeries::m_nNextFreeId]
mov word [edi + 0x28], 1
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0x969696
mov dword [edi + 0x34], 2
mov word [edi + 0x4c], 1
mov dword [esp + 0x14], 1
push ecx
lea ecx, [edi + 0x50]
mov dword [edi], vtable.CChartSeriesBase_class_CChartXYPoint_.0
call fcn.10008320
mov byte [esp + 0x14], 2
lea esi, [edi + 0x90]
mov dword [esp + 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100071e0
mov dword [esi], eax
mov byte [esp + 0x14], 7
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x10009100
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10026a26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [esp + 8], esi
mov dword [esi], vtable.CChartLabel_class_CChartXYPoint_.0
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], 0
mov word [esi + 0x18], ax
mov dword [esp + 0x14], eax
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], eax
mov word [esi + 0x30], ax
mov byte [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x20]
jmp loc.100f010c
Function at 0x10009d80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10026c8c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [esp + 8], edi
mov dword [edi], vtable.CChartSeries.0
mov dword [edi + 0x24], 7
mov dword [edi + 0x20], 0
mov word [edi + 0x10], ax
mov dword [esp + 0x14], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 4], eax
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov eax, dword [sym.ChartCtrl.dll_unsigned_int_CChartSeries::m_nNextFreeId]
mov dword [edi + 0x48], eax
inc dword [sym.ChartCtrl.dll_unsigned_int_CChartSeries::m_nNextFreeId]
mov word [edi + 0x28], 1
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0x969696
mov dword [edi + 0x34], 2
mov word [edi + 0x4c], 1
mov dword [esp + 0x14], 1
push ecx
lea ecx, [edi + 0x50]
mov dword [edi], vtable.CChartSeriesBase_class_CChartCandlestickPoint_.0
call fcn.1000a9f0
mov byte [esp + 0x14], 2
lea esi, [edi + 0x90]
mov dword [esp + 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100071e0
mov dword [esi], eax
mov byte [esp + 0x14], 7
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x1000c650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10026eec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [esp + 8], edi
mov dword [edi], vtable.CChartSeries.0
mov dword [edi + 0x24], 7
mov dword [edi + 0x20], 0
mov word [edi + 0x10], ax
mov dword [esp + 0x14], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 4], eax
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov eax, dword [sym.ChartCtrl.dll_unsigned_int_CChartSeries::m_nNextFreeId]
mov dword [edi + 0x48], eax
inc dword [sym.ChartCtrl.dll_unsigned_int_CChartSeries::m_nNextFreeId]
mov word [edi + 0x28], 1
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0x969696
mov dword [edi + 0x34], 2
mov word [edi + 0x4c], 1
mov dword [esp + 0x14], 1
push ecx
lea ecx, [edi + 0x50]
mov dword [edi], vtable.CChartSeriesBase_class_CChartGanttPoint_.0
call fcn.1000d2b0
mov byte [esp + 0x14], 2
lea esi, [edi + 0x90]
mov dword [esp + 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100071e0
mov dword [esi], eax
mov byte [esp + 0x14], 7
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x1001c6a0
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xa0]
cmp eax, 5
ja case.default.0x1001c6b2
jmp dword [eax*4 + 0x1001c750]
jmp fcn.100ae30a
jmp loc.100d8537
jmp loc.10076018
jmp fcn.100da2f4
jmp fcn.100c8fab
jmp fcn.100bc606
Function at 0x10022fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10028cca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ecx], vtable.CChartSeries.0
xor eax, eax
mov dword [ecx + 0x24], 7
mov dword [ecx + 0x20], 0
mov dword [esp], ecx
mov word [ecx + 0x10], ax
mov dword [esp + 0xc], eax
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], eax
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x44], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 4], eax
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [sym.ChartCtrl.dll_unsigned_int_CChartSeries::m_nNextFreeId]
mov dword [ecx + 0x48], eax
inc dword [sym.ChartCtrl.dll_unsigned_int_CChartSeries::m_nNextFreeId]
mov word [ecx + 0x28], 1
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0x969696
mov dword [ecx + 0x34], 2
mov word [ecx + 0x4c], 1
mov dword [esp + 0xc], 0xffffffff
mov eax, ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 4