joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x581a3a4c
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x411b42
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x44f5f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64f21b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
call fcn.0044f380
push 0x6bb0
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44f635
push eax
mov ecx, edi
call fcn.00407b50
jmp 0x44f637
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [edi + 0xc4]
push ecx
mov ecx, dword [edi + 0xc0]
push ecx
mov dword [edi + 0x768], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x768]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
mov eax, dword [edi + 0x768]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x768]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
add esp, 0x10
ret

Function at 0x44f8e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64f1fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
call fcn.0044f380
mov eax, dword [edi + 0x770]
test eax, eax
je 0x44f929
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x10]
call eax
mov edx, dword [edi]
mov eax, dword [edi + 0x770]
mov edx, dword [edx + 0x88]
push eax
mov ecx, edi
call edx
push 0x130
mov dword [edi + 0x7fc], 1
call fcn.0061c130
add esp, 4
mov dword [esp + 4], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x44f959
push edi
push eax
call fcn.00448cb0
jmp 0x44f95b
xor eax, eax
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [edi + 0xc4]
push ecx
mov ecx, dword [edi + 0xc0]
push ecx
mov dword [edi + 0x770], eax
mov edx, dword [eax]
mov edx, dword [edx + 0xa0]
push 0
push 0
mov ecx, eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x770]
mov eax, dword [eax + 0xc]
push edx
call eax
mov ecx, dword [edi + 0x320]
mov edx, dword [ecx]
mov eax, dword [edi + 0x770]
mov edx, dword [edx + 0x30]
push eax
call edx
mov ecx, dword [edi + 0x320]
mov eax, dword [ecx]
mov edx, dword [edi + 0x770]
mov eax, dword [eax + 0x20]
push edx
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop edi
add esp, 0x10
ret
Function at 0x463150
Capabilities:
Packed with generic packer

Disassembly:
push ecx
push esi
push edi
mov edi, eax
cmp byte [edi + 0x144], 0
je 0x463410
mov ecx, dword [edi]
mov eax, dword [ecx + 0x7f8]
cmp eax, 0x2b
je 0x463410
cmp eax, 0x32
je 0x463410
cmp dword [edi + 0x3c], 2
je 0x46318b
cmp byte [edi + 0x142], 0
je 0x46319b
add dword [edi + 0x4c], 0xffffffff
jns 0x46319b
push edi
call fcn.004679b0
pop edi
pop esi
pop ecx
ret
mov eax, dword [edi + 0x130]
test eax, eax
jle 0x463217
add eax, 0xffffffff
cmp eax, 0x3c
mov dword [edi + 0x130], eax
jne 0x463205
cmp byte [ecx + 0x8c5], 0
jne 0x463205
fldz
mov esi, dword [ecx + 0x784]
mov ecx, dword [0x6a9f00]
fst dword [esp + 8]
fcomp dword [ecx + 0x10e0]
fnstsw ax
test ah, 0x44
jnp 0x4631f1
fld dword [ecx + 0x10e0]
push ecx
fstp dword [esp]
call fcn.005af410
fstp dword [esp + 0xc]
add esp, 4
fld dword [esp + 8]
push ecx
mov eax, 0x53
fstp dword [esp]
mov ecx, esi
call fcn.00515020
cmp dword [edi + 0x130], 0
jne 0x463217
push 0
mov eax, edi
call fcn.0045e860
cmp byte [edi + 0x143], 0
jne 0x463410
cmp byte [edi + 0x142], 0
jne 0x463410
cmp dword [edi + 0x134], 0
jne 0x463410
mov eax, edi
call fcn.00464820
mov eax, dword [edi + 0x54]
test eax, eax
jle 0x463252
add eax, 0xffffffff
mov dword [edi + 0x54], eax
mov ecx, dword [edi]
jmp 0x794c00
pop edi
pop esi
pop ecx
ret

Function at 0x464410
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x794820
push esi
mov esi, eax
mov ecx, dword [esi + 0xa4]
test ecx, ecx
je 0x46444b
mov eax, dword [esi]
mov edx, dword [eax + 0x820]
mov edx, dword [edx + 8]
movzx eax, cx
cmp eax, dword [edx + 8]
jae 0x464446
lea eax, [eax + eax*4]
shl eax, 5
add eax, dword [edx]
cmp dword [eax + 0x9c], ecx
jne 0x464446
cmp dword [eax + 0x5c], 0
jle 0x46444b
call fcn.00464390
cmp byte [esi + 0x143], 0
jne 0x464471
mov eax, dword [esi + 0xb0]
test eax, eax
jle 0x464471
add eax, 0xffffffff
mov dword [esi + 0xb0], eax
jne 0x464471
mov eax, esi
pop esi
jmp 0x464230
pop esi
ret
Function at 0x530a00
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 0xd8]
push esi
xor esi, esi
cmp eax, esi
push edi
je 0x530bb1
mov ebx, dword [ebp + 0x20]
add ebx, 1
cmp eax, 1
mov dword [esp + 0x20], esi
jne 0x530a7b
mov eax, ebp
call fcn.005330e0
test byte [esp + 0x24], 0x10
jne 0x530bab
lea eax, [esp + 0x20]
push eax
push str.anim_screendoor
lea edi, [esp + 0x2c]
mov esi, ebp
call fcn.005345f0
fld dword [esp + 0x24]
mov eax, dword [ebp]
mov ecx, dword [eax + 0x820]
mov esi, dword [ecx]
push 0xc
push ebx
sub esp, 8
fstp dword [esp + 4]
fld dword [esp + 0x30]
fstp dword [esp]
call fcn.00518a70
jmp fcn.00800790
cmp eax, 2
jne 0x530b40
mov edi, ebp
call fcn.0052f440
cmp byte [ebp + 0xbf], 0
je 0x530aa9
push esi
mov eax, ebp
call fcn.0052b5b0
mov byte [ebp + 0xbf], 0
mov dword [ebp + 0xc0], esi
fld dword [0x6796f4]
push ecx
fstp dword [esp]
push 0xa
push 3
push str.anim_gasp
mov dword [ebp + 0x28], 0x1e
call fcn.00528b00
mov eax, ebp
call fcn.005330e0
mov eax, dword [esp + 0x24]
and eax, 0x10
mov dword [esp + 0x18], eax
jne 0x530b1a
lea edx, [esp + 0x14]
push edx
push str.Zombie_paper_paper
lea edi, [esp + 0x28]
mov esi, ebp
call fcn.005345f0
fld dword [esp + 0x20]
mov edx, dword [ebp]
sub esp, 8
fstp dword [esp + 4]
mov eax, 0xd
fld dword [esp + 0x1c]
mov ecx, ebx
fstp dword [esp]
call fcn.00453c80
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x530b92
test byte [esp + 0x24], 1
jne 0x530b92
lea esi, [eax + 0x43]
mov eax, dword [ebp]
call fcn.00453630
push 0
lea edx, [esi + 0x32]
push 0xfffffffffffffff5
mov esi, ebp
call fcn.005322c0
jmp 0x530b92
cmp eax, 3
jne 0x530bab
mov eax, ebp
call fcn.005330e0
test byte [esp + 0x24], 0x10
jne 0x530bab
fld dword [ebp + 0x2c]
mov edx, dword [ebp]
fadd qword [0x679968]
sub esp, 8
mov eax, 0x36
mov ecx, ebx
fstp dword [esp + 0x28]
fld dword [ebp + 0x30]
fadd qword [0x679820]
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fstp dword [esp + 4]
fld dword [esp + 0x28]
fstp dword [esp]
call fcn.00453c80
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x20]
xor esi, esi
cmp edx, esi
je 0x530bab
fld dword [ebp + 0x11c]
push ecx
fstp dword [esp]
call fcn.00518630
mov dword [ebp + 0xd8], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x530e30
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x24
push ebx
push esi
mov ebx, eax
push edi
mov edi, dword [ebx + 0xc4]
test edi, edi
je 0x530fce
lea esi, [esp + 0x14]
mov ecx, ebx
call fcn.0052d9e0
fld dword [ebx + 0x2c]
fadd dword [esp + 0x24]
or esi, 0xffffffff
cmp edi, 1
fiadd dword [esp + 0x14]
fadd qword [0x6794d0]
fstp dword [esp + 0x10]
fld dword [ebx + 0x30]
fadd dword [esp + 0x28]
fiadd dword [esp + 0x18]
fadd dword [esp + 0x20]
fadd qword [0x679340]
fstp dword [esp + 0xc]
jne 0x530ec2
lea eax, [esp + 0x10]
push eax
push str.anim_cone
lea edi, [esp + 0x14]
mov esi, ebx
call fcn.005345f0
push 0xffffffffffffffff
push str.anim_cone
mov eax, ebx
call fcn.005331c0
push 0
push str.anim_hair
mov eax, ebx
call fcn.005331c0
mov esi, 8
jmp 0x530f7a
cmp edi, 2
jne 0x530eff
lea ecx, [esp + 0x10]
push ecx
push str.anim_bucket
lea edi, [esp + 0x14]
mov esi, ebx
call fcn.005345f0
push 0xffffffffffffffff
push str.anim_bucket
mov eax, ebx
call fcn.005331c0
push 0
push str.anim_hair
mov eax, ebx
call fcn.005331c0
mov esi, 9
jmp 0x530f7a
cmp edi, 3
jne 0x530f3c
lea edx, [esp + 0x10]
push edx
push str.zombie_football_helmet
lea edi, [esp + 0x14]
mov esi, ebx
call fcn.005345f0
push 0xffffffffffffffff
push str.zombie_football_helmet
mov eax, ebx
call fcn.005331c0
push 0
push str.anim_hair
mov eax, ebx
call fcn.005331c0
mov esi, 0xa
jmp 0x530f7a
cmp edi, 4
jne 0x530f69
lea eax, [esp + 0x10]
push eax
push str.Zombie_digger_hardhat
lea edi, [esp + 0x14]
mov esi, ebx
call fcn.005345f0
push str.Zombie_digger_hardhat
mov ecx, ebx
call fcn.00533200
mov esi, 0xe
jmp 0x530f7a
cmp edi, 7
jne 0x530f7a
test byte [esp + 0x34], 0x10
jne 0x530fc4
call fcn.00527f20
test byte [esp + 0x34], 0x10
jne 0x530fc4
cmp esi, 0xffffffff
je 0x530fc4
mov eax, dword [ebx + 0x20]
fld dword [esp + 0xc]
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x820]
push esi
mov esi, dword [ecx]
add eax, 1
push eax
sub esp, 8
fstp dword [esp + 4]
fld dword [esp + 0x20]
fstp dword [esp]
call fcn.00518a70
test eax, eax
je 0x530fc4
jmp 0x800590
mov dword [ebx + 0xc4], 0
pop edi
pop esi
pop ebx
add esp, 0x24
ret 4
Function at 0x5c7b20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x63f998
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x699fe8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
xor ebx, ebx
cmp ecx, ebx
mov dword [esp + 0x20], ebx
lea edi, [esi + 0xc]
mov dword [esi], vtable.Sexy::DSoundInstance.0
mov dword [esi + 4], eax
mov byte [esi + 0x12], bl
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov dword [esi + 8], ecx
mov dword [edi], ebx
fld qword [0x65b8f8]
lea ebp, [esi + 0x30]
fst qword [esi + 0x18]
fstp qword [esi + 0x28]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], ebx
mov dword [ebp], 0xac44
je 0x5c7c41
mov eax, dword [eax + 0x3094]
mov edx, dword [eax]
push edi
push ecx
push eax
mov eax, dword [edx + 0x14]
call eax
cmp eax, ebx
je 0x5c7c36
cmp eax, 0x8878000a
jg 0x5c7c00
je 0x5c7bec
cmp eax, 0x8007000e
je 0x5c7bd8
cmp eax, 0x80070057
jne 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_INVALIDPARAM
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_OUTOFMEMORY
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_ALLOCATED
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x5c7c48
cmp eax, 0x88780032
je 0x5c7c22
cmp eax, 0x887800aa
jne 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_UNINITIALIZED
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x5c7c48
push ebx
push 0x67548c
push str.DSERR_INVALIDCALL
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x5c7c48
mov edi, dword [edi]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x20]
push ebp
push edi
call edx
mov eax, esi
call fcn.005c7ce0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x5c7fb0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x404
mov eax, dword [0x699fe8]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [esp + 0x408], 0
mov eax, dword [esp + 0x40c]
jne 0x5c8003
push eax
lea eax, [esp + 4]
push str._s_function_not_found_in_main.obb
push eax
call fcn.0061d4e6
add esp, 0xc
push 0x10
push str.Error
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.0061dd92
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.0061efd1
add esp, 0x404
ret
Function at 0x7956d0
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, dword [ebx + 0xe0]
test ecx, ecx
je 0x7957df
mov ecx, dword [ebx + 0xe4]
test ecx, ecx
je 0x7957df
pushal
mov byte [ebx + 0xf0], 0
fld dword [ebx + 0xe8]
fchs
fstp dword [ebx + 0xe8]
fld dword [ebx + 0xec]
fchs
fstp dword [ebx + 0xec]
mov esi, ecx
mov eax, 0xc8
cmp dword [ebx + 0x150], 0
jle 0x795727
add eax, 0x3c
push eax
call fcn.005317c0
mov esi, 0x30
mov eax, dword [ebx]
call fcn.00453630
mov esi, 0x2e
mov eax, dword [ebx]
call fcn.00453630
mov eax, 0xf
mov ecx, 0x61a80
push dword [ebx + 0xcc]
push dword [ebx + 0xc8]
mov edx, dword [ebx]
call fcn.00453c80
popal
mov dword [ebx + 0xe4], 0
mov dword [ebx + 0xe0], 0
mov dword [ebx + 0x54], 0xafc8
cmp dword [ebx + 0xd8], 0
je 0x7957df
cmp dword [ebx + 0xd8], 3
je 0x7957d8
cmp dword [ebx + 0xd8], 6
je 0x7957d8
cmp dword [ebx + 0xd8], 9
je 0x7957d8
cmp dword [ebx + 0xd8], 0xc
je 0x7957d8
cmp dword [ebx + 0xd8], 0xd
je 0x7957d8
cmp dword [ebx + 0xd8], 0x10
je 0x7957d8
cmp dword [ebx + 0xd8], 0x15
je 0x7957d8
cmp dword [ebx + 0xd8], 0x18
je 0x7957d8
add dword [ebx + 0xd8], 1
jmp 0x7957df
mov dword [ebx + 0x54], 1
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10c4a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.10c4a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10c4a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10c4a06a
add dl, dl
jne 0x10c4a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10c4a0dc
xor eax, eax
add dl, dl
jne 0x10c4a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10c4a17d
add dl, dl
jne 0x10c4a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10c4a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10c4a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10c4a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10c4a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10c4a075
mov eax, 1
add dl, dl
jne 0x10c4a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10c4a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10c4a0e1
sub eax, ebx
mov ebx, 1
jne 0x10c4a128
mov ecx, 1
add dl, dl
jne 0x10c4a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10c4a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10c4a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10c4a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10c4a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10c4a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10c4a136
cmp eax, 0x7d00
jae 0x10c4a16d
cmp eax, 0x500
jb 0x10c4a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10c4a075
cmp eax, 0x7f
ja 0x10c4a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10c4a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10c4a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10c4a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x61e04744
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ecx, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
movzx esi, word [ecx + 0x28]
mov di, word [eax + 0x2a]
mov eax, dword [edx + 0x28]
mov bx, word [edx + 0x2a]
mov dword [ebp - 0x10], edx
mov word [ebp - 0x14], ax
mov edx, esi
movzx eax, di
sub edx, eax
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x18], edx
movzx edx, bx
sub eax, edx
cmp dword [ebp - 0x18], eax
jge 0x61e04812
cmp di, bx
jb 0x61e04812
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
cmp word [ecx + 0x14], ax
jl 0x61e047aa
mov eax, 0
jg 0x61e04814
mov ebx, dword [ebp - 0x10]
mov di, word [ebx + 0x16]
cmp word [ecx + 0x16], di
jg 0x61e04814
movzx eax, word [ebp - 0x14]
xor edi, edi
mov dword [ebp - 0x18], eax
add eax, 0x3fffffff
mov dword [ebp - 0x1c], eax
cmp edi, esi
je 0x61e047f9
lea eax, [esi + 0x3fffffff]
mov ebx, dword [ecx + 0x30]
sub eax, edi
mov ebx, dword [ebx + eax*4]
test ebx, ebx
je 0x61e047f6
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
cmp dword [ebp - 0x18], edx
je 0x61e04812
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14]
inc dword [ebp - 0x14]
mov eax, edx
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x30]
cmp ebx, dword [edx + eax*4]
jne 0x61e047d8
inc edi
jmp 0x61e047bb
test byte [ecx + 0x24], 0x40
mov eax, 1
je 0x61e04814
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
shr eax, 6
and eax, 1
jmp 0x61e04814
xor dword [esi + 0x57], edx
push edi
push ebx
push ebp
sub esp, 0x38
mov edi, dword [0x61e97922]
and bh, byte [ecx - 0x17]
popal
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov edx, dword [ebx]
cmp edx, ebx
je 0x61e04888
xor ebp, ebp
mov esi, dword [edx + 0x30]
mov ecx, ebp
movzx eax, word [esi]
test eax, eax
je 0x61e0487a
mov dword [esp + 8], edx
mov eax, ebp
mov dword [esp + 4], ebx
mov dword [esp], edi
movzx ebx, word [esi + eax*2]
inc eax
lea edx, [ebx - 0x41]
cmp edx, 0x19
lea edi, [ebx + 0x20]
jbe 0x61e04862
mov edi, ebx
movzx edx, di
movzx ebx, word [esi + eax*2]
add ecx, edx
test ebx, ebx
jne 0x61e04850
mov edx, dword [esp + 8]
mov ebx, dword [esp + 4]
mov edi, dword [esp]
cmp edi, ecx
je 0x61e05107
mov edx, dword [edx]
cmp edx, ebx
jne 0x61e04837
xor ebx, ebx
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov esi, dword [0x61e9790e]
mov edi, dword [0x61e978e2]
mov edx, dword [0x61e97936]
mov eax, dword [ecx + esi*8 + 0x78]
mov dword [esp + 0xc], edx
mov edx, dword [eax + ebx + 0x24]
mov esi, dword [eax + ebx + 0x20]
add edx, ebx
mov ecx, dword [eax + ebx + 0x1c]
add esi, ebx
mov eax, dword [eax + ebx + 0x18]
add ecx, ebx
test eax, eax
jbe 0x61e04949
mov dword [esp + 0x30], ebx
xor ebp, ebp
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
xor ecx, ecx
jmp 0x61e04936
mov ebx, dword [edx + 0x18]
jmp 0x61e0488a
Function at 0x61e04813
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ecx, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
movzx esi, word [ecx + 0x28]
mov di, word [eax + 0x2a]
mov eax, dword [edx + 0x28]
mov bx, word [edx + 0x2a]
mov dword [ebp - 0x10], edx
mov word [ebp - 0x14], ax
mov edx, esi
movzx eax, di
sub edx, eax
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x18], edx
movzx edx, bx
sub eax, edx
cmp dword [ebp - 0x18], eax
jge 0x61e04812
cmp di, bx
jb 0x61e04812
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
cmp word [ecx + 0x14], ax
jl 0x61e047aa
mov eax, 0
jg 0x61e04814
mov ebx, dword [ebp - 0x10]
mov di, word [ebx + 0x16]
cmp word [ecx + 0x16], di
jg 0x61e04814
movzx eax, word [ebp - 0x14]
xor edi, edi
mov dword [ebp - 0x18], eax
add eax, 0x3fffffff
mov dword [ebp - 0x1c], eax
cmp edi, esi
je 0x61e047f9
lea eax, [esi + 0x3fffffff]
mov ebx, dword [ecx + 0x30]
sub eax, edi
mov ebx, dword [ebx + eax*4]
test ebx, ebx
je 0x61e047f6
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
cmp dword [ebp - 0x18], edx
je 0x61e04812
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x14]
inc dword [ebp - 0x14]
mov eax, edx
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x30]
cmp ebx, dword [edx + eax*4]
jne 0x61e047d8
inc edi
jmp 0x61e047bb
test byte [ecx + 0x24], 0x40
mov eax, 1
je 0x61e04814
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
shr eax, 6
and eax, 1
jmp 0x61e04814
xor dword [esi + 0x57], edx
push edi
push ebx
push ebp
sub esp, 0x38
mov edi, dword [0x61e97922]
and bh, byte [ecx - 0x17]
popal
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov edx, dword [ebx]
cmp edx, ebx
je 0x61e04888
xor ebp, ebp
mov esi, dword [edx + 0x30]
mov ecx, ebp
movzx eax, word [esi]
test eax, eax
je 0x61e0487a
mov dword [esp + 8], edx
mov eax, ebp
mov dword [esp + 4], ebx
mov dword [esp], edi
movzx ebx, word [esi + eax*2]
inc eax
lea edx, [ebx - 0x41]
cmp edx, 0x19
lea edi, [ebx + 0x20]
jbe 0x61e04862
mov edi, ebx
movzx edx, di
movzx ebx, word [esi + eax*2]
add ecx, edx
test ebx, ebx
jne 0x61e04850
mov edx, dword [esp + 8]
mov ebx, dword [esp + 4]
mov edi, dword [esp]
cmp edi, ecx
je 0x61e05107
mov edx, dword [edx]
cmp edx, ebx
jne 0x61e04837
xor ebx, ebx
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov esi, dword [0x61e9790e]
mov edi, dword [0x61e978e2]
mov edx, dword [0x61e97936]
mov eax, dword [ecx + esi*8 + 0x78]
mov dword [esp + 0xc], edx
mov edx, dword [eax + ebx + 0x24]
mov esi, dword [eax + ebx + 0x20]
add edx, ebx
mov ecx, dword [eax + ebx + 0x1c]
add esi, ebx
mov eax, dword [eax + ebx + 0x18]
add ecx, ebx
test eax, eax
jbe 0x61e04949
mov dword [esp + 0x30], ebx
xor ebp, ebp
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
xor ecx, ecx
jmp 0x61e04936
mov ebx, dword [edx + 0x18]
jmp 0x61e0488a