joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x420294
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x56a8af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202cf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202e8
lea eax, [ebp - 0x10]
mov edx, dword [0x58754c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202fb
lea eax, [ebp - 0x10]
mov edx, dword [0x58754c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x420307
adc edx, 0
mov edx, dword [edx*4 + 0x586378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420481
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420474
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420474
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420412
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420412
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420412
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420412
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420474
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420474
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420499
inc ebx
cmp ebx, 0x19
jne 0x4202c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56a8b6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x6840140c
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27f8
push ebx
push esi
push edi
push edi
add edi, 0x1660a
jmp 0x68401427
pop edi
push eax
add eax, 0x15f3c
xor eax, 0x18292
pop eax
push edx
push ebx
add esp, 4
jmp 0x68401443
and edx, 0xba75
pop edx
mov eax, 0x4d
mov word [ebp - 0x270c], ax
mov ecx, 0x42
mov word [ebp - 0x270a], cx
mov edx, 0x53
mov word [ebp - 0x2708], dx
mov eax, 0x65
mov word [ebp - 0x2706], ax
mov ecx, 0x72
mov word [ebp - 0x2704], cx
mov edx, 0x76
mov word [ebp - 0x2702], dx
mov eax, 0x69
mov word [ebp - 0x2700], ax
mov ecx, 0x63
mov word [ebp - 0x26fe], cx
mov edx, 0x65
mov word [ebp - 0x26fc], dx
mov eax, 0x2e
invalid
invalid
test dword [esi], eax
invalid

Function at 0x684015cd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x65
and ecx, 0xaafc
add ecx, 0x17317
and ecx, 0x1568c
pop ecx
mov dword [ebp - 0x18], 1
push eax
push eax
add esp, 4
sub eax, 0x13872
add eax, 0x7204
and eax, 0x8c78
pop eax
push edi
jmp 0x684015bf
call 0x684015cd
add byte [eax + 0x4f], cl
inc ebp
aas
cmp cl, byte [ebp + 0x34]
cmp eax, dword [ebx + 0x695f04c4]
push ebp
call fcn.684016d6
add edx, 0x56f3663b
imul eax, dword [ebp - 0x18], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x18], 0xfe
sub edx, ecx
mov dword [ebp - 0x1c], edx
push eax
push edi
add esp, 4
add eax, 0xcd00
pop eax
push esi
and esi, 0x11cc8
add esi, 0xc2c9
and esi, 0x7a8
pop esi
push ecx
push eax
add esp, 4
xor ecx, 0x16e42
sub ecx, 0x10e9e
pop ecx
push esi
push edi
add esp, 4
and esi, 0x2ed6
add esi, 0x15cfc
pop esi
push eax
or eax, 0x1551d
xor eax, 0x17753
call 0x6840165d
add byte [eax], bh
inc edi
dec ebx
inc ebx
inc eax
inc eax
push eax
inc ebp
add esp, 4
pop eax
mov dword [ebp - 0x3c], 1
push ebx
jmp 0x68401672
call 0x68401682
add byte [ecx*2 + 0x41433842], dh
inc ecx
inc esp
inc ebp
xor al, 0x83
les eax, [ecx + eax*4]
jmp 0x68401656
Function at 0x68401650
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x65
and ecx, 0xaafc
add ecx, 0x17317
and ecx, 0x1568c
pop ecx
mov dword [ebp - 0x18], 1
push eax
push eax
add esp, 4
sub eax, 0x13872
add eax, 0x7204
and eax, 0x8c78
pop eax
push edi
jmp 0x684015bf
call 0x684015cd
add byte [eax + 0x4f], cl
inc ebp
aas
cmp cl, byte [ebp + 0x34]
cmp eax, dword [ebx + 0x695f04c4]
push ebp
call fcn.684016d6
add edx, 0x56f3663b
imul eax, dword [ebp - 0x18], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x18], 0xfe
sub edx, ecx
mov dword [ebp - 0x1c], edx
push eax
push edi
add esp, 4
add eax, 0xcd00
pop eax
push esi
and esi, 0x11cc8
add esi, 0xc2c9
and esi, 0x7a8
pop esi
push ecx
push eax
add esp, 4
xor ecx, 0x16e42
sub ecx, 0x10e9e
pop ecx
push esi
push edi
add esp, 4
and esi, 0x2ed6
add esi, 0x15cfc
pop esi
push eax
or eax, 0x1551d
xor eax, 0x17753
call 0x6840165d
add byte [eax], bh
inc edi
dec ebx
inc ebx
inc eax
inc eax
push eax
inc ebp
add esp, 4
pop eax
mov dword [ebp - 0x3c], 1
push ebx
jmp 0x68401672
call 0x68401682
add byte [ecx*2 + 0x41433842], dh
inc ecx
inc esp
inc ebp
xor al, 0x83
les eax, [ecx + eax*4]
jmp 0x68401656

Function at 0x6840165d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x65
and ecx, 0xaafc
add ecx, 0x17317
and ecx, 0x1568c
pop ecx
mov dword [ebp - 0x18], 1
push eax
push eax
add esp, 4
sub eax, 0x13872
add eax, 0x7204
and eax, 0x8c78
pop eax
push edi
jmp 0x684015bf
call 0x684015cd
add byte [eax + 0x4f], cl
inc ebp
aas
cmp cl, byte [ebp + 0x34]
cmp eax, dword [ebx + 0x695f04c4]
push ebp
call fcn.684016d6
add edx, 0x56f3663b
imul eax, dword [ebp - 0x18], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x18], 0xfe
sub edx, ecx
mov dword [ebp - 0x1c], edx
push eax
push edi
add esp, 4
add eax, 0xcd00
pop eax
push esi
and esi, 0x11cc8
add esi, 0xc2c9
and esi, 0x7a8
pop esi
push ecx
push eax
add esp, 4
xor ecx, 0x16e42
sub ecx, 0x10e9e
pop ecx
push esi
push edi
add esp, 4
and esi, 0x2ed6
add esi, 0x15cfc
pop esi
push eax
or eax, 0x1551d
xor eax, 0x17753
call 0x6840165d
add byte [eax], bh
inc edi
dec ebx
inc ebx
inc eax
inc eax
push eax
inc ebp
add esp, 4
pop eax
mov dword [ebp - 0x3c], 1
push ebx
jmp 0x68401672
call 0x68401682
add byte [ecx*2 + 0x41433842], dh
inc ecx
inc esp
inc ebp
xor al, 0x83
les eax, [ecx + eax*4]
jmp 0x68401656
Function at 0x68401682
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x65
and ecx, 0xaafc
add ecx, 0x17317
and ecx, 0x1568c
pop ecx
mov dword [ebp - 0x18], 1
push eax
push eax
add esp, 4
sub eax, 0x13872
add eax, 0x7204
and eax, 0x8c78
pop eax
push edi
jmp 0x684015bf
call 0x684015cd
add byte [eax + 0x4f], cl
inc ebp
aas
cmp cl, byte [ebp + 0x34]
cmp eax, dword [ebx + 0x695f04c4]
push ebp
call fcn.684016d6
add edx, 0x56f3663b
imul eax, dword [ebp - 0x18], 0xfe
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x18], 0xfe
sub edx, ecx
mov dword [ebp - 0x1c], edx
push eax
push edi
add esp, 4
add eax, 0xcd00
pop eax
push esi
and esi, 0x11cc8
add esi, 0xc2c9
and esi, 0x7a8
pop esi
push ecx
push eax
add esp, 4
xor ecx, 0x16e42
sub ecx, 0x10e9e
pop ecx
push esi
push edi
add esp, 4
and esi, 0x2ed6
add esi, 0x15cfc
pop esi
push eax
or eax, 0x1551d
xor eax, 0x17753
call 0x6840165d
add byte [eax], bh
inc edi
dec ebx
inc ebx
inc eax
inc eax
push eax
inc ebp
add esp, 4
pop eax
mov dword [ebp - 0x3c], 1
push ebx
jmp 0x68401672
call 0x68401682
add byte [ecx*2 + 0x41433842], dh
inc ecx
inc esp
inc ebp
xor al, 0x83
les eax, [ecx + eax*4]
jmp 0x68401656

Function at 0x68401850
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
imul edx, dword [ebp - 0x1960], 0xfe
sub ecx, edx
xor ecx, dword [ebp - 0x2508]
imul ecx, dword [ebp - 0x1960]
imul eax, dword [ebp - 0x1960], 0xfe
sub ecx, eax
mov dword [ebp - 0x1964], ecx
mov ecx, dword [ebp - 0x12fc]
mov edx, dword [ebp - 0x12f8]
mov dword [ebp - 0x196c], ecx
mov dword [ebp - 0x1968], edx
push esi
push edx
add esp, 4
sub esi, 0x5ce2
pop esi
push ecx
call 0x684018ad
add byte [ecx + 0x49], al
inc edi
cmp eax, dword [edx + 0x37]
inc ebx
add esp, 4
or ecx, 0x769a
and ecx, 0xa5bd
jmp 0x684018c4
pop ecx
push ebx
push edx
add esp, 4
or ebx, 0x172b1

Function at 0x684018ad
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
imul edx, dword [ebp - 0x1960], 0xfe
sub ecx, edx
xor ecx, dword [ebp - 0x2508]
imul ecx, dword [ebp - 0x1960]
imul eax, dword [ebp - 0x1960], 0xfe
sub ecx, eax
mov dword [ebp - 0x1964], ecx
mov ecx, dword [ebp - 0x12fc]
mov edx, dword [ebp - 0x12f8]
mov dword [ebp - 0x196c], ecx
mov dword [ebp - 0x1968], edx
push esi
push edx
add esp, 4
sub esi, 0x5ce2
pop esi
push ecx
call 0x684018ad
add byte [ecx + 0x49], al
inc edi
cmp eax, dword [edx + 0x37]
inc ebx
add esp, 4
or ecx, 0x769a
and ecx, 0xa5bd
jmp 0x684018c4
pop ecx
push ebx
push edx
add esp, 4
or ebx, 0x172b1

Function at 0x684018d0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
and ebx, 0xa855
pop ebx
push edx
push ebx
add esp, 4
or edx, 0x16432
pop edx
push ecx
add ecx, 0x10ccc
pop ecx
push esi
push esi
add esp, 4
and esi, 0x13041
pop esi
mov eax, dword [ebp - 0x40]
add eax, 0xfe
imul ecx, dword [ebp - 0x3c], 0xfe
add ecx, 0x56f3663b
invalid
push ebp
invalid
invalid
Function at 0x68405d62
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push ecx
push ebx
add esp, 4
jmp 0x68405d70
add ecx, 0x2ba8
pop ecx
mov eax, dword [ebp - 0x5d4]
mov ecx, dword [eax]
mov dword [ebp - 0x5d4], ecx
mov edx, dword [ebp - 0x5d4]
cmp edx, dword [ebp - 0xebc]
je 0x68405da3
mov eax, dword [ebp - 0x5d4]
cmp dword [eax + 0x30], 0
jne 0x68405b59
mov dword [ebp - 0x888], 0
Function at 0x68406c53
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x1316e
pop esi
push ebx
push edi
add esp, 4
jmp 0x68406c6a
xor ebx, 0x14560
pop ebx
lea eax, [ebp - 0x1a88]
mov dword [ebp - 0xed8], eax
mov ecx, dword [ebp - 0x5e0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xed4], edx
xor eax, eax
mov word [ebp - 0x27c], ax
xor ecx, ecx
mov word [ebp - 0x144], cx
push edx
xor edx, 0x17cdf
pop edx
push edx
push esi
add esp, 4
call 0x68406cb9
add byte [ecx + ecx*2], dh
cmp cl, byte [eax + 0x41]
cmp eax, 0xc4834348
add al, 0xe8
or eax, dword [eax]
add byte [eax], al
add byte [esi + 0x37], cl
cmp edi, dword ds:[edi]
xor bh, byte [ecx]
dec ecx
cmp al, byte [ebx - 0x74a5fb3c]
xchg ebp, eax
sub al, 0xf1
invalid

Function at 0x68406cb9
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x1316e
pop esi
push ebx
push edi
add esp, 4
jmp 0x68406c6a
xor ebx, 0x14560
pop ebx
lea eax, [ebp - 0x1a88]
mov dword [ebp - 0xed8], eax
mov ecx, dword [ebp - 0x5e0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xed4], edx
xor eax, eax
mov word [ebp - 0x27c], ax
xor ecx, ecx
mov word [ebp - 0x144], cx
push edx
xor edx, 0x17cdf
pop edx
push edx
push esi
add esp, 4
call 0x68406cb9
add byte [ecx + ecx*2], dh
cmp cl, byte [eax + 0x41]
cmp eax, 0xc4834348
add al, 0xe8
or eax, dword [eax]
add byte [eax], al
add byte [esi + 0x37], cl
cmp edi, dword ds:[edi]
xor bh, byte [ecx]
dec ecx
cmp al, byte [ebx - 0x74a5fb3c]
xchg ebp, eax
sub al, 0xf1
invalid

Function at 0x68406ccc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor esi, 0x1316e
pop esi
push ebx
push edi
add esp, 4
jmp 0x68406c6a
xor ebx, 0x14560
pop ebx
lea eax, [ebp - 0x1a88]
mov dword [ebp - 0xed8], eax
mov ecx, dword [ebp - 0x5e0]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xed4], edx
xor eax, eax
mov word [ebp - 0x27c], ax
xor ecx, ecx
mov word [ebp - 0x144], cx
push edx
xor edx, 0x17cdf
pop edx
push edx
push esi
add esp, 4
call 0x68406cb9
add byte [ecx + ecx*2], dh
cmp cl, byte [eax + 0x41]
cmp eax, 0xc4834348
add al, 0xe8
or eax, dword [eax]
add byte [eax], al
add byte [esi + 0x37], cl
cmp edi, dword ds:[edi]
xor bh, byte [ecx]
dec ecx
cmp al, byte [ebx - 0x74a5fb3c]
xchg ebp, eax
sub al, 0xf1
invalid
Function at 0x68406d44
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push esi
xor esi, 0xfd3a
call fcn.68406c53
add byte [ebx], dh
cmp bh, byte [ecx]
dec edi
inc esi
inc edx
add esp, 4
add esp, 4
add esp, 4
pop edi
push ecx
push edi
add esp, 4
or ecx, 0x1048c
pop ecx
push esi
jmp 0x68406d5b
pop esi
movzx ecx, word [ebp - 0x144]
test ecx, ecx
jne 0x68406d7f
movzx edx, word [ebp - 0x27c]
movzx eax, word [ebp - 0x144]
sub edx, eax
mov dword [ebp - 0x1950], edx
jmp 0x68406de2
movzx ecx, word [ebp - 0x27c]
movzx edx, word [ebp - 0x144]
cmp ecx, edx
je 0x68406c9e
movzx eax, word [ebp - 0x27c]
xor eax, 0x20
movzx ecx, word [ebp - 0x144]
cmp eax, ecx
je 0x68406c9e
movzx edx, word [ebp - 0x27c]
movzx eax, word [ebp - 0x144]
cmp edx, eax
jge 0x68406dcc
mov dword [ebp - 0x194c], 0xffffffff
jmp 0x68406dd6
mov dword [ebp - 0x194c], 1
mov ecx, dword [ebp - 0x194c]
mov dword [ebp - 0x1950], ecx
cmp dword [ebp - 0x1950], 0
jne 0x68406e2b
push esi
push eax
add esp, 4
sub esi, 0x12779
xor esi, 0x17776
sub esi, 0x72a
pop esi
push ecx
push esi
add esp, 4
sub ecx, 0xa1a5
xor ecx, 0x97c1
jmp 0x68406e1c
pop ecx
mov edx, dword [ebp - 0x5e0]
mov dword [ebp - 0x378], edx
jmp 0x68406e93
push edi
push ecx
add esp, 4
xor edi, 0x5ad5
or edi, 0x106e4
add edi, 0xe2e8
xor edi, 0x8c5f
pop edi
push edi
add edi, 0xc652
pop edi
push eax
push ecx
add esp, 4
or eax, 0x44fa
pop eax
mov eax, dword [ebp - 0x5e0]
mov ecx, dword [eax]
mov dword [ebp - 0x5e0], ecx
mov edx, dword [ebp - 0x5e0]
cmp edx, dword [ebp - 0xedc]
je 0x68406e89
mov eax, dword [ebp - 0x5e0]
cmp dword [eax + 0x30], 0
jne 0x68406c3f
mov dword [ebp - 0x378], 0
Function at 0x6848f5f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov eax, dword [ebx + 4]
lea ebp, [esi + 0x62c]
lea edx, [esi + 0x580]
cmp eax, 1
mov dword [esp + 0x48], eax
seta al
movzx eax, al
mov edi, eax
mov eax, dword [esi + 0xc]
shl edi, 3
mov ecx, dword [eax + 0xf0]
mov dword [esp + 0x38], edi
lea edi, [ebx + 0x138fc]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x34], edi
mov edi, dword [esi + 0x780]
add edi, 0x10
mov dword [esp + 0x30], edi
mov edi, dword [esp + 0x78]
mov dword [esp + 0x2c], edi
mov edi, dword [ebx + 0x48]
mov dword [esp + 0x28], edi
mov edi, dword [ebx + 0x4c]
mov dword [esp + 0x24], edi
mov edi, dword [ebx + 0x40]
mov dword [esp + 0x20], edi
mov edi, dword [ebx + 0x44]
mov dword [esp + 0x1c], edi
mov edi, dword [ebx + 0x38]
mov dword [esp + 0x18], edi
mov edi, dword [ebx + 0x3c]
mov dword [esp + 0x14], edi
mov edi, dword [esi + 8]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov edi, dword [esi]
mov dword [esp + 8], edi
mov edi, dword [esi + 4]
mov dword [esp + 4], edi
mov eax, dword [eax + 0xf4]
mov dword [esp], eax
mov eax, ebx
call fcn.6848f220
test eax, eax
je 0x6848f6b0
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [ebx + 0x48]
mov dword [esp + 0x4c], eax
mov dword [esp], edx
call fcn.6848fe10
mov ecx, dword [esi + 0xc]
xor edx, edx
mov eax, dword [esp + 0x4c]
mov dword [ebx + 0x4c], 0
mov edi, dword [ecx + 0x114]
test edi, edi
jne 0x6848f6e5
cmp dword [ebx + 0x13924], 1
sbb edx, edx
and edx, 3
mov ebp, dword [ebx + 0x13934]
and edx, ebp
mov dword [esi + 0x628], ebp
cmp dword [esp + 0x48], 1
mov dword [ebx + 0x13934], edx
mov edx, dword [ecx + 0x118]
mov dword [esi + 0x620], edi
mov dword [esi + 0x624], edx
jbe 0x6848f6a6
mov edx, dword [esi + 0x62c]
mov dword [edx], 0
mov edx, dword [esi + 0x62c]
mov dword [edx + 4], 0
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x684b1a20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov ebx, dword [esp + 0xa0]
mov esi, dword [esp + 0xa4]
mov eax, dword [ebx + 0x878]
mov edx, dword [ebx + 0xe14]
mov ebp, dword [ebx + 0x4f4]
mov dword [esp + 0x44], eax
imul eax, esi
cmp dword [ebx + 0x504], 1
sete cl
mov dword [esp + 0x34], ebp
lea edi, [eax*4]
mov eax, dword [ebx + 0x4f8]
imul ebp, edi
mov dword [esp + 0x48], edi
add ebp, dword [ebx + 0xe10]
imul eax, edi
mov dword [esp + 0x68], ebp
sar eax, cl
add edx, eax
add eax, dword [ebx + 0xe18]
mov dword [esp + 0x6c], edx
mov edx, dword [ebx + 0x594]
mov dword [esp + 0x70], eax
mov eax, edi
imul eax, dword [ebx + 0x598]
mov dword [esp + 0x38], edx
imul edx, edi
mov edi, dword [ebx + 0xe1c]
sar eax, cl
add edi, edx
mov edx, dword [ebx + 0xe20]
mov dword [esp + 0x74], edi
add edx, eax
add eax, dword [ebx + 0xe24]
mov dword [esp + 0x78], edx
mov edx, dword [ebx + 0x504]
mov dword [esp + 0x7c], eax
xor eax, eax
test edx, edx
setne al
cmp esi, 1
lea ecx, [eax + eax]
sbb eax, eax
add esi, 1
not eax
mov dword [esp + 0x4c], ecx
and eax, 8
mov dword [esp + 0x58], eax
mov dword [esp + 0x50], esi
mov esi, eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x44]
sar esi, 1
mov dword [esp + 0x30], 0
sub eax, 2
mov dword [esp + 0x5c], esi
xor esi, esi
mov dword [esp + 0x54], eax
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
test esi, esi
setne al
imul edx, ecx
sub edi, edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x40], edi
mov edi, dword [esp + 0x50]
imul edx, ecx
movzx ecx, byte [esp + 0x30]
sub ebp, edx
cmp dword [ebx + 0x870], edi
mov edx, dword [esp + 0x54]
cmovle edx, dword [esp + 0x44]
xor edi, edi
shl edx, 2
sar edx, cl
test esi, esi
je 0x684b1b66
xor ecx, ecx
cmp dword [ebx + 0x504], 3
setne cl
mov edi, ecx
movzx eax, al
lea eax, [ebx + eax*4]
mov ecx, dword [eax + 0x804]
mov dword [esp + 0x20], ecx
mov eax, dword [eax + 0x7fc]
mov ecx, edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x860]
lea eax, [edi + eax*4]
sar eax, cl
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x500]
add eax, ecx
sub eax, dword [esp + 0x48]
sar eax, cl
mov ecx, edi
cmp eax, edx
cmovg eax, edx
mov edx, dword [esp + 0x3c]
add esi, 1
add edx, eax
mov dword [esp + 0x14], edx
mov eax, dword [ebx + 0x59c]
mov dword [esp + 8], ebp
add eax, edi
sar eax, cl
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [ebx + 0x818]
call dword [eax + 0x150]
cmp esi, dword [esp + 0x4c]
jg 0x684b1c30
mov eax, dword [ebx + 0x598]
cmp dword [ebx + 0x504], 1
mov edi, dword [esp + esi*4 + 0x74]
mov ebp, dword [esp + esi*4 + 0x68]
mov dword [esp + 0x38], eax
mov eax, dword [ebx + 0x4f8]
mov dword [esp + 0x34], eax
je 0x684b1c40
mov eax, dword [esp + 0x58]
mov dword [esp + 0x30], 0
mov dword [esp + 0x3c], eax
jmp 0x684b1b16
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x30], 1
mov dword [esp + 0x3c], eax
jmp 0x684b1b16