joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018c0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x218
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [esp + 0x21c]
push ebp
push esi
push eax
mov dword [esp + 0xc], ecx
call sub.WSOCK32.dll_gethostbyname
mov ebp, eax
test ebp, ebp
je 0x401a77
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
je 0x401a77
push ebx
push edi
push 0x100
lea eax, [esp + 0x128]
push 0
push eax
call sub.MSVCR90.dll_memset
push 0x100
lea ecx, [esp + 0x34]
push 0
push ecx
call sub.MSVCR90.dll_memset
add esp, 0x18
xor ebx, ebx
xor esi, esi
jmp 0x401930
cmp esi, 0xf0
jge 0x4019d0
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
mov byte [esp + 0x22], al
mov eax, dword [ebx + edx]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
push edx
movzx edx, byte [eax]
push ecx
push edx
lea eax, [esp + 0x24]
push str._u._u._u._u
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea edi, [esi + 0xf]
add esp, 0x18
cmp esi, edi
mov ecx, esi
jge 0x4019be
jmp 0x401990
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
shl edx, 4
sub edx, eax
mov eax, ecx
sub eax, edx
mov dl, byte [esp + eax + 0x14]
mov byte [esp + ecx + 0x124], dl
inc ecx
cmp ecx, edi
jl 0x401990
mov eax, dword [ebp + 0xc]
add ebx, 4
cmp dword [ebx + eax], 0
mov esi, edi
jne 0x401930
xor eax, eax
xor esi, esi
lea ecx, [esp + 0x124]
mov bl, 0xd
lea ecx, [ecx]
cmp byte [ecx], 0
je 0x401a27
mov edx, dword [ecx]
mov dword [esp + eax + 0x24], edx
mov edx, dword [ecx + 4]
lea eax, [esp + eax + 0x24]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov dx, word [ecx + 0xc]
mov word [eax + 0xc], dx
mov dl, byte [ecx + 0xe]
mov byte [eax + 0xe], dl
lea eax, [esp + 0x24]
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401a10
sub eax, edi
mov byte [esp + eax + 0x24], bl
inc esi
inc eax
add ecx, 0xf
cmp esi, 0xf
jl 0x4019e0
mov edi, dword [esp + 0x10]
push 0x100
push 0
push edi
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x30]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401a42
sub eax, edx
mov esi, eax
cmp esi, 0x100
jle 0x401a5a
mov esi, 0x100
test esi, esi
jle 0x401a6d
push esi
lea eax, [esp + 0x28]
push eax
push edi
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov byte [edi + esi], 0
pop edi
mov al, 1
pop ebx
jmp 0x401a89
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov esi, 0x4074fc
call fcn.004011a0
xor al, al
mov ecx, dword [esp + 0x21c]
pop esi
pop ebp
xor ecx, esp
call fcn.0040375c
add esp, 0x218
ret 4
Function at 0x401ab0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x40417e
mov eax, dword fs:[0]
push eax
sub esp, 0x1a4
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x1a0], eax
push esi
push edi
mov eax, dword [0x407018]
xor eax, esp
push eax
lea eax, [esp + 0x1b0]
mov dword fs:[0], eax
lea esi, [ebx + 4]
mov dword [esp + 0x14], ebx
call fcn.004024d0
xor esi, esi
lea edi, [ebx + 8]
mov dword [esp + 0x1b8], esi
call fcn.004022e0
lea edi, [ebx + 0x40]
xor ecx, ecx
mov eax, edi
mov byte [esp + 0x1b8], 1
call fcn.00402550
cmp dword [0x4074f0], esi
jne 0x401b5d
cmp dword [0x4074ec], esi
jne 0x401b5d
lea eax, [esp + 0x1c]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
cmp eax, esi
je 0x401b5d
mov ecx, eax
lea eax, [esp + 0x18]
call fcn.00402550
mov ecx, dword [eax]
push 0x405750
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], ecx
call sub.MSVCR90.dll__CxxThrowException
push esi
push esi
push 1
push esi
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
inc dword [0x4074f0]
mov dword [ebx], eax
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x28], esi
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x3c], esi
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x14], 0xffffffff
mov eax, ebx
mov ecx, dword [esp + 0x1b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.0040375c
add esp, 0x1b0
ret
Function at 0x401c60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov edi, dword [0x4074f8]
mov eax, edi
mov ebx, ecx
call fcn.00401da0
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
mov eax, 2
push 0x27dd
mov word [esp + 0x18], ax
call sub.WSOCK32.dll_htons
push ebx
mov word [esp + 0x1a], ax
call sub.WSOCK32.dll_inet_addr
push 0x10
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x24], eax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x401ce1
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.00401c40
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0040375c
add esp, 0x20
ret
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x80
push 0xffff
mov edx, 1
mov eax, 0xa
push esi
mov word [esp + 0x24], dx
mov word [esp + 0x26], ax
call sub.WSOCK32.dll_setsockopt
lea edx, [edi + 0x3c]
push edx
push 0
push edi
push 0x4021c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x38], eax
test eax, eax
jne 0x401d4d
push 0x3ea
call fcn.00401c40
push esi
call sub.WSOCK32.dll_closesocket
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0040375c
add esp, 0x20
ret
lea ebx, [edi + 4]
mov eax, ebx
call fcn.00402530
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [edi + 0x18], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], edx
mov dword [edi + 0x24], eax
mov eax, ebx
mov dword [edi + 0x14], esi
call fcn.00402540
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0040375c
add esp, 0x20
ret
Function at 0x401da0
Capabilities:
Get socket status
Terminate thread

Disassembly:
sub esp, 0x11c
push ebx
push ebp
push esi
push edi
mov edi, eax
call fcn.00402060
test al, al
jne 0x401dca
push 0x2749
call fcn.00401c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret
mov eax, dword [edi]
mov ebp, dword [sym.imp.KERNEL32.dll_ResetEvent]
push eax
call ebp
lea ebx, [edi + 4]
mov eax, ebx
call fcn.00402530
mov esi, dword [edi + 0x14]
mov eax, ebx
mov dword [edi + 0x14], 0xffffffff
call fcn.00402540
push 1
push esi
call sub.WSOCK32.dll_shutdown
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
lea edx, [esp + 0x2c]
push edx
push 1
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], 1
mov dword [esp + 0x2c], 0xa
mov dword [esp + 0x30], 0
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
jne 0x401e39
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.00401c40
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi + 0x38]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x1388
push eax
call ebx
push esi
call sub.WSOCK32.dll_closesocket
mov edx, dword [edi + 0x38]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x14], 0x103
jne 0x401e8c
mov eax, dword [edi]
push 0x7d0
push eax
call ebx
mov ecx, dword [edi]
push ecx
call ebp
mov edx, dword [edi + 0x38]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0x38], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret

Function at 0x401f80
Capabilities:
Send data
Send data on socket

Disassembly:
push edi
mov edi, eax
call fcn.00402060
test al, al
jne 0x401f9c
push 0x2749
call fcn.00401c40
xor eax, eax
pop edi
ret 8
push esi
lea esi, [edi + 4]
mov eax, esi
call fcn.00402530
mov edi, dword [edi + 0x14]
mov eax, esi
call fcn.00402540
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0
push eax
push ecx
push edi
call sub.WSOCK32.dll_send
pop esi
pop edi
ret 8
Function at 0x402080
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x204
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x200], eax
push ebp
push esi
lea ebp, [ebx + 4]
push edi
mov eax, ebp
call fcn.00402530
mov esi, dword [ebx + 0x14]
mov eax, ebp
call fcn.00402540
cmp esi, 0xffffffff
je 0x402139
push 0x200
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
push 0x200
lea ecx, [esp + 0x14]
push ecx
push esi
call sub.WSOCK32.dll_recv
mov edi, eax
cmp edi, 0xffffffff
je 0x40213e
test edi, edi
jle 0x402172
mov eax, ebp
call fcn.00402530
lea edx, [esp + 0xc]
push edx
lea esi, [ebx + 8]
call fcn.00402360
mov esi, dword [ebx + 0x28]
mov edi, dword [ebx + 0x2c]
mov eax, ebp
call fcn.00402540
test esi, esi
je 0x402115
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
test edi, edi
je 0x40211f
push ebx
call edi
add esp, 4
mov eax, ebp
call fcn.00402530
mov esi, dword [ebx + 0x14]
mov eax, ebp
call fcn.00402540
cmp esi, 0xffffffff
jne 0x4020b4
mov eax, dword [ebx]
push eax
jmp 0x402197
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov edi, ebx
call fcn.00401c40
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x402159
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x402166
push ebx
call eax
add esp, 4
mov eax, ebx
call fcn.00401da0
mov ecx, dword [ebx]
push ecx
jmp 0x402197
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x402180
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x40218d
push ebx
call eax
add esp, 4
mov eax, ebx
call fcn.00401da0
mov edx, dword [ebx]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 0x20c]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0040375c
add esp, 0x204
ret
Function at 0x40375c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x407018]
jne 0x403766
repz ret
jmp fcn.00403b95
Function at 0x10181f83
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1027a888]
jne 0x10181f8d
repz ret
jmp fcn.1018b67c

Function at 0x1018ff5b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10180c14
and dword [ebp - 4], 0
cmp dword [0x1027c008], 0
mov ebx, eax
jne 0x1019000c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x101900bd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x101900bd
push eax
call fcn.10180ba2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1027c008], eax
call esi
push eax
call fcn.10180ba2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1027c00c], eax
call esi
push eax
call fcn.10180ba2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1027c010], eax
call esi
push eax
call fcn.10180ba2
pop ecx
mov dword [0x1027c018], eax
test eax, eax
je 0x1019000c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10180ba2
pop ecx
mov dword [0x1027c014], eax
mov eax, dword [0x1027c014]
cmp eax, ebx
je 0x10190064
cmp dword [0x1027c018], ebx
je 0x10190064
push eax
call fcn.10180c1d
push dword [0x1027c018]
mov esi, eax
call fcn.10180c1d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10190064
test edi, edi
je 0x10190064
call esi
test eax, eax
je 0x1019005b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1019005b
test byte [ebp - 0xc], 1
jne 0x10190064
or dword [ebp + 0x10], 0x200000
jmp 0x1019009d
mov eax, dword [0x1027c00c]
cmp eax, ebx
je 0x1019009d
push eax
call fcn.10180c1d
pop ecx
test eax, eax
je 0x1019009d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1019009d
mov eax, dword [0x1027c010]
cmp eax, ebx
je 0x1019009d
push eax
call fcn.10180c1d
pop ecx
test eax, eax
je 0x1019009d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1027c008]
call fcn.10180c1d
pop ecx
test eax, eax
je 0x101900bd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x101900bf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10194bb9
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
call fcn.10001089
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
jne 0x10194cf0
lea eax, [esp + 0x38]
mov dword [esp + 0x20], eax
call fcn.101954cc
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x1c], ecx
je 0x10194c03
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
jmp 0x10194cf0
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.101948d8
lea ecx, [0x10195f49]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x8c], edx
mov dword [esp + 0x78], 0x123a00
mov edx, dword [0x1027a0a0]
mov dword [esp + 0x60], edx
mov edx, dword [0x1027a0a4]
mov dword [esp + 0x38], edx
mov edx, dword [0x1027a0a8]
mov dword [esp + 0x70], edx
mov edx, dword [0x1027a0ac]
mov dword [esp + 0x58], edx
mov edx, dword [0x1027a0b0]
mov dword [esp + 0x80], edx
mov dword [0x1027a0b4], 0x1b55
mov dword [0x1027a0b8], 0x19df
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x10194cdf
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x50], ecx
mov dword [0x1027a0b8], 0x3d
mov dword [0x1027a0b4], 0xffffdef4
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x88], esi
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1019584e
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x1027a0b4], 0x9dd
mov dword [esp + 0x1c], eax
jmp 0x10194bf6
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x10194d20
jmp 0x10194cfa
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov dword [0x1027a0b4], 0x795
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
jmp 0x10194cdf
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x10194c7b
jmp 0x10194cfa
Function at 0x10194f34
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1027a0c0], 0
mov byte [0x1027a0c4], 0
mov dword [0x1027a0b8], 0x37b
mov dword [0x1027a0bc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10194f9d
mov eax, dword [0x1027a0b8]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x10194ff8
mov dword [0x1027a0b4], 0x1374
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1027a0b4], 0x195
mov dword [0x1027a0b8], 0xfffff8ce
mov eax, dword [0x1027a0bc]
add eax, 1
mov dword [0x1027a0bc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10194f9d
mov eax, 0xfffff8ce
xor ecx, ecx
mov dword [0x1027a0b4], 0x6f3
mov dword [0x1027a0bc], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x1027a0c8], 0
mov esi, dword [0x1027a0c0]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x30], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x1027a0c8], ebx
add ecx, 0xffffe110
mov dword [0x1027a0b4], ecx
mov eax, ebx
cdq
mov ecx, dword [ebp - 0x30]
idiv ecx
mov dword [0x1027a0c0], edx
mov dword [0x1027a0b8], 0x2010
mov ebx, dword [ebp - 0x2c]
mov cl, byte [edi + ebx]
mov byte [0x1027a0c4], cl
mov dword [0x1027a0b4], 0x21db
mov cl, byte [edi + edx]
mov byte [edi + ebx], cl
mov cl, byte [0x1027a0c4]
mov edx, dword [0x1027a0c0]
mov byte [edi + edx], cl
mov edx, dword [0x1027a0bc]
add edx, 1
mov dword [0x1027a0bc], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x10194f7b
jmp 0x10194f8b
Function at 0x101954cc
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1027a0b8], 0x8e3
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x101955a0
mov dword [0x1027a0b4], 0x157c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x101955eb
jmp 0x10195602
mov eax, dword [ebp - 0x18]
mov dword [0x1027a0b4], 0x4c9
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x101955d6
jmp 0x10195602
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff5
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2], 0x61
je 0x10195585
jmp 0x10195602
mov dword [0x1027a0b4], 0x192b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x10195505
jmp 0x10195602
mov dword [0x1027a0b8], 0x27
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1019556a
jmp 0x10195602
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], edx
je 0x10195527
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
jl 0x101955a0
jmp 0x10195527
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1019554c
jmp 0x10195602
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
je 0x10195611
xor eax, eax
mov dword [0x1027a0b4], 0x8eb
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esp, 0x24
pop ebp
ret
Function at 0x1019584e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x10258eed]
mov esi, 0xe
lea edi, [ebp - 0x2c]
mov dword [0x1027a0b8], 0x1712
mov ebx, dword [0x1027a0b4]
add ebx, 0xffffecd1
mov dword [0x1027a0b4], ebx
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], esi
call fcn.101950ba
mov dword [0x1027a0b8], 0xa58
call fcn.101953ec
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.10194d3a
mov dword [0x1027a0b4], 0x4cc
cmp eax, 0
sete cl
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], cl
xor eax, eax
mov cl, byte [ebp - 0x41]
test cl, 1
mov dword [ebp - 0x48], eax
jne 0x101959a5
jmp 0x10195914
mov eax, dword [ebp - 0x4c]
add eax, 0x20ea
mov dword [0x1027a0b8], 0x6cd
mov dword [0x1027a0b4], 0x1dc0
mov dword [ebp - 0x48], eax
jmp 0x101959a5
mov eax, dword [ebp - 0x40]
mov dword [0x1027a0b4], 0x1780
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x30]
mov dword [esp + 4], ecx
mov dword [ebp - 0x4c], eax
call fcn.1019563b
xor eax, eax
mov dword [0x1027a0b4], 0x6a3
mov dword [0x1027a0b8], 0x1c22
mov ecx, dword [ebp - 0x4c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x4c], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [edx + 8], ecx
cmp ecx, 0
mov dword [ebp - 0x48], eax
jne 0x101958f0
mov eax, dword [ebp - 0x48]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10195b82
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov ecx, dword [0x1027a0b4]
mov edx, ecx
add edx, 0xfffff6a0
mov dword [0x1027a0b8], edx
add ecx, 0xffffdda3
mov dword [0x1027a0b4], ecx
mov dword [ebp - 0x10], eax
call fcn.101951da
xor ecx, ecx
mov edx, eax
mov dword [0x1027a0b8], 0x3d
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x10195be8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x1027a0b4], 0xffffe1e3
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x10195cad
jmp 0x10195cb8
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x1027a0b8], 0xffffd675
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edx
jmp 0x10195ccd
mov al, byte [ebp - 0x4d]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x54]
add edx, 1
mov ah, byte [ebp - 0x55]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x4c], edx
jne 0x10195ccd
jmp 0x10195cfa
mov eax, dword [ebp - 0x44]
movzx ecx, word [eax]
mov dword [0x1027a0b8], 0x257f
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x1027a0b4], 0x2299
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
jmp 0x10195c2d
mov eax, dword [ebp - 0x4c]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x4d], bh
mov byte [ebp - 0x55], cl
jne 0x10195c53
mov al, byte [ebp - 0x55]
test al, 1
jne 0x10195c7e
jmp 0x10195d07
xor eax, eax
mov ecx, dword [ebp - 0x44]
add ecx, 2
mov edx, dword [ebp - 0x40]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], eax
jb 0x10195c2d
jmp 0x10195cad