joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d41b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x858660]
test esi, esi
jle 0x5d429d
mov edi, dword [0x858664]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x5d41e4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x5d4296
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x5d41d0
mov dword [esp], eax
mov ebx, eax
call fcn.005d4ae0
test eax, eax
mov edi, eax
je 0x5d42da
lea ebx, [esi + esi*2]
mov esi, dword [0x858664]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.005d4be0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x858664]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x5d42ba
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x5d428f
sub eax, 0x40
and eax, 0xffffffbf
je 0x5d428f
mov eax, dword [esp + 0x20]
add ebx, dword [0x858664]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x5d42a4
add dword [0x858660], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x5d41ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 0x746d98
mov dword [esp + 4], eax
call fcn.005d4150
mov eax, dword [0x858664]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], 0x746d64
mov dword [esp + 4], eax
call fcn.005d4150
mov dword [esp + 4], ebx
mov dword [esp], 0x746d44
call fcn.005d4150
lea esi, [esi]

Function at 0x5d4750
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x858678
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x858670]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x5d47a5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x5d479e
test esi, esi
je 0x5d479e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x5d4780
mov dword [esp], 0x858678
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x5d4a00
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x5d4a38
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x5d4a2e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x5d4a3a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x5d4a20
xor eax, eax
pop ebx
pop esi
ret
Function at 0x5e24b0
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
sub ecx, 1
push esi
push ebx
mov ebx, 0x66666667
mov ebp, edx
mov esi, 1
sub esp, 0x2c
mov dword [esp + 0x1c], eax
mov eax, ecx
mov dword [esp + 0x10], ecx
sar eax, 0x1f
mov edi, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov eax, ecx
sar ecx, 0x1f
imul ebx
mov ebx, edx
sar ebx, 2
sub ebx, ecx
je 0x5e2503
mov ecx, 0x66666667
mov eax, ebx
sar ebx, 0x1f
add esi, 1
imul ecx
sar edx, 2
sub edx, ebx
mov ebx, edx
jne 0x5e24f0
mov eax, dword [edi + 0x28]
cmp eax, 0xffffffff
je 0x5e2580
cmp eax, esi
cmovge esi, eax
mov eax, dword [edi + 8]
lea edx, [esi + 2]
cmp eax, edx
jg 0x5e2571
mov dword [edi + 8], 0xffffffff
mov eax, dword [esp + 0x1c]
mov dword [esp], edi
mov ecx, 1
mov edx, ebp
add esi, 1
call fcn.005e1d80
mov eax, dword [edi + 0x28]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 4]
mov edx, eax
and eax, 0x20
or edx, 0x1c0
or eax, 0x45
mov dword [edi + 4], edx
mov edx, edi
call fcn.005e1910
add dword [edi + 8], esi
mov eax, dword [esp + 0x10]
mov ecx, edi
mov edx, dword [esp + 0x14]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.005e21a0
sub eax, edx
mov dword [edi + 8], eax
jmp 0x5e2521
mov edx, dword [0x7179cc]
cmp edx, 0xffffffff
je 0x5e25a9
test edx, edx
mov eax, 2
jne 0x5e25a1
call fcn.005e76d0
and eax, 1
neg eax
add eax, 3
mov dword [edi + 0x28], eax
jmp 0x5e250b
mov dword [esp], str.PRINTF_EXPONENT_DIGITS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x5e25cf
movsx eax, byte [eax]
xor edx, edx
sub eax, 0x30
cmp eax, 2
setbe dl
mov dword [0x7179cc], edx
jmp 0x5e258b
xor edx, edx
jmp 0x5e25c7
Function at 0x5e9370
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x717a10], eax
je 0x5e9387
add esp, 0xc
ret
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x5e9790
Capabilities:
Print debug messages

Disassembly:
test eax, eax
je 0x5e97b5
push edi
push esi
push ebx
mov ebx, eax
add esp, 0xffffff80
mov dword [esp], eax
call fcn.005e9150
cmp eax, 1
je 0x5e97b7
mov dword [ebx], 0xffffffff
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
repz ret
lea ebx, [esp + 0x15]
mov esi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
xor eax, eax
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x3d]
mov cl, 0x43
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.msvcrt.dll__ultoa]
cmp byte [esp + 0x3c], 0
mov eax, 0x27
jne 0x5e9805
jmp 0x5e9813
cmp eax, 0x6a
je 0x5e981d
add eax, 1
cmp byte [ebx + eax], 0
jne 0x5e9800
cmp eax, 0x6a
je 0x5e981d
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + eax + 0x16], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push eax
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x5e98c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp dword [0x859108], 1
je 0x5e98d5
call fcn.005e9830
mov eax, dword [0x717a10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x5e98f2
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.005e96e0
test eax, eax
mov ebx, eax
je 0x5e99f9
mov eax, dword [entry3]
test eax, eax
je 0x5e99f9
mov dword [ebx + 0x24], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebx + 0x3c], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x18], eax
lea eax, [ebx + 0x38]
sub esp, 0x10
mov dword [ebx + 0x1c], 0xffffffff
call fcn.005e9790
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x14], 0
call esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, eax
call esi
mov edx, eax
lea eax, [ebx + 0x14]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x5e9a00
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebx + 0x6c], eax
movzx eax, byte [ebx + 0x20]
sub esp, 4
mov dword [ebx + 0x68], 0
and eax, 0xffffffcf
or eax, 0x10
mov byte [ebx + 0x20], al
mov eax, dword [0x717a10]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
je 0x5e9a00
mov eax, ebx
jmp 0x5e98ea
xor eax, eax
jmp 0x5e98ea
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
push esi
push ebx
mov eax, 0x80070057
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
test edx, edx
jg 0x5e9a32
pop ebx
pop esi
ret 0xc
mov esi, ebx
movzx eax, byte [ecx]
test al, al
je 0x5e9a54
lea ebx, [esi + 1]
add ecx, 1
sub edx, 1
mov byte [ebx - 1], al
jne 0x5e9a30
mov eax, 0x8007007a
mov byte [esi], 0
pop ebx
pop esi
ret 0xc
xor eax, eax
jmp 0x5e9a4c
Function at 0x5f0f00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x5f0f30
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x5f0ff0
add esp, 0x14
mov eax, 1
pop ebx
pop esi
ret 0xc
cmp eax, 1
je 0x5f10b0
cmp eax, 3
jne 0x5f0f19
mov eax, dword [0x717a10]
cmp eax, 0xffffffff
je 0x5f0f19
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x5f0f19
test byte [eax + 0x20], 0x30
je 0x5f1020
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x5f10d2
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x5f0fa4
mov dword [esp], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [ebx + 0x18]
sub esp, 4
test eax, eax
je 0x5f0f96
mov dword [esp], eax
call esi
sub esp, 4
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x14], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.005e8f70
lea eax, [ebx + 0x38]
call fcn.005e9790
mov edx, dword [ebx + 0xb0]
test edx, edx
je 0x5f10ea
mov eax, dword [0x717a10]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
mov eax, 1
add esp, 0x14
pop ebx
pop esi
ret 0xc
mov eax, dword [0x8590e4]
test eax, eax
je 0x5f0f19
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov dword [0x8590e4], 0
sub esp, 4
jmp 0x5f0f19
mov eax, dword [eax + 0x68]
test eax, eax
mov eax, dword [ebx + 0x18]
jne 0x5f1080
test eax, eax
je 0x5f103a
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, dword [ebx + 0xb4]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x68], 1
test eax, eax
jne 0x5f10e0
test byte [ebx + 0x24], 4
je 0x5f1097
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
test eax, eax
je 0x5f0f9d
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x5f0f9d
test eax, eax
je 0x5f1090
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x1c]
mov dword [esp], eax
call fcn.005e8f70
lea eax, [ebx + 0x38]
call fcn.005e9790
jmp 0x5f0f19
mov dword [esp + 4], 0x5e91b0
mov dword [esp], 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
sub esp, 8
mov dword [0x8590e4], eax
jmp 0x5f0f19
call fcn.005f0df0
jmp 0x5f0f72
call fcn.005f0df0
jmp 0x5f1056
mov eax, ebx
call fcn.005e9410
jmp 0x5f0fc5
Function at 0x5f1a30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.005e98c0
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x5f1ab2
test byte [ebx + 0x20], 0x30
jne 0x5f1a66
add ebx, 0x70
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.msvcrt.dll_longjmp
mov eax, dword [0x717a10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
push edx
mov ebx, eax
je 0x5f1aa9
cmp dword [eax + 0x14], 0
je 0x5f1ab9
mov esi, dword [eax + 4]
mov dword [eax + 0x68], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x5f1a9c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x5f1afd
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call fcn.005f0df0
jmp 0x5f1a4d
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x5f1ad0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x5f1b20
mov eax, dword [0x717a10]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x5f1aa9
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xb0], 0
mov dword [ebx + 0x14], 0
jne 0x5f1ae3
mov eax, ebx
call fcn.005e9410
jmp 0x5f1ae3
Function at 0x6129c4
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [0x718d44]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edx
xor edx, edx
test eax, eax
je 0x6129df
mov edx, dword [eax + 4]
mov eax, edx
add esp, 0x1c
ret

Function at 0x6129e8
Capabilities:
Get thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [0x718d44]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edx
test eax, eax
je 0x612a10
mov edx, dword [esp + 0x20]
cmp dword [eax], edx
jne 0x612a0b
mov eax, dword [eax + 4]
jmp 0x612a12
mov eax, dword [eax + 8]
jmp 0x6129fa
xor eax, eax
add esp, 0x1c
ret
Function at 0x639240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1b
mov ebp, esp
push edi
push esi
push ebx
lea edi, [ebp - 0x84]
mov esi, str.not_enough_space_for_format_expansion__Please_submit_full_bug_report_at_http:__gcc.gnu.org_bugs.html_:_n
sub esp, 0x9c
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
lea eax, [edx + 1]
mov dword [ebp - 0x8c], eax
lea eax, [edx + 0x8a]
and eax, 0xfffffff0
call fcn.005d4d10
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x84]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 8]
movzx eax, word [esi]
mov word [edi], ax
movzx eax, byte [esi + 2]
mov byte [edi + 2], al
lea eax, [ebx + 0x6b]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x8c]
mov byte [ebx + eax + 0x6a], 0
mov dword [esp], ebx
call fcn.006dfd70
nop
nop
nop
nop
nop
nop
nop
push esi
push ebx
sub esp, 0x24
cmp byte [0x7198bc], 0
jne 0x63931e
mov byte [0x7198bc], 1
call fcn.006eb700
test eax, eax
je 0x6393cd
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x1c], 0xffffffff
sete al
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.005d3b20
mov esi, eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
cmp dword [esp + 0x1c], 0
mov dword [esp + 4], eax
je 0x639314
mov dword [esp], ebx
call sub.msvcrt.dll_fputs
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x7450ad
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
cmp dword [esp + 0x1c], 0
je 0x63934b
call fcn.006ebba0
mov dword [esp], esi
call sub.msvcrt.dll_fputs
jmp 0x6392e0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
mov dword [esp], esi
call fcn.005e7498
jmp 0x63930f
call sub.msvcrt.dll_abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6393c8
Function at 0x6d9050
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
push edi
push esi
push ebx
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor edx, edi
cmp edi, 3
jbe 0x6d90ff
lea ebp, [edi - 4]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x14]
mov eax, ebp
shr eax, 2
lea esi, [esi + eax*4 + 4]
nop
lea esi, [esi]
imul eax, dword [ebx], 0x5bd1e995
imul edx, edx, 0x5bd1e995
add ebx, 4
mov ecx, eax
shr ecx, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e995
xor edx, eax
cmp ebx, esi
jne 0x6d9080
mov eax, dword [esp + 0x14]
and ebp, 0xfffffffc
and edi, 3
lea eax, [eax + ebp + 4]
cmp edi, 2
je 0x6d90e9
cmp edi, 3
je 0x6d90e0
cmp edi, 1
je 0x6d90f2
mov eax, edx
shr eax, 0xd
xor edx, eax
imul eax, edx, 0x5bd1e995
pop ebx
pop esi
mov edx, eax
shr edx, 0xf
xor eax, edx
pop edi
pop ebp
ret
movzx ecx, byte [eax + 2]
shl ecx, 0x10
xor edx, ecx
movzx ecx, byte [eax + 1]
shl ecx, 8
xor edx, ecx
movzx eax, byte [eax]
xor edx, eax
imul edx, edx, 0x5bd1e995
jmp 0x6d90bf
mov eax, dword [esp + 0x14]
jmp 0x6d90b0

Function at 0x6db270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
lea esi, [esp + 0x20]
mov ebx, dword [esp + 0x74]
mov ecx, esi
mov dword [esp], eax
call fcn.0069fca4
push eax
mov ecx, dword [edi + 8]
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov ebp, dword [ebx + 4]
mov dword [esp + 0x48], ecx
mov ecx, dword [edi + 0xc]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x30]
mov edi, dword [ebx + 8]
mov dword [esp + 0x40], edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x4c], ecx
mov ecx, dword [ebx + 0xc]
mov ebx, dword [ebx]
mov dword [esp + 4], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x38], edi
mov dword [esp], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x30], ebx
call fcn.006e8360
mov dword [esp + 0x18], esi
mov edx, eax
test edx, edx
jle 0x6db39d
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x20]
mov ebx, ebp
sub ebx, dword [esp + 0x44]
mov eax, edi
sub eax, dword [esp + 0x24]
sar ebx, 3
sar eax, 3
imul ebx, ebx, 0xeeeeeeef
imul eax, eax, 0xeeeeeeef
test ebx, ebx
mov ecx, eax
jne 0x6db328
mov ebx, dword [esp + 0x4c]
mov ebp, dword [ebx - 4]
mov ebx, 4
add ebp, 0x1e0
test eax, eax
jne 0x6db33e
mov eax, dword [esp + 0x2c]
mov ecx, 4
mov edi, dword [eax - 4]
add edi, 0x1e0
cmp ebx, edx
cmovg ebx, edx
cmp ebx, ecx
cmovg ebx, ecx
imul esi, ebx, 0x78
sar esi, 3
imul esi, esi, 0xeeeeeeef
test esi, esi
mov dword [esp + 0x1c], edx
jle 0x6db374
sub ebp, 0x78
sub edi, 0x78
dec esi
mov dword [esp], ebp
mov ecx, edi
call fcn.005f7284
push eax
mov edx, dword [esp + 0x1c]
jmp 0x6db354
mov esi, ebx
lea ecx, [esp + 0x40]
neg esi
mov dword [esp], esi
call fcn.0069fc40
push edx
mov ecx, dword [esp + 0x18]
mov dword [esp], esi
call fcn.0069fcec
push ecx
mov edx, dword [esp + 0x1c]
sub edx, ebx
jmp 0x6db2e2
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x70]
mov dword [esp], eax
call fcn.0069fca4
push eax
mov eax, dword [esp + 0x70]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6db3bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
lea esi, [esp + 0x20]
mov ebx, dword [esp + 0x74]
mov ecx, esi
mov dword [esp], eax
call fcn.0069fdec
push ebp
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
mov edi, dword [edi + 0xc]
mov ebp, dword [ebx + 4]
mov dword [esp + 0x40], edx
mov dword [esp + 0x48], ecx
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x4c], edi
mov edi, dword [ebx + 8]
mov ebx, dword [ebx]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], ecx
mov dword [esp + 4], eax
mov dword [esp + 0x38], edi
mov dword [esp + 0x30], ebx
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call fcn.006e83d0
mov dword [esp + 0x18], ebx
mov ebp, eax
mov dword [esp + 0x1c], esi
test ebp, ebp
jle 0x6db4f7
mov eax, dword [esp + 0x40]
mov ebx, eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
sub ebx, dword [esp + 0x44]
mov edx, eax
sub edx, dword [esp + 0x24]
mov dword [esp + 0x14], eax
sar ebx, 3
imul ebx, ebx, 0xcccccccd
sar edx, 3
imul edx, edx, 0xcccccccd
test ebx, ebx
mov eax, edx
jne 0x6db484
mov ecx, dword [esp + 0x4c]
mov ebx, 0xc
mov ecx, dword [ecx - 4]
lea esi, [ecx + 0x1e0]
mov dword [esp + 0x10], esi
test edx, edx
jne 0x6db49d
mov eax, dword [esp + 0x2c]
mov eax, dword [eax - 4]
add eax, 0x1e0
mov dword [esp + 0x14], eax
mov eax, 0xc
cmp ebx, ebp
cmovg ebx, ebp
cmp ebx, eax
cmovg ebx, eax
xor edx, edx
imul eax, ebx, 0x28
sar eax, 3
imul eax, eax, 0xcccccccd
sub edx, 0x28
test eax, eax
jle 0x6db4d2
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
mov ecx, 9
dec eax
add edi, edx
add esi, edx
rep movsd dword es:[edi], dword [esi]
jmp 0x6db4b5
mov ecx, dword [esp + 0x18]
mov esi, ebx
sub ebp, ebx
neg esi
mov dword [esp], esi
call fcn.0069fd7c
push edx
mov ecx, dword [esp + 0x1c]
mov dword [esp], esi
call fcn.0069fe34
push ecx
jmp 0x6db432
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x70]
mov dword [esp], eax
call fcn.0069fdec
push eax
mov eax, dword [esp + 0x70]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6db568
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x7c]
mov esi, dword [esp + 0x78]
lea ebp, [esp + 0x20]
mov ebx, dword [esp + 0x74]
mov ecx, ebp
mov dword [esp], eax
call fcn.006a0090
push edi
mov edi, dword [esi + 8]
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x48], edi
mov edi, dword [esi + 0xc]
mov esi, dword [ebx + 8]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x4c], edi
mov edi, dword [ebx + 4]
mov dword [esp + 0x38], esi
mov ebx, dword [ebx]
lea esi, [esp + 0x40]
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
call fcn.006e84e4
mov dword [esp + 0x1c], ebp
mov edi, eax
test edi, edi
jle 0x6db673
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x20]
mov ebx, edx
mov ecx, eax
sub ebx, dword [esp + 0x44]
sub ecx, dword [esp + 0x24]
sar ecx, 2
sar ebx, 2
mov ebp, ecx
jne 0x6db612
mov edx, dword [esp + 0x4c]
mov ebx, pe_nt_image_headers32
mov edx, dword [edx - 4]
add edx, 0x200
test ecx, ecx
jne 0x6db627
mov eax, dword [esp + 0x2c]
mov ebp, pe_nt_image_headers32
mov eax, dword [eax - 4]
add eax, 0x200
cmp ebx, edi
cmovg ebx, edi
cmp ebx, ebp
cmovg ebx, ebp
mov ebp, ebx
shl ebp, 2
je 0x6db650
mov ecx, ebp
mov dword [esp + 8], ebp
neg ecx
add edx, ecx
add eax, ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memmove
mov ebp, ebx
mov ecx, esi
sub edi, ebx
neg ebp
mov dword [esp], ebp
call fcn.0069ffcc
push edx
mov ecx, dword [esp + 0x1c]
mov dword [esp], ebp
call fcn.006a00d8
push ecx
jmp 0x6db5da
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x70]
mov dword [esp], eax
call fcn.006a0090
push eax
mov eax, dword [esp + 0x70]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret