joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100017e0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x218
mov eax, dword [0x10013040]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
xor eax, eax
push 0x206
mov edi, ecx
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.10008da0
add esp, 0xc
call fcn.10001dd0
test esi, esi
jne 0x10001840
cmp dword [edi + 0x34], 8
jb 0x10001830
mov eax, dword [edi + 0x20]
push eax
push 0x104
lea edx, [esp + 0x10]
push edx
jmp 0x1000184b
lea eax, [edi + 0x20]
push eax
push 0x104
lea edx, [esp + 0x10]
push edx
jmp 0x1000184b
push esi
push 0x104
lea eax, [esp + 0x10]
push eax
push 0
push str.Description
push 0x10010b5c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001864
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0xc]
push ecx
xor eax, eax
mov ecx, edi
call fcn.100022b0
cmp dword [edi + 0x18], 8
jb 0x100018a1
mov eax, dword [edi + 4]
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.100062d6
add esp, 0x218
ret
mov ecx, dword [esp + 0x214]
lea eax, [edi + 4]
pop edi
xor ecx, esp
call fcn.100062d6
add esp, 0x218
ret
Function at 0x10004600
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0x10014960
mov dword [0x1001482c], 0
mov dword [0x10014828], ebx
call fcn.10001dd0
mov esi, dword [ebp + 0xc]
mov eax, esi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004630
sub eax, edx
sar eax, 1
push eax
push esi
xor eax, eax
mov ecx, 0x10014960
call fcn.100022b0
mov edi, 0x10014928
call fcn.10001dd0
mov edi, 0x1001490c
call fcn.10001dd0
push 0xa
push str.languages_
xor eax, eax
mov ecx, 0x10014928
call fcn.100022b0
call fcn.10005930
mov ecx, eax
lea edx, [ecx + 2]
mov edi, edi
mov di, word [ecx]
add ecx, 2
test di, di
jne 0x10004680
sub ecx, edx
sar ecx, 1
push ecx
push eax
xor eax, eax
mov ecx, 0x10014928
call fcn.100022b0
mov edi, 0x1001490c
call fcn.10001dd0
push ebx
mov ecx, esi
call fcn.100041a0
mov ecx, eax
lea edx, [ecx + 2]
mov si, word [ecx]
add ecx, 2
test si, si
jne 0x100046b4
sub ecx, edx
sar ecx, 1
push ecx
push eax
xor eax, eax
mov ecx, 0x1001490c
call fcn.100022b0
push 0xffffffffffffffff
push 0
push 0x10014928
xor esi, esi
mov ebx, 0x1001490c
call fcn.10002ca0
mov eax, dword [0x10014910]
mov esi, 8
cmp dword [0x10014924], esi
jae 0x100046fd
mov eax, 0x10014910
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10004757
mov eax, dword [0x10014910]
cmp dword [0x10014924], esi
jae 0x1000471a
mov eax, 0x10014910
mov ebx, 0x10014830
call fcn.10001430
mov edi, 0x1001490c
call fcn.10001dd0
push 0xb
push str.english.lng
xor eax, eax
mov ecx, edi
call fcn.100022b0
push 0xffffffffffffffff
push 0
push 0x10014928
xor esi, esi
mov ebx, edi
call fcn.10002ca0
mov esi, 8
jmp 0x100047b5
mov edi, 0x1001490c
call fcn.10001dd0
push 0xb
push str.english.lng
xor eax, eax
mov ecx, edi
call fcn.100022b0
push 0xffffffffffffffff
push 0
push 0x10014928
xor esi, esi
mov ebx, edi
call fcn.10002ca0
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push eax
mov ecx, str.english.lng
call fcn.10004420
mov eax, dword [0x10014910]
mov esi, 8
cmp dword [0x10014924], esi
jae 0x100047ab
mov eax, 0x10014910
mov ebx, 0x10014830
call fcn.10001430
mov eax, dword [0x10014910]
cmp dword [0x10014924], esi
jae 0x100047c7
mov eax, 0x10014910
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov eax, dword [0x10014910]
jne 0x10004800
cmp dword [0x10014924], esi
jae 0x100047e4
mov eax, 0x10014910
push 0x10
push str.FileNotExists
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.10004870
push 0
call fcn.10006cad
cmp dword [0x10014924], esi
jae 0x1000480d
mov eax, 0x10014910
mov ebx, 0x10014890
call fcn.10001430
mov edi, 0x1001490c
call fcn.10001dd0
mov edi, 0x10014944
call fcn.10001dd0
push str.Description
mov ecx, 0x10014830
call fcn.100018c0
mov ecx, eax
lea esi, [ecx + 2]
nop
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x10004840
sub ecx, esi
sar ecx, 1
push ecx
push eax
xor eax, eax
mov ecx, 0x10014944
call fcn.100022b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10005190
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1000e548
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x10013040]
xor eax, esp
mov dword [esp + 0x2d8], eax
push ebx
push esi
push edi
mov eax, dword [0x10013040]
xor eax, esp
push eax
lea eax, [esp + 0x2f0]
mov dword fs:[0], eax
lea eax, [esp + 0x34]
push eax
call fcn.10001240
mov edi, 0x1001490c
mov dword [esp + 0x2f8], 0
call fcn.10001dd0
push 5
push 0x10010c50
xor eax, eax
mov ecx, edi
call fcn.100022b0
push 0xffffffffffffffff
push 0
push 0x10014928
xor esi, esi
mov ebx, edi
call fcn.10002ca0
mov ecx, dword [0x10014994]
mov edx, dword [ecx + 4]
push edx
mov ecx, 0x1001497c
call fcn.100028c0
mov eax, dword [0x10014994]
mov dword [eax + 4], eax
mov eax, dword [0x10014994]
mov dword [0x10014998], esi
mov dword [eax], eax
mov eax, dword [0x10014994]
mov dword [eax + 8], eax
cmp dword [0x10014924], 8
mov eax, dword [0x10014910]
jae 0x10005255
mov eax, 0x10014910
lea ecx, [esp + 0x94]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
je 0x100053af
mov edi, 0x1001490c
call fcn.10001dd0
lea eax, [esp + 0xc0]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10005285
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xc4]
push eax
xor eax, eax
mov ecx, 0x1001490c
call fcn.100022b0
push 0xffffffffffffffff
push 0
push 0x10014928
xor esi, esi
mov ebx, 0x1001490c
call fcn.10002ca0
mov esi, dword [0x10014910]
mov edi, 8
cmp dword [0x10014924], edi
jae 0x100052d6
mov esi, 0x10014910
lea ecx, [esp + 0x34]
call fcn.100017e0
xor ebx, ebx
xor ecx, ecx
mov word [esp + 0x1c], cx
mov ecx, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x10005300
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x1c]
call fcn.10002bf0
mov edx, esi
push edx
push 0x1001497c
mov byte [esp + 0x300], 1
call fcn.10001e70
mov esi, eax
lea eax, [esp + 0xc0]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10005340
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xc4]
call fcn.10002bf0
mov byte [esp + 0x2f8], bl
cmp dword [esp + 0x30], edi
jb 0x10005376
mov eax, dword [esp + 0x1c]
push eax
call fcn.100067fc
add esp, 4
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x94]
push edx
xor ecx, ecx
push eax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebx
mov word [esp + 0x24], cx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10005271
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x2fc], 0xffffffff
call fcn.10001330
mov ecx, dword [esp + 0x2f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2d8]
xor ecx, esp
call fcn.100062d6
mov esp, ebp
pop ebp
ret
Function at 0x10005930
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x1000e2ab
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x10013040]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push esi
push edi
mov eax, dword [0x10013040]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov edi, 0x1001490c
call fcn.10001dd0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x36]
push ecx
mov word [esp + 0x38], ax
call fcn.10008da0
add esp, 0xc
push 0x104
lea edx, [esp + 0x30]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x2c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100059a7
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x30]
mov esi, 0x1001490c
call fcn.10002bf0
mov eax, dword [0x10014910]
mov edi, 8
cmp dword [0x10014924], edi
jae 0x100059dc
mov eax, 0x10014910
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ecx, eax
lea esi, [ecx + 2]
jmp 0x100059f0
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x100059f0
sub ecx, esi
sar ecx, 1
push eax
mov ebx, ecx
xor eax, eax
mov edx, 0x1001490c
call fcn.10005cf0
push 0x1001490c
mov edx, eax
lea esi, [esp + 0x14]
call fcn.10005a90
push 0xffffffffffffffff
push 0
mov ecx, 0x1001490c
mov dword [esp + 0x248], 0
call fcn.10002200
cmp dword [esp + 0x28], edi
jb 0x10005a4a
mov eax, dword [esp + 0x14]
push eax
call fcn.100067fc
add esp, 4
mov eax, dword [0x10014910]
cmp dword [0x10014924], edi
jae 0x10005a5c
mov eax, 0x10014910
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.100062d6
add esp, 0x234
ret

Function at 0x100062d6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10013040]
jne 0x100062e0
repz ret
jmp fcn.100075f6

Function at 0x1000a5ef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1000a204
push eax
push esi
push dword [ebp + 8]
call fcn.1000a1b9
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1000a204
push eax
push esi
push dword [ebp + 8]
call fcn.1000a1b9
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1000a1f4
retf
Function at 0x1000d05f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10008534
and dword [ebp - 4], 0
cmp dword [0x10014758], 0
mov ebx, eax
jne 0x1000d110
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000d1c1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000d1c1
push eax
call fcn.100084c2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10014758], eax
call esi
push eax
call fcn.100084c2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1001475c], eax
call esi
push eax
call fcn.100084c2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10014760], eax
call esi
push eax
call fcn.100084c2
pop ecx
mov dword [0x10014768], eax
test eax, eax
je 0x1000d110
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100084c2
pop ecx
mov dword [0x10014764], eax
mov eax, dword [0x10014764]
cmp eax, ebx
je 0x1000d168
cmp dword [0x10014768], ebx
je 0x1000d168
push eax
call fcn.1000853d
push dword [0x10014768]
mov esi, eax
call fcn.1000853d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000d168
test edi, edi
je 0x1000d168
call esi
test eax, eax
je 0x1000d15f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000d15f
test byte [ebp - 0xc], 1
jne 0x1000d168
or dword [ebp + 0x10], 0x200000
jmp 0x1000d1a1
mov eax, dword [0x1001475c]
cmp eax, ebx
je 0x1000d1a1
push eax
call fcn.1000853d
pop ecx
test eax, eax
je 0x1000d1a1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000d1a1
mov eax, dword [0x10014760]
cmp eax, ebx
je 0x1000d1a1
push eax
call fcn.1000853d
pop ecx
test eax, eax
je 0x1000d1a1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10014758]
call fcn.1000853d
pop ecx
test eax, eax
je 0x1000d1c1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000d1c3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1e7a7500
Capabilities:
Compare security identifiers

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x1e7ba2c0
je 0x1e7a751c
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
ret 8
mov eax, dword [eax + 8]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [esp + 8]
cmp ecx, 2
jne 0x1e7a7541
test eax, eax
je 0x1e7a754a
mov eax, dword [sym.imp.python27.dll__Py_TrueStruct]
inc dword [eax]
ret 8
cmp ecx, 3
jne 0x1e7a7554
test eax, eax
je 0x1e7a7537
mov eax, dword [sym.imp.python27.dll__Py_ZeroStruct]
inc dword [eax]
ret 8
mov eax, dword [sym.imp.python27.dll__Py_NotImplementedStruct]
inc dword [eax]
ret 8

Function at 0x1e7a8e02
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1e7a8e3d
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1e7a8e24
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1e7a8e35
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1e7a8e3f
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1e7a8e1a
xor eax, eax
pop edi
pop esi
ret
Function at 0x1e7a9130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1e7a8dd2
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a8d87
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1e7a8dd2
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a8d87
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
fld dword [esi + eax*8 + 0x45]
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x1e7a925d
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1e7a8dd2
push eax
push esi
push dword [ebp + 8]
call fcn.1e7a8d87
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1e7a8dc2
movsb byte es:[edi], byte [esi]
jge 0x1e7a91f5
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
invalid
inc ebp
nop
Function at 0x1e7a93a0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x1e7a9367
cmp dword [eax + 0xc], ebx
je 0x1e7a940a
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.1e7a8dc2
cmp dword [edi + 0x2b], ecx
adc eax, 0x750c5d39
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
lea edi, [ecx + esi]
jne 0x1e7a93aa
mov dword [ebp + 0x10], edi
jmp 0x1e7a93af
add eax, esi
mov dword [ebp + 0x10], eax
call fcn.1e7a8dc2
stosd dword es:[edi], eax
lds eax, [edi]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x1e7a93f8
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x1e7a93d3
and eax, 0xffff
push eax
jmp 0x1e7a93d7
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1e7a8d87
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x1e7a95b1
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x1e7a93b8
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x1e7a9359
call fcn.1e7a8dc2
aam 0xad
inc esi
mov esi, 0xa0878b
add byte [eax], al
cmp eax, ebx
je 0x1e7a9476
add eax, esi
cmp dword [eax], ebx
je 0x1e7a9476
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1e7a9471
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1e7a945b
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1e7a9463
cmp edx, ebx
jne 0x1e7a95b1
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1e7a9432
add eax, dword [eax + 4]
jmp 0x1e7a941f
mov dword [ebp + 0xc], ebx
jmp 0x1e7a9481
Function at 0x1e7a9480
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a9499
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a94b7
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edi, es
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a9515
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a94fc
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a9505
invalid
add al, 0x80
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a950f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a94f1
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1e7a947b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1e7a9562
dec eax
je 0x1e7a9559
sub eax, 3
je 0x1e7a9550
mov dword [ebp - 4], 0x40
jmp 0x1e7a957f
mov dword [ebp - 4], 4
jmp 0x1e7a9565
mov dword [ebp - 4], 0x20
jmp 0x1e7a9565
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1e7a95b1
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1e7a9531
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1e7a8dc2
aad 0xf4
add ecx, dword [edi + edi*8]
jne 0x1e7a95bc
push 1
push esi
call edi
mov eax, esi
jmp 0x1e7a95bd
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1e7a94a0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1e7a9499
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1e7a94b7
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edi, es
add al, 1
add byte [eax], al
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1e7a9515
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1e7a94fc
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1e7a9505
invalid
add al, 0x80
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1e7a950f
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1e7a94f1
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1e7a947b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1e7a9562
dec eax
je 0x1e7a9559
sub eax, 3
je 0x1e7a9550
mov dword [ebp - 4], 0x40
jmp 0x1e7a957f
mov dword [ebp - 4], 4
jmp 0x1e7a9565
mov dword [ebp - 4], 0x20
jmp 0x1e7a9565
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1e7a95b1
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1e7a9531
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1e7a8dc2
aad 0xf4
add ecx, dword [edi + edi*8]
jne 0x1e7a95bc
push 1
push esi
call edi
mov eax, esi
jmp 0x1e7a95bd
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret