joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13c6076
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ecx, dword [0x41f214]
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], ecx
mov eax, dword [eax + 0x10]
call dword [eax]
xor ebx, ebx
mov edi, eax
inc ebx
push 0x1c
push ebx
call fcn.013a300b
add esp, 8
mov esi, eax
mov dword [esi], 0
mov dword [esi + 4], edi
cmp dword [edi], ebx
jne 0x13c6109
xorps xmm0, xmm0
xor edi, edi
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
call fcn.013caf16
mov byte [esp + edi], al
inc edi
cmp edi, 0x20
jne 0x13c60c1
mov edi, esp
mov ebx, 0x20
and byte [edi], 0xf8
mov al, byte [edi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
push ebx
push edi
call fcn.013be960
add esp, 8
mov dword [esi + 0x18], eax
push ebx
push edi
call fcn.013d78fa
add esp, 8
mov eax, dword [esi + 0x18]
test eax, eax
je 0x13c615e
mov ecx, dword [esi + 4]
add ecx, 0x1c
jmp 0x13c6127
push dword [edi + 0x1c]
push dword [0x41f164]
call fcn.013beb33
add esp, 8
test eax, eax
mov dword [esi + 0x18], eax
je 0x13c615e
mov ecx, dword [esi + 4]
add ecx, 0x20
push eax
push ecx
call fcn.013c3e83
add esp, 8
test eax, eax
je 0x13c6153
mov ecx, dword [eax + 4]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0
push eax
call fcn.013a31d8
add esp, 4
jmp 0x13c6169
push dword [esi + 0x18]
call fcn.013bcbe2
add esp, 4
push esi
call fcn.013a31d8
add esp, 4
xor esi, esi
mov ecx, dword [esp + 0x28]
call fcn.013df522
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x13c8909
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 0x10]
mov eax, dword [0x41f214]
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
movaps xmm0, xmmword [0x40f220]
test edi, edi
mov dword [esp + 0x48], eax
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
jle 0x13c8968
mov al, byte [ebx]
xor al, 0x36
cmp edi, 1
mov byte [esp], al
je 0x13c8968
xor eax, eax
inc eax
mov cl, byte [ebx + eax]
xor byte [esp + eax], cl
lea ecx, [eax + 1]
cmp ecx, edi
jge 0x13c8968
cmp eax, 0x3f
mov eax, ecx
jl 0x13c8954
movaps xmm0, xmmword [0x40f1e0]
mov esi, esp
xor eax, eax
movups xmmword [edx], xmm0
mov dword [edx + 0x50], eax
mov dword [edx + 0x58], eax
mov dword [edx + 0x54], eax
push 0x40
push esi
push edx
call fcn.013c7f66
add esp, 0xc
movaps xmm0, xmmword [0x40f230]
test edi, edi
movaps xmmword [esi + 0x30], xmm0
movaps xmmword [esi + 0x20], xmm0
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
jle 0x13c89c8
mov al, byte [ebx]
xor al, 0x5c
cmp edi, 1
mov byte [esp], al
je 0x13c89c8
xor eax, eax
inc eax
mov cl, byte [ebx + eax]
xor byte [esp + eax], cl
lea ecx, [eax + 1]
cmp ecx, edi
jge 0x13c89c8
cmp eax, 0x3f
mov eax, ecx
jl 0x13c89b4
mov eax, dword [ebp + 8]
movaps xmm0, xmmword [0x40f1e0]
mov edi, 0x40
xor ecx, ecx
movups xmmword [eax + 0x5c], xmm0
mov dword [eax + 0xac], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb0], ecx
lea eax, [eax + 0x5c]
push edi
push esi
push eax
call fcn.013c7f66
add esp, 0xc
push edi
push esi
call fcn.013d78fa
add esp, 8
mov ecx, dword [esp + 0x48]
call fcn.013df522
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x13ca6ce
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x404
mov eax, dword [0x41f214]
mov edi, ecx
mov ebx, esp
mov dword [esp + 0x400], eax
push edi
push 0x3ff
push 1
push ebx
call fcn.013ee167
add esp, 0x10
mov esi, eax
push edi
call fcn.013eef91
add esp, 4
test esi, esi
js 0x13ca716
xor edi, edi
inc edi
cmp esi, 0x20
jge 0x13ca71d
mov esi, edi
jmp 0x13ca8a7
xor esi, esi
jmp 0x13ca8a7
cmp esi, 0x400
jb 0x13ca73c
push 0x674
push 0x40f59e
push 0x40f8cc
call fcn.013ec93a
add esp, 0xc
mov byte [esp + esi], 0
push 0x20
push 0x40f2b7
push ebx
call fcn.013e0319
add esp, 0xc
test eax, eax
je 0x13ca87f
push 0x1a
push 0x40f68f
push ebx
call fcn.013e0319
add esp, 0xc
test eax, eax
je 0x13ca886
push 0x14
push 0x40f6aa
push ebx
call fcn.013e0319
add esp, 0xc
test eax, eax
je 0x13ca88d
push 0x1e
push 0x40f6e0
push ebx
call fcn.013e0319
add esp, 0xc
test eax, eax
je 0x13ca894
push 0xb
push 0x40f6ff
push ebx
call fcn.013e0319
add esp, 0xc
test eax, eax
je 0x13ca89b
push 0x20
push 0x40f6bf
push ebx
call fcn.013e0319
add esp, 0xc
test eax, eax
je 0x13ca8a2
push 0x403ac0
push ebx
call fcn.013ef5dc
add esp, 8
cmp byte [esp + eax], 0x20
jne 0x13ca82d
lea esi, [esp + eax]
lea eax, [esi + 1]
push 0x403ac0
push eax
call fcn.013ef5dc
add esp, 8
cmp byte [esi + eax + 1], 0x20
jne 0x13ca82d
lea esi, [esi + eax + 1]
lea eax, [esi + 1]
push 0x403ac0
push eax
call fcn.013ef5dc
add esp, 8
mov al, byte [esi + eax + 1]
mov esi, 8
test al, al
je 0x13ca8a7
cmp al, 0xa
je 0x13ca8a7
cmp al, 0x20
je 0x13ca8a7
push 0x40f73c
push ebx
call fcn.013ef1fc
add esp, 8
mov esi, eax
push ebx
push esi
call fcn.013c93a7
add esp, 8
test eax, eax
je 0x13ca70f
lea eax, [esp + esi + 1]
lea ebx, [esp + esi]
push 0x40306d
push eax
call fcn.013ef5dc
add esp, 8
mov al, byte [eax + ebx + 1]
mov esi, 0xa
test al, al
je 0x13ca8a7
cmp al, 0xa
je 0x13ca8a7
cmp al, 0x20
jne 0x13ca70f
jmp 0x13ca8a7
mov esi, 2
jmp 0x13ca8a7
mov esi, 9
jmp 0x13ca8a7
mov esi, 3
jmp 0x13ca8a7
mov esi, 6
jmp 0x13ca8a7
mov esi, 5
jmp 0x13ca8a7
mov esi, 7
mov ecx, dword [esp + 0x400]
call fcn.013df522
mov eax, esi
add esp, 0x404
pop esi
pop edi
pop ebx
ret

Function at 0x13caf5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ebp, 0x258
push 1
push ebp
call fcn.013a300b
add esp, 8
mov esi, eax
call fcn.013cac69
mov eax, 0x41d1c4
add eax, dword [0x41d674]
push ebp
push eax
push esi
call fcn.013e1a9c
add esp, 0xc
mov dword [ebx], ebp
mov dword [edi], esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.013cac69
Function at 0x13cc980
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov dword [esp], edx
mov ebp, dword [esp + 0x70]
mov ebx, ecx
mov eax, dword [0x41f214]
test ebp, ebp
mov dword [esp + 0x50], eax
jle 0x13cca49
mov esi, dword [esp + 0x6c]
xor edx, edx
mov eax, dword [ebx + 0x14]
mov dword [esp + 8], ebp
cmp ebp, eax
cmovg ebp, eax
cmp eax, 0x41
jl 0x13cc9d3
push 0x3ba
push 0x40fa00
push 0x40face
mov edi, edx
call fcn.013ec93a
mov edx, edi
add esp, 0xc
mov eax, edx
mov dword [esp + 4], edx
shr eax, 0x18
mov byte [esp + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0xd], al
mov byte [esp + 0xe], dh
mov byte [esp + 0xf], dl
call dword [ebx]
mov edi, ebx
mov ebx, eax
push dword [esp + 0x68]
push dword [esp + 4]
push ebx
call dword [edi + 8]
add esp, 0xc
push 4
lea eax, [esp + 0x10]
push eax
push ebx
call dword [edi + 8]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ebx
mov ebx, edi
call dword [ebx + 0xc]
add esp, 8
test ebp, ebp
jle 0x13cca34
xor eax, eax
mov cl, byte [esp + eax + 0x10]
xor byte [esi + eax], cl
inc eax
cmp eax, ebp
jl 0x13cca28
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
add esi, ebp
inc edx
sub eax, ebp
mov ebp, eax
jg 0x13cc9a7
mov ecx, dword [esp + 0x50]
call fcn.013df522
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x13ce774
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14c
mov eax, dword [0x41f214]
mov esi, dword [esp + 0x164]
mov edx, dword [esp + 0x160]
lea edi, [esp + 8]
mov ecx, 0x10
mov dword [esp + 0x148], eax
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + eax*4 + 0x28]
xor ecx, dword [esp + eax*4 + 0x3c]
xor ecx, dword [esp + eax*4 + 0x10]
xor ecx, dword [esp + eax*4 + 8]
rol ecx, 1
mov dword [esp + eax*4 + 0x48], ecx
inc eax
cmp eax, 0x40
jne 0x13ce7a5
movdqu xmm0, xmmword [edx]
mov esi, dword [edx + 0x10]
xor eax, eax
pshufd xmm1, xmm0, 0xe5
pshufd xmm3, xmm0, 0x4e
pshufd xmm2, xmm0, 0xe7
movd ecx, xmm0
mov edi, esi
mov dword [esp + 4], esi
movd ebp, xmm1
movd ebx, xmm3
movd edx, xmm2
mov dword [esp], edi
mov edi, edx
mov edx, ebx
mov ebx, ebp
mov esi, ebx
and ebp, edx
rol ebx, 0x1e
not esi
and esi, edi
or esi, ebp
mov ebp, ecx
rol ecx, 5
add esi, dword [esp]
add esi, ecx
mov ecx, dword [esp + eax*4 + 8]
inc eax
cmp eax, 0x14
lea ecx, [ecx + esi + 0x5a827999]
jne 0x13ce7ef
xor eax, eax
mov esi, edi
mov edi, edx
mov edx, ebx
mov ebx, ebp
mov ebp, ecx
mov ecx, edi
xor ecx, ebx
rol ebx, 0x1e
xor ecx, edx
add ecx, esi
mov esi, ebp
rol esi, 5
add ecx, esi
mov esi, dword [esp + eax*4 + 0x58]
inc eax
cmp eax, 0x14
lea ecx, [esi + ecx + 0x6ed9eba1]
jne 0x13ce822
xor eax, eax
mov esi, edx
mov edx, ebx
mov ebx, ebp
mov dword [esp], edi
mov ebp, edx
mov edi, edx
or ebp, esi
and edi, esi
and ebp, ebx
rol ebx, 0x1e
or edi, ebp
mov ebp, ecx
rol ecx, 5
add edi, dword [esp]
add edi, ecx
mov ecx, dword [esp + eax*4 + 0xa8]
inc eax
cmp eax, 0x14
lea ecx, [ecx + edi - 0x70e44324]
mov edi, esi
jne 0x13ce851
xor eax, eax
mov esi, edi
mov edi, edx
mov edx, ebx
mov ebx, ebp
mov ebp, ecx
mov ecx, edi
xor ecx, ebx
rol ebx, 0x1e
xor ecx, edx
add ecx, esi
mov esi, ebp
rol esi, 5
add ecx, esi
mov esi, dword [esp + eax*4 + 0xf8]
inc eax
cmp eax, 0x14
lea ecx, [esi + ecx - 0x359d3e2a]
jne 0x13ce88b
movd xmm1, edx
movd xmm2, ebx
movd xmm4, ebp
movd xmm3, ecx
mov eax, dword [esp + 0x160]
punpckldq xmm2, xmm1
punpckldq xmm3, xmm4
punpcklqdq xmm3, xmm2
paddd xmm0, xmm3
movdqu xmmword [eax], xmm0
mov ecx, dword [esp + 4]
add ecx, edi
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x148]
call fcn.013df522
add esp, 0x14c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x13cec9a
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, dword [ebp + 8]
mov eax, dword [0x41f214]
movaps xmm0, xmmword [0x40f220]
mov edi, edx
mov esi, ecx
test ebx, ebx
mov dword [esp + 0x48], eax
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
jle 0x13cecf7
mov al, byte [edi]
xor al, 0x36
cmp ebx, 1
mov byte [esp], al
je 0x13cecf7
xor eax, eax
inc eax
mov cl, byte [edi + eax]
xor byte [esp + eax], cl
lea ecx, [eax + 1]
cmp ecx, ebx
jge 0x13cecf7
cmp eax, 0x3f
mov eax, ecx
jl 0x13cece3
movaps xmm0, xmmword [0x40f1e0]
xor eax, eax
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x54], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x58], eax
mov eax, esp
push 0x40
push eax
push esi
call fcn.013ce927
add esp, 0xc
movaps xmm0, xmmword [0x40f230]
mov eax, esp
test ebx, ebx
mov edx, eax
movaps xmmword [eax + 0x30], xmm0
movaps xmmword [eax + 0x20], xmm0
movaps xmmword [eax + 0x10], xmm0
movaps xmmword [eax], xmm0
jle 0x13ced62
mov al, byte [edi]
xor al, 0x5c
cmp ebx, 1
mov byte [esp], al
je 0x13ced62
xor eax, eax
inc eax
mov cl, byte [edi + eax]
xor byte [esp + eax], cl
lea ecx, [eax + 1]
cmp ecx, ebx
jge 0x13ced62
cmp eax, 0x3f
mov eax, ecx
jl 0x13ced4e
movaps xmm0, xmmword [0x40f1e0]
xor eax, eax
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], 0xc3d2e1f0
mov dword [esi + 0xb4], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xb8], eax
lea eax, [esi + 0x60]
mov esi, 0x40
push esi
mov edi, edx
push edi
push eax
call fcn.013ce927
add esp, 0xc
push esi
push edi
call fcn.013d78fa
add esp, 8
mov ecx, dword [esp + 0x48]
call fcn.013df522
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x13d5ade
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x41f214]
mov ebp, dword [esp + 0x4c]
xor esi, esi
inc esi
mov dword [esp + 0x28], eax
push dword [esp + 0x50]
push ebp
push dword [esp + 0x50]
push dword [esp + 0x50]
call fcn.013dd7b3
add esp, 0x10
test eax, eax
je 0x13d5c41
mov edi, dword [esp + 0x54]
cmp eax, 1
je 0x13d5b43
cmp eax, 2
jne 0x13d5baa
mov ebx, dword [0x41d700]
push 2
call fcn.013e2e0b
add esp, 4
cmp ebx, 0
je 0x13d5b6a
push edi
push ebp
push 0x4118c3
push eax
jmp 0x13d5b60
mov ebx, dword [0x41d700]
push 2
call fcn.013e2e0b
add esp, 4
cmp ebx, 0
je 0x13d5b87
push edi
push ebp
push 0x41164b
push eax
call fcn.013a284c
jmp 0x13d5c17
push edi
push ebp
push 0x411a0a
push eax
call fcn.013a284c
add esp, 0x10
push 2
call fcn.013e2e0b
add esp, 4
push eax
jmp 0x13d5ba2
push edi
push ebp
push 0x411705
push eax
call fcn.013a284c
add esp, 0x10
push 2
call fcn.013e2e0b
add esp, 4
push eax
call fcn.013ed982
add esp, 4
lea ebp, [esp + 8]
mov byte [ebp], 0
push 0xfffffffffffffff6
call dword [0x4833b8]
lea ebx, [esp + 4]
mov edi, eax
push ebx
push edi
call dword [0x483364]
mov eax, dword [ebx]
mov esi, dword [0x48345c]
or eax, 7
push eax
push edi
call esi
mov eax, esp
push 0
push eax
push 0x1f
push ebp
push edi
call dword [0x483444]
push dword [ebx]
push edi
call esi
movzx eax, byte [ebp]
cmp eax, 0xd
ja 0x13d5c1e
mov ecx, 0x2401
bt ecx, eax
jae 0x13d5c1e
push 2
call fcn.013e2e0b
add esp, 4
push eax
push 1
push 0x16
push 0x411caf
call fcn.013ee4d5
add esp, 0x10
xor esi, esi
jmp 0x13d5c41
cmp al, 0x79
je 0x13d5c26
cmp al, 0x59
jne 0x13d5c3e
push dword [esp + 0x50]
push dword [esp + 0x50]
push dword [esp + 0x50]
push dword [esp + 0x50]
call fcn.013ddac2
add esp, 0x10
xor esi, esi
inc esi
mov ecx, dword [esp + 0x28]
call fcn.013df522
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x13d5c54
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x41f214]
mov dword [esp + 0x28], eax
mov esi, dword [0x41d700]
push 2
call fcn.013e2e0b
add esp, 4
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
cmp esi, 0
je 0x13d5c95
push edx
push ecx
push 0x411d44
push eax
call fcn.013a284c
add esp, 0x10
xor esi, esi
jmp 0x13d5d01
push edx
push ecx
push 0x411cc6
push eax
call fcn.013a284c
add esp, 0x10
push 2
call fcn.013e2e0b
add esp, 4
push eax
call fcn.013ed982
add esp, 4
push 0xfffffffffffffff6
call dword [0x4833b8]
lea edi, [esp + 4]
mov esi, eax
push edi
push esi
call dword [0x483364]
mov eax, dword [edi]
mov ebx, dword [0x48345c]
or eax, 7
push eax
push esi
call ebx
mov eax, esp
lea ebp, [esp + 8]
push 0
push eax
push 0x1f
push ebp
push esi
call dword [0x483444]
push dword [edi]
push esi
call ebx
mov al, byte [ebp]
or al, 0x20
cmp al, 0x79
jne 0x13d5d14
xor esi, esi
inc esi
mov ecx, dword [esp + 0x28]
call fcn.013df522
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.013e2e0b
add esp, 4
push eax
push 1
push 0x16
push 0x411db8
call fcn.013ee4d5
jmp 0x13d5c8e
Function at 0x13d5d32
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x41f214]
mov dword [esp + 0x28], eax
mov esi, dword [0x41d700]
push 2
call fcn.013e2e0b
add esp, 4
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
cmp esi, 0
je 0x13d5d73
push edx
push ecx
push 0x411ecd
push eax
call fcn.013a284c
add esp, 0x10
xor esi, esi
jmp 0x13d5ddf
push edx
push ecx
push 0x411dcf
push eax
call fcn.013a284c
add esp, 0x10
push 2
call fcn.013e2e0b
add esp, 4
push eax
call fcn.013ed982
add esp, 4
push 0xfffffffffffffff6
call dword [0x4833b8]
lea edi, [esp + 4]
mov esi, eax
push edi
push esi
call dword [0x483364]
mov eax, dword [edi]
mov ebx, dword [0x48345c]
or eax, 7
push eax
push esi
call ebx
mov eax, esp
lea ebp, [esp + 8]
push 0
push eax
push 0x1f
push ebp
push esi
call dword [0x483444]
push dword [edi]
push esi
call ebx
mov al, byte [ebp]
or al, 0x20
cmp al, 0x79
jne 0x13d5df2
xor esi, esi
inc esi
mov ecx, dword [esp + 0x28]
call fcn.013df522
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call fcn.013e2e0b
add esp, 4
push eax
push 1
push 0x16
push 0x411fc1
call fcn.013ee4d5
jmp 0x13d5d6c

Function at 0x13dacf4
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x41f214]
mov ebx, dword [esp + 0x1c]
mov edi, 2
mov dword [esp + 4], eax
push edi
call fcn.013e2e0b
add esp, 4
push eax
push 1
push 0xd
push 0x413d3b
call fcn.013ee4d5
add esp, 0x10
lea ebp, [esp + 0x20]
mov dword [esp], ebp
push edi
call fcn.013e2e0b
add esp, 4
mov esi, eax
call fcn.013a2274
push ebp
push 0
push ebx
push esi
push dword [eax + 4]
push dword [eax]
call fcn.013e609d
add esp, 0x18
push edi
call fcn.013e2e0b
add esp, 4
push eax
push 0xa
call fcn.013edcf5
add esp, 8
mov eax, dword [0x41df30]
test eax, eax
je 0x13dad81
push eax
call fcn.013a2cac
add esp, 4
mov dword [0x41df30], 0
push 1
call fcn.013d5ac8
add esp, 4
mov ecx, dword [esp + 4]
call fcn.013df522
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x13dadc6
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x41f214]
mov ebx, dword [esp + 0x1c]
mov edi, 2
mov dword [esp + 4], eax
push edi
call fcn.013e2e0b
add esp, 4
push eax
push 1
push 7
push 0x413d49
call fcn.013ee4d5
add esp, 0x10
lea ebp, [esp + 0x20]
mov dword [esp], ebp
push edi
call fcn.013e2e0b
add esp, 4
mov esi, eax
call fcn.013a2274
push ebp
push 0
push ebx
push esi
push dword [eax + 4]
push dword [eax]
call fcn.013e609d
add esp, 0x18
push edi
call fcn.013e2e0b
add esp, 4
push eax
push 0xa
call fcn.013edcf5
add esp, 8
mov ecx, dword [esp + 4]
call fcn.013df522
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x13dae48
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x41f214]
mov ebx, dword [esp + 0x20]
mov edi, 2
mov dword [esp + 4], eax
push edi
call fcn.013e2e0b
add esp, 4
push eax
push 1
push 0xd
push 0x413d3b
call fcn.013ee4d5
add esp, 0x10
lea ebp, [esp + 0x24]
mov dword [esp], ebp
push edi
call fcn.013e2e0b
add esp, 4
mov esi, eax
call fcn.013a2274
push ebp
push 0
push ebx
push esi
push dword [eax + 4]
push dword [eax]
call fcn.013e609d
add esp, 0x18
push edi
call fcn.013e2e0b
add esp, 4
push eax
push 0xa
call fcn.013edcf5
add esp, 8
mov eax, dword [0x41df30]
test eax, eax
je 0x13daed5
push eax
call fcn.013a2cac
add esp, 4
mov dword [0x41df30], 0
push 1
call fcn.013d5ac8
add esp, 4
mov ecx, dword [esp + 4]
call fcn.013df522
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x13daef0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
mov edi, 2
push edi
call fcn.013e2e0b
add esp, 4
xor esi, esi
inc esi
push eax
push esi
push 7
push 0x413d51
call fcn.013ee4d5
add esp, 0x10
lea ebp, [esp + 0x1c]
mov dword [esp], ebp
push edi
call fcn.013e2e0b
add esp, 4
push ebp
push ebx
push eax
call fcn.013dad9c
add esp, 0xc
push edi
call fcn.013e2e0b
add esp, 4
push eax
push 0xa
call fcn.013edcf5
add esp, 8
push esi
call fcn.013eaff5

Function at 0x13daf0c
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
mov edi, 2
push edi
call fcn.013e2e0b
add esp, 4
xor esi, esi
inc esi
push eax
push esi
push 7
push 0x413d51
call fcn.013ee4d5
add esp, 0x10
lea ebp, [esp + 0x1c]
mov dword [esp], ebp
push edi
call fcn.013e2e0b
add esp, 4
push ebp
push ebx
push eax
call fcn.013dad9c
add esp, 0xc
push edi
call fcn.013e2e0b
add esp, 4
push eax
push 0xa
call fcn.013edcf5
add esp, 8
push esi
call fcn.013eaff5
Function at 0x13dbee6
Capabilities:
Terminate process

Disassembly:
push 0x413ea0
call fcn.013eea1e
add esp, 4
push 0x411500
call fcn.013eea1e
add esp, 4
push 0x413ed0
call fcn.013eea1e
add esp, 4
push 0x413f00
call fcn.013eea1e
add esp, 4
push 0x413f37
call fcn.013eea1e
add esp, 4
push 0x413f40
call fcn.013eea1e
add esp, 4
push 0x413f70
call fcn.013eea1e
add esp, 4
push 0x413fa0
call fcn.013eea1e
add esp, 4
push 0x413fd0
call fcn.013eea1e
add esp, 4
push 0x414010
call fcn.013eea1e
add esp, 4
push 0x414040
call fcn.013eea1e
add esp, 4
push 0x414070
call fcn.013eea1e
add esp, 4
push 0x4140a0
call fcn.013eea1e
add esp, 4
push 0x4140d0
call fcn.013eea1e
add esp, 4
push 0x414100
call fcn.013eea1e
add esp, 4
push 0x414120
call fcn.013eea1e
add esp, 4
push 0x414150
call fcn.013eea1e
add esp, 4
push 0x414190
call fcn.013eea1e
add esp, 4
push 0x4141d0
call fcn.013eea1e
add esp, 4
push 0x414210
call fcn.013eea1e
add esp, 4
push 0x414240
call fcn.013eea1e
add esp, 4
push 0x414260
call fcn.013eea1e
add esp, 4
push 0x414290
call fcn.013eea1e
add esp, 4
push 0x4142c0
call fcn.013eea1e
add esp, 4
push 0x414300
call fcn.013eea1e
add esp, 4
push 0x414330
call fcn.013eea1e
add esp, 4
push 0x414370
call fcn.013eea1e
add esp, 4
push 0x4143a0
call fcn.013eea1e
add esp, 4
push 0x4143d0
call fcn.013eea1e
add esp, 4
push 0x414400
call fcn.013eea1e
add esp, 4
push 0x414440
call fcn.013eea1e
add esp, 4
push 0x414470
call fcn.013eea1e
add esp, 4
push 0x414490
call fcn.013eea1e
add esp, 4
push 0x4144d0
call fcn.013eea1e
add esp, 4
push 0x414500
call fcn.013eea1e
add esp, 4
push 0x414530
call fcn.013eea1e
add esp, 4
push 0x414550
call fcn.013eea1e
add esp, 4
push 0x414590
call fcn.013eea1e
add esp, 4
push 0x4145c0
call fcn.013eea1e
add esp, 4
push 0x414600
call fcn.013eea1e
add esp, 4
push 0x414635
call fcn.013eea1e
add esp, 4
push 0x414650
call fcn.013eea1e
add esp, 4
push 0x414689
call fcn.013eea1e
add esp, 4
push 0x4146a0
call fcn.013eea1e
add esp, 4
push 0x4146c0
call fcn.013eea1e
add esp, 4
push 0x4146eb
call fcn.013eea1e
add esp, 4
push 0x414700
call fcn.013eea1e
add esp, 4
push 1
call fcn.013eaff5