joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004c746
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
pop ebp
mov ecx, dword [esp]
mov edx, dword [esp + 8]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
add esp, 8
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x1004c740
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x1004c746
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x1004c6a1
cmp al, 0x61
jb 0x1004c699
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x1004c68c
cmp edx, dword [esp + 0x14]
je 0x1004c6b1
dec ecx
jne 0x1004c681
xor eax, eax
jmp 0x1004c740
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x1004c740
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x1004c740
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x1004c6f1
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x1004c700
jmp 0x1004c6e8
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call 0x1004c746
test eax, eax
je 0x1004c740
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x1004c73b
cmp al, 0x61
jb 0x1004c733
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x1004c726
call 0x1004c655
mov dword [esp + 0x1c], eax
popal
ret
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x1004c793
mov al, cl
cmp al, 0x61
jb 0x1004c76e
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x1004c793
mov al, cl
cmp al, 0x61
jb 0x1004c786
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x1004c75f
cmp edx, dword [esp + 0x18]
je 0x1004c7a3
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x1004c758
xor eax, eax
jmp 0x1004c7a6
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x1004c7d6
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x1004c7e0
add dword [esp], 5
retf
Function at 0x1004ca40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x1004ca90
mov al, cl
cmp al, 0x61
jb 0x1004ca6b
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x1004ca90
mov al, cl
cmp al, 0x61
jb 0x1004ca83
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x1004ca5c
cmp edx, dword [esp + 0x18]
je 0x1004caa0
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x1004ca55
xor eax, eax
jmp 0x1004caa3
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x1004cabc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x1004cba3
lea esi, [ebx + eax]
test edx, 0xffff0000
je fcn.1004cba9
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x1004cb08
cmp al, 0x61
jb 0x1004cb00
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x1004caf3
cmp edx, dword [esp + 0x14]
je 0x1004cb18
dec ecx
jne 0x1004cae8
xor eax, eax
jmp 0x1004cba3
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x1004cba3
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x1004cba3
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x1004cb54
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x1004cb63
jmp 0x1004cb4b
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.1004cba9
test eax, eax
je 0x1004cba3
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x1004cb9e
cmp al, 0x61
jb 0x1004cb96
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x1004cb89
call fcn.1004cabc
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x1004cba9
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x1004cbf6
mov al, cl
cmp al, 0x61
jb 0x1004cbd1
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x1004cbf6
mov al, cl
cmp al, 0x61
jb 0x1004cbe9
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x1004cbc2
cmp edx, dword [esp + 0x18]
je 0x1004cc06
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x1004cbbb
xor eax, eax
jmp 0x1004cc09
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret
Function at 0x1004d28d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
pushal
test ecx, ecx
je 0x1004d37e
movzx eax, word [ecx]
cmp eax, 0x5a4d
jne 0x1004d385
mov eax, dword [ecx + 0x3c]
lea ebx, [ecx + eax]
mov eax, dword [ebx]
cmp eax, 0x4550
jne 0x1004d385
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x1004d2da
movzx ecx, word [ebx + 0x16]
test ecx, 0x2000
je 0x1004d2da
mov edx, dword [esp + 0x18]
add eax, edx
push 0
push 0
push edx
call eax
mov eax, ebx
mov edx, dword [esp + 0x14]
mov ebx, dword [edx]
mov ecx, dword [eax + 0x74]
cmp ecx, 1
jb 0x1004d336
lea edi, [eax + 0x80]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1004d336
mov edi, dword [edi]
add edi, dword [esp + 0x18]
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x1004d336
add ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
xor edx, edx
inc edx
mov eax, dword [eax + 8]
call eax
mov ecx, eax
mov eax, dword [ebx + 0x1a8]
call eax
test eax, eax
je 0x1004d331
mov ecx, eax
mov eax, dword [ebx + 0x128]
push ecx
call eax
test eax, eax
js 0x1004d38c
lea edi, [edi + 0x14]
jmp 0x1004d2fd
lea edx, [esp + 0x18]
xor ecx, ecx
push ecx
mov ecx, esp
mov eax, dword [ebx + 0xc8]
push 0x8000
push ecx
push edx
push 0xffffffffffffffff
call eax
pop ecx
test eax, eax
js 0x1004d38c
inc eax
mov dword [esp + 0x1c], eax
popal
ret
mov eax, dword [esp + 0x14]
mov ebx, dword [eax]
test edi, edi
jns 0x1004d371
mov eax, dword [ebx + 0x110]
push edi
call eax
mov edi, eax
mov eax, dword [ebx + 0x118]
push edi
call eax
xor eax, eax
jmp 0x1004d356
mov edi, 0x57
jmp 0x1004d35c
mov edi, 0xc1
jmp 0x1004d35c
mov edi, eax
jmp 0x1004d35c
Function at 0x100ee094
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x11c128d0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100ee0cf
add dword [esp], 5
retf

Function at 0x100ee79f
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x11c128d0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100ee7da
add dword [esp], 5
retf

Function at 0x100eec37
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100eec63
add dword [esp], 5
retf

Function at 0x100ef56c
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x11c128d0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100ef5a7
add dword [esp], 5
retf

Function at 0x100f08b5
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x11c128d0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100f08f0
add dword [esp], 5
retf

Function at 0x100f0c52
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x11c128d0]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100f0c8d
add dword [esp], 5
retf

Function at 0x100f0d76
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100f0da2
add dword [esp], 5
retf
Function at 0x100f64b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100f64da
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100f64da
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100f64e4
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100f6526
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100f6588
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100f6583
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100f656e
test dl, dl
je 0x100f656a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100f656e
add ecx, 2
add eax, 2
test dl, dl
jne 0x100f654e
xor eax, eax
jmp 0x100f6573
sbb eax, eax
or eax, 1
test eax, eax
je 0x100f6594
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100f653b
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100f6619
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100f663c
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100f663c
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100f6646
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100f6688
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100f66ea
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100f66e5
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100f66d0
test dl, dl
je 0x100f66cc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100f66d0
add ecx, 2
add eax, 2
test dl, dl
jne 0x100f66b0
xor eax, eax
jmp 0x100f66d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100f66f6
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100f669d
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100f6788
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100f67ab
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100f67ab
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100f67b5
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100f67f7
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100f6859
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100f6854
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100f683f
test dl, dl
je 0x100f683b
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100f683f
add ecx, 2
add eax, 2
test dl, dl
jne 0x100f681f
xor eax, eax
jmp 0x100f6844
sbb eax, eax
or eax, 1
test eax, eax
je 0x100f6865
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100f680c
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100f68f2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100f6915
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100f6915
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100f691f
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100f6961
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100f69c3
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100f69be
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100f69a9
test dl, dl
je 0x100f69a5
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100f69a9
add ecx, 2
add eax, 2
test dl, dl
jne 0x100f6989
xor eax, eax
jmp 0x100f69ae
sbb eax, eax
or eax, 1
test eax, eax
je 0x100f69cf
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100f6976
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100f6a68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100f6a8b
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100f6a8b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100f6a95
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100f6ad7
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100f6b39
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100f6b34
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100f6b1f
test dl, dl
je 0x100f6b1b
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100f6b1f
add ecx, 2
add eax, 2
test dl, dl
jne 0x100f6aff
xor eax, eax
jmp 0x100f6b24
sbb eax, eax
or eax, 1
test eax, eax
je 0x100f6b45
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100f6aec
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100f6bd9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100f6bfc
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100f6bfc
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100f6c06
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100f6c48
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100f6caa
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100f6ca5
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100f6c90
test dl, dl
je 0x100f6c8c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100f6c90
add ecx, 2
add eax, 2
test dl, dl
jne 0x100f6c70
xor eax, eax
jmp 0x100f6c95
sbb eax, eax
or eax, 1
test eax, eax
je 0x100f6cb6
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100f6c5d
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100f6d48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100f6d6b
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100f6d6b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100f6d75
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100f6db7
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100f6e19
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100f6e14
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100f6dff
test dl, dl
je 0x100f6dfb
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100f6dff
add ecx, 2
add eax, 2
test dl, dl
jne 0x100f6ddf
xor eax, eax
jmp 0x100f6e04
sbb eax, eax
or eax, 1
test eax, eax
je 0x100f6e25
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100f6dcc
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100f6eb7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100f6eda
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100f6eda
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100f6ee4
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100f6f26
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100f6f88
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100f6f83
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100f6f6e
test dl, dl
je 0x100f6f6a
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100f6f6e
add ecx, 2
add eax, 2
test dl, dl
jne 0x100f6f4e
xor eax, eax
jmp 0x100f6f73
sbb eax, eax
or eax, 1
test eax, eax
je 0x100f6f94
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100f6f3b
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x101285d2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x101285f5
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc