joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10058610
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x361f6dc]
fld dword [esi + 0x1f64]
call fcn.10085e30
fld dword [esi + 0x1f6c]
mov dword [ebp - 8], eax
call fcn.10085e30
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 0x101b875c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10058661
test dl, dl
je 0x1005865d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10058661
add eax, 2
add ecx, 2
test dl, dl
jne 0x10058641
xor eax, eax
jmp 0x10058666
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1005868a
mov eax, dword [0x101a46dc]
mov ecx, dword [0x100eaf2c]
add eax, 0x44
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.10060510
pop esi
mov esp, ebp
pop ebp
ret
push 0x100945a8
call fcn.100072f0
add esp, 4
cmp eax, 1
jne 0x100586ae
push str.ClickBox1
call fcn.100386e0
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
fild dword [ebp + 0xc]
sub esp, 8
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp + 4]
fild dword [ebp - 8]
fstp dword [esp]
call fcn.10055930
fcomp qword [0x1009ffd0]
add esp, 8
fnstsw ax
test ah, 5
jp 0x1005872d
fild dword [ebp + 0x14]
sub esp, 8
fstp dword [esp + 4]
fild dword [ebp - 0xc]
fstp dword [esp]
call fcn.10055930
fcomp qword [0x1009ffd0]
add esp, 8
fnstsw ax
test ah, 5
jp 0x1005872d
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101b8cf0]
cmp eax, 0xbb8
jbe 0x1005872d
mov edx, dword [ebp + 0x18]
push edx
push 1
call fcn.10039420
add esp, 8
call esi
mov dword [0x101b8cf0], eax
pop esi
mov esp, ebp
pop ebp
ret
fild dword [ebp + 0x14]
sub esp, 0xc
fstp dword [esp + 8]
fild dword [ebp + 0x10]
fstp dword [esp + 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.10037ba0
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10058760
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [0x361f6dc]
fld dword [esi + 0x1f64]
call fcn.10085e30
fld dword [esi + 0x1f6c]
mov dword [ebp - 8], eax
call fcn.10085e30
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 0x101b875c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100587b1
test dl, dl
je 0x100587ad
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100587b1
add eax, 2
add ecx, 2
test dl, dl
jne 0x10058791
xor eax, eax
jmp 0x100587b6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100587dc
mov eax, dword [0x101a46dc]
mov ecx, dword [0x100eaf2c]
add eax, 0x93
push eax
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.1006fa60
pop esi
mov esp, ebp
pop ebp
ret
push 0x100945a8
call fcn.100072f0
add esp, 4
cmp eax, 1
jne 0x10058800
push str.ClickBox1
call fcn.100386e0
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
fild dword [ebp + 0xc]
sub esp, 8
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp + 4]
fild dword [ebp - 8]
fstp dword [esp]
call fcn.10055930
fcomp qword [0x1009ffd0]
add esp, 8
fnstsw ax
test ah, 5
jp 0x1005887f
fild dword [ebp + 0x14]
sub esp, 8
fstp dword [esp + 4]
fild dword [ebp - 0xc]
fstp dword [esp]
call fcn.10055930
fcomp qword [0x1009ffd0]
add esp, 8
fnstsw ax
test ah, 5
jp 0x1005887f
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101b8cf4]
cmp eax, 0xbb8
jbe 0x1005887f
mov edx, dword [ebp + 0x18]
push edx
push 1
call fcn.10039420
add esp, 8
call esi
mov dword [0x101b8cf4], eax
pop esi
mov esp, ebp
pop ebp
ret
fild dword [ebp + 0x14]
sub esp, 0xc
fstp dword [esp + 8]
fild dword [ebp + 0x10]
fstp dword [esp + 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.10037ba0
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100802e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x1019efb0], 1
jne 0x100802ee
jmp fcn.100800a0
push ebx
push esi
mov esi, dword [0x361f6dc]
mov eax, dword [esi + 0x1d24]
push edi
push 0xaf54b8
push eax
call fcn.10006f00
mov ebx, eax
add esp, 8
test ebx, ebx
jle 0x10080375
cmp ebx, esi
je 0x10080375
xor esi, esi
cmp dword [0x101435f0], esi
jle 0x10080375
mov edi, 0x10142df8
cmp byte [esi + 0x101433d4], 1
jne 0x10080369
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi*4 + 0x10143410]
cmp eax, dword [esi*4 + 0x10143500]
jb 0x10080369
mov ecx, dword [esi*4 + 0x101432a8]
shl ecx, 5
cmp dword [ecx + ebx + 0x45c4], 0
jne 0x10080369
movzx edx, word [ebx + 0x14]
push edx
push edi
call fcn.10006c10
add esp, 8
cmp al, 1
je 0x10080383
inc esi
add edi, 0x14
cmp esi, dword [0x101435f0]
jl 0x10080324
pop edi
pop esi
mov dword [0x100ae398], 0x64
pop ebx
ret
lea eax, [esi + esi*4]
lea ecx, [eax*4 + 0x10142df8]
push 8
push ecx
call fcn.1003a930
add esp, 8
pop edi
pop esi
mov dword [0x100ae398], 0xbd6
pop ebx
ret
Function at 0x10085dc6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100ae8c8]
jne 0x10085dd0
repz ret
jmp fcn.10086539
Function at 0x101c7d47
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + eax - 0x63362160], eax
not byte [esp + eax - 0x63362160]
neg ecx
not dx
shl ax, 0x84
inc ecx
dec edx
or edx, edx
setns dl
bswap ecx
ja 0x10291270
mov ecx, dword [esi]
mov eax, 0xe897b53b
ror eax, 0x18
add esi, 4
xor ecx, ebx
sal eax, 0xbb
mov edx, eax
sar eax, 0xd5
xor ecx, 0xf83fc9b7
rol ecx, 2
neg eax
bswap eax
bswap edx
xor ecx, 0x47216409
dec al
setne al
sar dl, 0xe1
sbb ecx, 0xc7279611
xor ecx, 0x60d2e99
and dl, 0x9f
sbb edx, eax
sub dx, ax
bswap ecx
xor dx, ax
call fcn.1022f84f
invalid
lea esi, [esi + edx*2 - 0x60]
sar dl, 0x23
shl eax, cl
movsx ecx, dx
rol dx, cl
mov dword [esi + edx*2 - 0x300], eax
jae 0x10273f6d
jmp edi
pop eax
xor ebx, ecx
shr edx, 0x39
rol ax, 0xeb
adc edi, ecx
mov ecx, eax
sub cl, cl
dec edx
mov eax, dword [esi + edx - 0x31]
adc cx, dx
xor cl, 0x98
sar cx, 0xa
mov cl, byte [esi + edx - 0x2d]
jae 0x1026eba4

Function at 0x101ed971
Capabilities:
Encode data using base64

Disassembly:
not eax
ror eax, 1
xor ebx, eax
jmp 0x101f2053
rol eax, 1
mov dword [esp], 0x99b05b0e
jmp 0x101eb4aa
sal cx, 0xe1
add edi, eax
jmp 0x10256645
call fcn.101eff3b

Function at 0x1026373b
Capabilities:
Encode data using xor

Disassembly:
lea eax, [edx + 0x431baa29]
ror eax, 0x45
lea ebp, [ebp + edx - 0x443303ac]
mov dword [esp + edx - 0x443303ae], 0x6a32a2a7
and dl, dh
xor edx, eax
mov word [ebp], cx
call fcn.1025659d
mov eax, 0xdb101f26
inc eax
mov edx, dword [ebp]
mov ecx, 0x34b69127
push ecx
xor cx, cx
xor ecx, ecx
add cl, byte [ecx + ebp - 0x34b5fffc]
dec dword [esp]
sar al, 4
adc ebp, 2
xor dword [esp], eax
sal word [esp + 1], 0xa
bswap eax
shr edx, cl
mov ecx, eax
mov dword [ebp + eax - 0x21f10db], edx
rol ecx, 0xb3
rol ecx, cl
lea edi, [edi + eax*8 - 0x10f886dc]
lea edx, [ecx*2 - 0x56d2e175]
mov eax, dword [edi + eax*2 - 0x43e21b6]
push ecx
xor eax, ebx
call fcn.102553ef
jg 0x10263775
clc
or eax, 0xe4b9530f
mov al, 0xa4
or edi, dword [edi - 0x1d3d0f1c]
cmp dword [ecx], ebx
sbb cl, bh
leave
mov cl, 0x91
out 0xb0, al
or byte [eax - 0x6b70e47b], dh
pop ebp
retf

Function at 0x1027be20
Capabilities:
Encode data using base64

Disassembly:
mov dword [esp], edi
push esi
mov edi, 0xd305c627
movsx esi, di
pushfd
shl si, 0xc9
shr esi, 0x5a
mov esi, eax
call fcn.101c9bf8
Function at 0x10286176
Capabilities:
Encode data using xor

Disassembly:
shl eax, 0x23
adc esi, ecx
shl eax, 1
jmp esi
xor edx, ebx
call fcn.1024aa7d
xadd ecx, eax
rol edx, 2
and cx, cx
sal cx, 0x43
xadd eax, ecx
dec edx
bswap edx
inc cx
inc edx
add ax, 0xb4b4
sub cl, ch
xor ebx, edx
sar ax, 0xce
xor cl, ah
call fcn.101e44fb
mov eax, 0xc7a16616
xor ecx, 0xcab79ea6
and eax, eax
xor ebx, ecx
jmp 0x101ddd79
ror ecx, 3
call fcn.1027c203
mov ecx, 0xa711662d
lea edx, [ecx*8 - 0x7d6211ec]
sub edi, 4
sal dl, 0x21
mov edx, dword [edi]
lea eax, [ecx*2 + 0x56879826]
js 0x102835dc
pop edx
inc byte [ebx - 0x1c]
lodsb al, byte [esi]
cwde
add esp, edi
xor bl, bh
dec ebp
inc edx
sbb byte [edi], cl
stc
je 0x102861cf
dec edi
xor al, 0x14
lcall 0xe5ee, 0x780f0caf
mov al, 0xa7
dec eax
call 0xedce52aa
push es
dec esi
sbb ecx, edi
xor dl, dl
invalid
out 0xd2, eax
sbb cl, byte [edi + 0x109c0ac3]
cmovne edx, dword [edi - 0x47b0ecaa]
adc byte [edi], cl
inc ebp
xchg edi, eax
push esi
adc ecx, dword [edi - 0x48]
mov esi, 0xd76f5be9
fisubr word [edi + 0x417d4db1]
adc dl, bl
das
and dword [ecx], 0x3a171a98
lahf
xor byte [esp + eax*8 + 0x5a5dadba], ch
cwde
inc ebp
push edx
pushal
push edi
cmp eax, esi
mov esi, ebp
push 0x51
stosb byte es:[edi], al
sub al, 0xfe
cmp eax, 0x1dd115df
mov esp, 0xe9c42a2b
cmc
jbe 0x102861d6
invalid

Function at 0x102883b3
Capabilities:
Delete file
Download url
Receive data

Disassembly:
movzx edx, ax
jmp fcn.10034882
mov dword [esp + edx*2 - 0x124], edx
mov dx, word [eax + esi - 0x1da1588e]
and ax, word [esp + eax*4 - 0x76856248]
lea esi, [esi + eax*2 - 0x3b42011e]
mov word [ecx + eax - 0x1da10092], dx
sub eax, eax
sbb al, 0xa3
sbb dword [esp + eax - 0x5d], eax
mov ecx, dword [ebp + eax*8 - 0x2e8]
lea ebp, [ebp + eax*2 - 0xb6]
ror ax, 0x8d
adc dword [esp + eax*2 - 0x5d0], eax
xor ecx, ebx
not ecx
jmp 0x1021db32

Function at 0x102b2de3
Capabilities:
Encode data using base64

Disassembly:
rol ecx, 2
sar eax, 0x44
neg dx
add dword [esp + edx - 0x3e7], eax
xor ebx, ecx
add edi, ecx
movsx ecx, ax
sal edx, cl
call fcn.101c750a
shr ax, 0xe1
not ecx
or al, al
mov dword [esp], 0xb990fc19
sbb ecx, 0xfe23bb2e
movzx edx, word [esp]
jmp 0x101d20fc
Function at 0x1000c3be
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, 0x53b
mov dword [0x1001ab68], 0
mov dword [0x1001ab5c], 0x53b
mov dword [0x1001ab64], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
jmp 0x1000c42d
mov eax, dword [0x1001ab5c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jmp 0x1000c42d
mov dword [0x1001ab64], 0
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1000c466
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add eax, 0x20c7
mov dword [0x1001ab5c], eax
mov eax, ecx
mov dl, al
mov eax, dword [ebp - 0x18]
mov byte [eax + ecx], dl
mov ecx, dword [0x1001ab64]
add ecx, 1
mov dword [0x1001ab64], ecx
cmp ecx, 0x100
mov dword [ebp - 0x28], ecx
jl 0x1000c406
jmp 0x1000c41c
mov eax, dword [ebp - 0x2c]
mov ecx, 0x100
mov edx, dword [0x1001ab68]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x30], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov eax, edi
cdq
idiv ecx
mov dword [0x1001ab68], edx
mov dword [0x1001ab5c], 0x85
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x30]
mov cl, byte [ecx + edi]
mov dword [0x1001ab60], 0x53a
mov esi, dword [ebp - 0x18]
mov ch, byte [esi + edx]
mov byte [esi + edi], ch
mov edx, dword [0x1001ab68]
mov byte [esi + edx], cl
mov dword [0x1001ab5c], 0x1aae
mov edx, dword [0x1001ab64]
add edx, 1
mov dword [0x1001ab64], edx
cmp edx, 0x100
mov dword [ebp - 0x2c], edx
jl 0x1000c466
mov dword [0x1001ab5c], 0x15f7
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000c825
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [0x1001ab60]
add esi, 0xffffe320
mov dword [0x1001ab5c], esi
mov dword [0x1001ab60], 0x158a
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x1000c940
lea eax, [ebp - 0x24]
mov dword [0x1001ab5c], 0xfffffcac
mov dword [ebp - 0x34], eax
call fcn.1000d83c
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1000cc4e
xor ecx, ecx
mov edx, dword [0x1001ab60]
add edx, 0x951
mov dword [0x1001ab60], edx
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
je 0x1000c981
mov eax, dword [ebp - 0x38]
mov dword [0x1001ab5c], 0x2e
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1001ab5c], 0x82f
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.1000d6ef
xor eax, eax
mov dword [0x1001ab60], 0xa4
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0xc], ecx
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0x5c], ecx
mov dword [0x1001ab5c], 0x227d
cmp ecx, 0
mov dword [ebp - 0x3c], eax
je 0x1000c981
jmp 0x1000c96c
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x1000e69c]
mov dl, byte [eax + 0x1000e66d]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
je 0x1000c85e
jmp 0x1000c940
mov eax, dword [ebp - 0x40]
add eax, 0x227e
mov dword [0x1001ab5c], 0x36a9
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add esp, 0x4c
pop esi
pop ebp
ret
Function at 0x1000c98a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1001ab64], 0
mov dword [0x1001ab68], 0
mov dword [0x1001ab6c], 0
mov ebx, dword [0x1001ab5c]
add ebx, 0x659
mov dword [0x1001ab60], ebx
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
jne 0x1000ca31
mov dword [0x1001ab5c], 0x11d4
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x1001ab60]
mov ecx, dword [0x1001ab64]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov eax, dword [0x1001ab68]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
add ecx, 0xfffff2cf
mov dword [0x1001ab5c], ecx
add edx, 1
mov dword [ebp - 0x3c], eax
mov eax, edx
cdq
idiv edi
mov dword [0x1001ab64], edx
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x40], edx
cdq
idiv edi
mov dword [0x1001ab68], edx
mov dword [0x1001ab60], 0x226a
mov esi, dword [ebp - 0x40]
mov cl, byte [ecx + esi]
mov edi, dword [ebp - 0x24]
mov ch, byte [edi + edx]
mov byte [edi + esi], ch
mov edx, dword [0x1001ab68]
mov byte [edi + edx], cl
mov dword [0x1001ab5c], 0x4b7
mov edx, dword [0x1001ab64]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1001ab68]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1001ab6c], ebx
mov dword [0x1001ab60], 0xbf4
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x3c]
mov cl, byte [edx + esi]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x20]
mov byte [ebx + esi], cl
mov dword [0x1001ab5c], 0x2237
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x38], esi
je 0x1000c9f4
jmp 0x1000ca06
Function at 0x1000ce44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
mov dword [ebp - 0x130], eax
xor eax, eax
mov dword [0x1001ab60], 0x16af
mov dword [0x1001ab5c], 0xba1
mov ecx, eax
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
lea edx, section..data
imul esi, eax, 0xa8
mov edi, edx
add edi, esi
add edi, 0x9c
mov esi, dword [edi]
imul edi, eax, 0xa8
add edx, edi
add edx, 0x2c
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x105
mov ecx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], eax
je 0x1000cf52
jmp 0x1000ce7d
lea eax, [ebp - 0x12c]
mov dword [0x1001ab5c], 0xfffffcac
mov dword [ebp - 0x140], eax
call fcn.1000d83c
mov dword [esp], eax
mov eax, dword [ebp - 0x140]
mov dword [esp + 4], eax
call fcn.1000cc4e
mov ecx, eax
mov dword [0x1001ab70], eax
mov eax, esp
mov edx, dword [ebp - 0x13c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov dword [0x1001ab5c], 0x1331
mov edx, ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], ecx
jmp 0x1000cfa3
xor eax, eax
mov dword [0x1001ab5c], 0x16a0
mov dword [0x1001ab60], 0x158a
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
mov cl, byte [eax + 0x1000e69c]
mov dl, byte [eax + 0x1000e66d]
sub dl, cl
mov byte [ebp + eax - 0x12c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x150], eax
je 0x1000ced8
jmp 0x1000cf6e
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x148]
lea edx, section..data
imul esi, eax, 0xa8
mov edi, edx
add edi, esi
add edi, 0x9c
mov esi, dword [edi]
imul edi, eax, 0xa8
mov ebx, edx
add ebx, edi
add ebx, 0x28
mov edi, dword [ebx]
imul ebx, eax, 0xa8
add edx, ebx
add edx, 0x2c
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x144]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], edx
call fcn.1000d653
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x158]
add eax, ecx
mov edx, dword [ebp - 0x154]
add edx, 1
cmp edx, 0x105
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], edx
jne 0x1000cfa3
lea eax, [0x1000e67b]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov dword [0x1001ab5c], 0x263
mov dword [0x1001ab60], 0x6cd
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.1000c3be
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x13c]
mov dword [esp + 0xc], edx
call fcn.1000c98a
xor eax, eax
mov ecx, dword [ebp - 0x144]
add ecx, 0x3a2a6
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x12ea00
mov ecx, dword [ebp - 0x144]
add ecx, 0x24222
mov dword [edx + 8], ecx
mov dword [0x1001ab60], 0x12c7
mov dword [edx + 0xc], 0x20b0
mov dword [0x1001ab5c], 0x1952
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000d105
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [0x1001ab5c], 0x1286
mov dword [ebp - 0x10], eax
call fcn.1000d2bc
mov ecx, eax
mov dword [0x1001ab60], 0xc33
mov edx, dword [eax + 0x3c]
mov esi, dword [0x1001ab5c]
add esi, 0xfffff9ee
mov dword [0x1001ab5c], esi
mov dword [0x1001ab60], 0x12e0
mov eax, dword [eax + edx + 0x78]
mov dword [0x1001ab5c], 0x24de
mov edx, eax
add edx, 0x20
mov esi, ecx
add esi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], esi
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
add ecx, dword [edx]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov ebx, dword [esi + edi + 0x24]
mov dword [0x1001ab60], 0x1633
mov edx, dword [esi + edi + 0x18]
cmp edx, 0
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
je 0x1000d1d4
jmp 0x1000d219
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov edx, dword [ebp - 0x34]
add ecx, edx
mov esi, dword [ebp - 0x14]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x39], bh
mov byte [ebp - 0x3a], cl
je 0x1000d210
jmp 0x1000d252
mov eax, dword [ebp - 0x2c]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x40]
add eax, 2
mov ecx, dword [ebp - 0x44]
add ecx, 1
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
xor eax, eax
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x24]
cmp ecx, edx
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x54], esi
jb 0x1000d229
jmp 0x1000d1d4
mov al, byte [ebp - 0x3a]
test al, 1
jne 0x1000d294
jmp 0x1000d1df
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
add ecx, edx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x54]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x1001ab5c], 0xfffff1ba
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edx
jmp 0x1000d1a9
mov eax, dword [ebp - 0x38]
add eax, 1
mov cl, byte [ebp - 0x39]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x3a]
and ch, dl
cmp eax, 0x20
setb dl
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x59], ch
mov byte [ebp - 0x5a], dl
mov al, byte [ebp - 0x59]
mov cl, byte [ebp - 0x5a]
and al, cl
test al, 1
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x30], edx
jne 0x1000d1a9
jmp 0x1000d210
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x14]
add edi, dword [edx + ecx*4]
mov dword [0x1001ab5c], 0xffffe909
mov dword [ebp - 0x2c], edi
jmp 0x1000d1d4
Function at 0x1000d9ca
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x1001ab60], 0x214c
mov edx, dword [0x1001ab5c]
add edx, 0xffffe7ea
mov dword [0x1001ab5c], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1000ce44
lea ecx, [0x1000d969]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x7c], edx
mov dword [esp + 0x78], 0x12ea00
mov edx, dword [0x1001ab48]
mov dword [esp + 0x60], edx
mov edx, dword [0x1001ab4c]
mov dword [esp + 0x88], edx
mov edx, dword [0x1001ab50]
mov dword [esp + 0x34], edx
mov edx, dword [0x1001ab54]
mov dword [esp + 0x30], edx
mov edx, dword [0x1001ab58]
mov dword [esp + 0x40], edx
mov edx, dword [0x1001ab60]
mov esi, edx
add esi, 0x1175
mov dword [0x1001ab5c], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x1000da95
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
je 0x1000daa9
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x10], eax
jmp 0x1000da72
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x44], ecx
mov edx, dword [esp + 0x14]
add edx, 0xb63
mov dword [0x1001ab5c], edx
mov edx, dword [esp + 8]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x68], esi
mov dword [0x1001ab60], 0x97e
mov esi, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1000c825
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x1001ab5c]
add ecx, 0xffffe325
mov dword [0x1001ab5c], ecx
lea esp, [ebp - 4]
pop esi
pop ebp
ret