joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494d13
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x96
xchg esi, eax
fistp word [eax + 9]
sub bl, byte [ecx]
xor byte [edx], cl
adc eax, 0x48680eaa
and byte [eax], ch
cmp byte [esi - 0x60], dl
mov al, byte [0xa8f12418]
pop ebx
test al, 0x9c
mov eax, 0xede3aa00
mov bh, byte ds:[ecx + 0x5369566c]
xor byte [edi - 0x78], 0x87
clc
dec edx
push cs
dec esi
out dx, al
adc al, 0xf8
je 0x494c9d
aas
push 0xaf0c7436
mov ch, 0xd
cmp esp, ecx
cmp eax, 0x2828cd9c
and byte [ecx + ecx*8], dh
call 0x939359e3
jb 0x494d60
mov esp, 0x1949d52b
or byte [esi + ebp*8 - 0x45be0995], 0x75
lcall 0xd3fd, 0x74af4b10
sbb byte [edi - 0x3254b358], dl
inc eax
shl byte [ebp + 0x5a], 1
and dword [eax - 7], esp
imul eax, dword [esi - 0x746d1156], 0xfa392207
pop eax
jmp 0x494c9c
or ah, ah
insd dword es:[edi], dx
lcall 0x30c8, 0x3bafdeab
dec ecx
std
cwde
lodsd eax, dword [esi]
adc byte [eax + 0x4f7944f0], bl

Function at 0x4a14c2
Capabilities:
Encode data using xor

Disassembly:
lea ebx, [esp + eax*4 - 0x14e3a82d]
xchg esp, eax
mov word [ebp - 0x25], sp
je 0x4a14fc
mov ebx, 0xe47ab1f7
adc byte [edx], bh
aam 0xa6
in al, 0x10
cmp dl, ah
cmpsb byte [esi], byte es:[edi]
xor al, 0x4c
jl 0x4a14d0
jl 0x4a14e9
mov edi, 0xfe26ddc
jp 0x4a150b
in eax, 0x92
xchg edx, eax
mov ecx, 0xa1086565
dec ecx
mov ch, 0x8b
or byte gs:[ecx - 0x744ad9b7], ah
std
push ebx
pop ds
fbld tbyte [edx]
and byte es:[ebx], bh
jle 0x4a152e
mov al, byte [0xe44421f6]
mov ah, 0x1e
inc edi
inc eax
nop
pop esi
insd dword es:[edi], dx
invalid
ja 0x4a1543
mov edi, 0x2090d1fe
push ecx
sbb ax, bx
push ebx
bound ebp, qword [eax*4 - 0x12cb56ca]
xor edx, dword fs:[eax - 0x3c6d557a]
sahf
mov esi, 0x86958f07
push ebp
shl dword [eax], 0x6e
outsb dx, byte [esi]
jae 0x4a14d4
stosb byte es:[edi], al
dec edi
push edx
movsd dword es:[edi], dword [esi]
dec eax
dec esi
xchg edi, eax
jbe 0x4a156a
mov ecx, 0x2cc72b0
shr byte [ebx - 0xe27c6eb], 1
fdiv st(1)
je 0x4a14d0
push es
jb 0x4a14e7
pop es
or cl, byte cs:[0x21df4ec2]
xor ebx, edx
push esi
mov edx, 0xad63d746
xchg esp, eax
xchg ebx, eax
push cs
push 0xfffffffffffffff2
cwde
or dword [edx + 0x38], edx
invalid
Function at 0x4a40b7
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004a42aa
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004aedff
xor ebx, ebx
cmp eax, ebx
jne 0x4a4265
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004a42aa
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.004abade
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.004fd3d3
add esp, 0x10
test eax, eax
jne 0x4a4180
push esi
call fcn.004a1769
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4a4180
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4a416b
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4a4180
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a4179
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004b0312
cmp byte [esp + 0x13], bl
je 0x4a41b0
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.004a42e7
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4a4220
push 0x14
call fcn.004fc640
cmp eax, ebx
pop ecx
je 0x4a41da
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4a41dc
xor edi, edi
cmp edi, ebx
je 0x4a4220
push esi
push edi
call fcn.004a380d
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004a38d5
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a39fe
add esp, 0x18
call fcn.004a42aa
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.004ae4cc
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a4237
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4a4249
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4a428c
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4a428c
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004a38d5
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a39fe
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b04fb
Capabilities:
Encode data using xor

Disassembly:
inc edx
out 0x46, eax
inc eax
sbb dword cs:[ecx + 0x2c], edi
inc ecx
adc dword [edi + 0x7f], eax
push ss
lodsd eax, dword [esi]
cmpsb byte [esi], byte es:[edi]
shr byte [ebx + 0x7d], 1
xor eax, 0x669e48c2
add cl, 0x2e
jl 0x4b04ed
pushfd
and bl, byte [0x74a34406]
xchg sp, ax

Function at 0x4b7f22
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x68
out 0x6e, eax
insb byte es:[edi], dx
ror edi, 0x96
xor al, 0xc7
out 0x1e, eax
aad 0x50
mov al, byte [0x51b93b7a]
mov al, 0xe1
test al, 0xeb
mov eax, dword [0xd5fb49e7]
invalid
Function at 0x40100e
Capabilities:
Extract resource via kernel32 functions
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc2c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
xor esi, esi
cmp dword [0x2b72744], 0xee
mov dword [ebp - 0xc], eax
jne 0x401052
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
mov eax, dword [0x413f78]
mov dword [ebp - 0x24], eax
mov eax, dword [0x413f7c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], 0x9e3779b9
call fcn.00401007
mov eax, dword [0x413f80]
add dword [ebp - 4], 0xe0
mov dword [ebp - 0x20], eax
mov eax, dword [0x413f84]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, dword [0x2b72744]
mov edx, edi
shl edx, 4
add edx, dword [ebp - 0x20]
cmp eax, 0xfa9
jne 0x4010bb
mov dword [0x2b72740], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c8
mov dword [0x43fe8c], esi
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
lea ebx, [eax + edi]
mov eax, edi
shr eax, cl
mov dword [0x2b7273c], 0x9150ce2e
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], eax
push ebx
mov eax, edx
call fcn.00401000
xor dword [ebp - 8], eax
cmp dword [0x2b72744], 0x27
jne 0x40112b
lea eax, [ebp - 0x2c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push esi
push esi
lea eax, [ebp - 0xc2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
lea eax, [ebp - 0x42c]
push eax
push str.Pexiyisotat_pahowiyahabixi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
and eax, 0x5dc052bb
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, eax
add edx, eax
shr ecx, 5
add ecx, dword [ebp - 0x28]
shl eax, 4
add eax, dword [ebp - 0x24]
push edx
mov dword [ebp - 8], ecx
mov dword [0x43fe88], esi
call fcn.00401000
xor eax, ecx
sub edi, eax
mov eax, dword [ebp - 0x1c]
sub dword [ebp - 4], eax
dec dword [ebp - 0x14]
jne 0x401092
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x401524
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [0x2b72744]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x2b72234], eax
ret

Function at 0x40153f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
xor esi, esi
cmp dword [0x2b72744], 0x20a
push edi
jne 0x4015a3
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
push esi
call dword [sym.imp.KERNEL32.dll_PulseEvent]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
cmp edi, 0x90ce7e5
jg 0x4015bc
inc edi
cmp edi, 0x702132fa
jl 0x4015a5
call fcn.00401510
push 0x43fa00
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [0x2b72744]
mov dword [0x2b72738], eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x2b72234], eax
call fcn.00401524
mov eax, dword [0x414054]
mov dword [0x2b73b34], eax
call fcn.004011d7
xor edi, edi
mov eax, dword [0x2b72744]
add eax, edi
cmp eax, 0x5e
jne 0x40161f
push esi
push str.danixoranevizicoxadotekofimudocazu
push str.lilowetehovozawexihecijip
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapSize]
inc edi
cmp edi, 0x40c893
jl 0x4015f9
call fcn.00401180
xor ecx, ecx
cmp ecx, 0x7616
jne 0x40163c
call fcn.004011bd
inc ecx
cmp ecx, 0x2466e9
jl 0x40162f
push 0x7b
pop edi
cmp dword [0x2b72744], 0xd
jne 0x40166d
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharWidthFloatA]
dec edi
jne 0x401648
call dword [0x2b72234]
pop edi
pop esi
leave
ret

Function at 0x401f02
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4130d8]
jne 0x401f0c
repz ret
jmp fcn.0040592c
Function at 0x405cb6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040389f
and dword [ebp - 4], 0
cmp dword [0x43f8d8], 0
mov ebx, eax
jne 0x405d67
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405e18
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405e18
push eax
call fcn.0040382d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43f8d8], eax
call esi
push eax
call fcn.0040382d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43f8dc], eax
call esi
push eax
call fcn.0040382d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43f8e0], eax
call esi
push eax
call fcn.0040382d
pop ecx
mov dword [0x43f8e8], eax
test eax, eax
je 0x405d67
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040382d
pop ecx
mov dword [0x43f8e4], eax
mov eax, dword [0x43f8e4]
cmp eax, ebx
je 0x405dbf
cmp dword [0x43f8e8], ebx
je 0x405dbf
push eax
call fcn.004038a8
push dword [0x43f8e8]
mov esi, eax
call fcn.004038a8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405dbf
test edi, edi
je 0x405dbf
call esi
test eax, eax
je 0x405db6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405db6
test byte [ebp - 0xc], 1
jne 0x405dbf
or dword [ebp + 0x10], 0x200000
jmp 0x405df8
mov eax, dword [0x43f8dc]
cmp eax, ebx
je 0x405df8
push eax
call fcn.004038a8
pop ecx
test eax, eax
je 0x405df8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405df8
mov eax, dword [0x43f8e0]
cmp eax, ebx
je 0x405df8
push eax
call fcn.004038a8
pop ecx
test eax, eax
je 0x405df8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43f8d8]
call fcn.004038a8
pop ecx
test eax, eax
je 0x405e18
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405e1a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100016c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, esi
mov edx, 0xe3
push edi
mov ecx, dword [eax + 4]
mov edi, dword [eax]
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [eax]
and cl, 1
shr edi, 1
sub edx, 1
neg cl
sbb ecx, ecx
and ecx, 0x9908b0df
xor edi, ecx
xor edi, dword [eax + 0x634]
add eax, 4
test edx, edx
mov dword [eax - 4], edi
jne 0x100016c8
mov edx, 0x18c
mov ecx, dword [eax + 4]
mov edi, dword [eax]
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [eax]
and cl, 1
shr edi, 1
neg cl
sbb ecx, ecx
and ecx, 0x9908b0df
xor edi, ecx
xor edi, dword [eax - 0x38c]
add eax, 4
sub edx, 1
mov dword [eax - 4], edi
jne 0x10001700
mov ecx, dword [esi]
mov edx, dword [eax]
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [eax]
and cl, 1
shr edx, 1
neg cl
pop edi
sbb ecx, ecx
and ecx, 0x9908b0df
xor edx, ecx
xor edx, dword [eax - 0x38c]
mov dword [eax], edx
mov dword [esi + 0x9c4], 0x270
mov dword [esi + 0x9c0], esi
ret

Function at 0x10001770
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, eax
push edi
mov ecx, 1
mov dword [esi], edx
jmp 0x10001780
mov edx, dword [eax]
mov edi, edx
shr edi, 0x1e
xor edi, edx
imul edi, edi, 0x6c078965
add edi, ecx
mov dword [eax + 4], edi
add ecx, 1
add eax, 4
cmp ecx, 0x270
jl 0x10001780
call fcn.100016c0
pop edi
pop esi
ret

Function at 0x100017b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
push edi
mov edi, ebx
shr edi, 1
or edi, ebx
mov esi, eax
mov eax, edi
shr eax, 2
or edi, eax
mov ecx, edi
shr ecx, 4
or edi, ecx
mov edx, edi
shr edx, 8
or edi, edx
mov eax, edi
shr eax, 0x10
or edi, eax
cmp dword [esi + 0x9c4], 0
jne 0x100017e4
call fcn.100016c0
mov eax, dword [esi + 0x9c0]
add dword [esi + 0x9c4], 0xffffffff
mov ecx, dword [eax]
add eax, 4
mov edx, ecx
shr edx, 0xb
xor ecx, edx
mov dword [esi + 0x9c0], eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov edx, ecx
and edx, 0xffffdf8c
shl edx, 0xf
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
and eax, edi
cmp eax, ebx
ja 0x100017d6
pop edi
pop esi
ret
Function at 0x10006d90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1002b3c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x100951fc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x10096c80]
mov edx, dword [eax + 0xc]
mov ecx, 0x10096c80
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 0
mov eax, dword [0x10096c80]
mov edx, dword [eax + 0xc]
mov ecx, 0x10096c80
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x24], 1
mov eax, dword [0x10096c80]
mov edx, dword [eax + 0xc]
mov ecx, 0x10096c80
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], 2
mov eax, dword [0x10096c80]
mov edx, dword [eax + 0xc]
mov ecx, 0x10096c80
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
lea edx, [esp + 0x18]
lea ebx, [esp + 0x20]
mov ecx, esi
mov byte [esp + 0x30], 3
call fcn.10006ef0
mov byte [esp + 0x24], 2
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10006e69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x24], 1
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10006e8e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10006eb3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10006edb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x1c
ret 4
Function at 0x10007e60
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1002ad0e
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100951fc]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [esp + 0xbc]
mov esi, dword [ebp + 0x3c]
mov ecx, dword [esi + ebp + 0x50]
mov edx, dword [esi + ebp + 0x34]
mov eax, dword [ebx]
push 0x40
add esi, ebp
push 0x3000
push ecx
push edx
push eax
call dword [0x10034110]
mov edi, eax
test edi, edi
jne 0x10007f25
mov ecx, dword [esi + 0x50]
mov eax, dword [ebx]
push 0x40
push 0x3000
push ecx
push edi
push eax
call dword [0x10034110]
mov edi, eax
test edi, edi
jne 0x10007f25
xor esi, esi
push esi
push 0x100826fa
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], esi
mov byte [esp + 0x2c], 0
call fcn.10003900
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0xbc], esi
call fcn.100014d0
push 0x10085db4
lea ecx, [esp + 0x5c]
push ecx
mov dword [esp + 0x60], vtable.std::range_error.0
call fcn.1001621e
mov eax, dword [ebx]
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0
mov ecx, dword [esi + 0x54]
push ecx
push ebp
push edi
push eax
call dword [0x10034128]
test eax, eax
jne 0x10007fa1
call dword [0x1003407c]
push 0
push 0x100826fa
lea ecx, [esp + 0x28]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
call fcn.10003900
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0xbc], 1
call fcn.100014d0
push 0x10085db4
lea ecx, [esp + 0x5c]
push ecx
mov dword [esp + 0x60], vtable.std::range_error.0
call fcn.1001621e
movzx eax, word [esi + 6]
sub eax, 1
movzx edx, word [esi + 0x14]
lea ebp, [edx + esi + 0x18]
mov dword [esp + 0x18], 0
js 0x10008001
add ebp, 0x10
lea ecx, [ecx]
mov ecx, dword [ebp]
test ecx, ecx
je 0x10007fe8
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
push 0
push ecx
mov ecx, dword [ebp + 4]
add ecx, dword [esp + 0xc4]
add edx, edi
push ecx
push edx
push eax
call dword [0x10034128]
test eax, eax
je 0x1000802c
movzx ecx, word [esi + 6]
mov eax, dword [esp + 0x18]
add eax, 1
sub ecx, 1
add ebp, 0x28
cmp eax, ecx
mov dword [esp + 0x18], eax
jle 0x10007fc0
mov eax, edi
cdq
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], edx
mov edx, dword [esi + 0x50]
mov dword [ebx + 0x78], edx
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa4
ret 4
call dword [0x1003407c]
mov ebx, dword [ebx]
push 0x8000
push 0
push edi
push ebx
call dword [0x10034124]
push 0
push 0x100826fa
lea ecx, [esp + 0x44]
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], 0
mov byte [esp + 0x48], 0
call fcn.10003900
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x84]
push eax
mov dword [esp + 0xbc], 2
call fcn.100014d0
push 0x10085db4
lea ecx, [esp + 0x84]
push ecx
mov dword [esp + 0x88], vtable.std::range_error.0
call fcn.1001621e
int3
Function at 0x100093d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1002b6b1
mov eax, dword fs:[0]
push eax
sub esp, 0x874
mov eax, dword [0x100951fc]
xor eax, esp
mov dword [esp + 0x86c], eax
push esi
push edi
mov eax, dword [0x100951fc]
xor eax, esp
push eax
lea eax, [esp + 0x880]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov esi, edi
mov dword [esp + 0x14], eax
call fcn.10009280
cmp byte [edi + 0x890], 0
je 0x1000951d
push ecx
lea esi, [edi + 0x88]
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.10002d70
mov ecx, dword [edi + 4]
push ecx
call fcn.10002970
add esp, 8
test al, al
je 0x10009496
xor esi, esi
push esi
push 0x100826fa
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], esi
mov byte [esp + 0x3c], 0
call fcn.10003900
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x890], esi
call fcn.100014d0
push 0x10085c78
lea ecx, [esp + 0x50]
push ecx
call fcn.1001621e
mov edx, esi
mov eax, ebx
sub edx, ebx
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100094a0
lea ecx, [esp + 0x1c]
call fcn.1000a120
mov dword [esp + 0x888], 1
mov edx, dword [edi + 4]
push edx
lea ecx, [esp + 0x20]
call fcn.10007c00
mov eax, dword [edi + 0x70]
mov ecx, dword [edi]
xor edx, edx
push 0x8000
push edx
push eax
push ecx
mov dword [edi + 0x70], edx
mov dword [edi + 0x74], edx
mov dword [edi + 0x78], edx
call dword [0x10034124]
mov eax, dword [esp + 0x14]
push eax
mov ecx, edi
call fcn.10007e60
push edi
call fcn.10008ae0
lea esi, [esp + 0x1c]
mov dword [esp + 0x888], 0xffffffff
call fcn.10007d00
mov ecx, esi
call fcn.1000a210
jmp 0x10009555
lea edx, [edi + 0x88]
mov eax, ebx
sub edx, ebx
jmp 0x10009530
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10009530
call fcn.10008980
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, edi
call fcn.10007e60
call fcn.100080d0
mov eax, dword [edi + 0x888]
push 0xa
lea edx, [esp + 0x78]
push edx
cdq
push edx
push eax
call fcn.100179a1
mov eax, dword [0x10096c80]
mov edx, dword [eax + 0xc]
add esp, 0x10
mov ecx, 0x10096c80
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x888], 2
mov eax, dword [edi + 4]
push eax
push 0x100841e0
push 0x10
push 0x100841bc
call fcn.10003540
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.1000ab30
mov eax, dword [esp + 0x1c]
mov edi, dword [edi]
add esp, 0xc
lea edx, [esp + 0x74]
push edx
push eax
push edi
call fcn.10008fe0
mov dword [esp + 0x894], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100095f4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x880]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x86c]
xor ecx, esp
call fcn.10015b2b
mov esp, ebp
pop ebp
ret 4