joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032440
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [0x10449d50]
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + 0x3e48]
mov dword [ebp - 4], eax
test cl, 0x10
jne 0x100325ad
mov ebx, dword [edi + 0x46bc]
test ebx, ebx
je 0x100324b3
cmp dword [edi + 0x3e94], ebx
jne 0x100325a4
mov esi, dword [edi + 0x3eb8]
xor ecx, ecx
cmp esi, 0xffffffff
cmove esi, ecx
cmp byte [esi + edi + 0xdc0], cl
je 0x100325a4
cmp byte [eax + 0xb7], cl
jne 0x100325a4
xor cl, cl
jmp 0x10032552
cmp byte [edi + 0xdc0], 0
je 0x100325a4
cmp byte [eax + 0xb7], 0
jne 0x100325a4
test byte [edi + 0x46c4], 1
jne 0x100324ee
cmp dword [edi + 0x3e94], esi
je 0x100325a4
cmp dword [edi + 0x3eb0], eax
jne 0x100325a4
test cl, 8
je 0x100325a4
lea esi, [edi + 0x46c8]
mov ecx, eax
push esi
call fcn.10036b10
mov ebx, eax
push ebx
mov dword [edi + 0x46bc], ebx
call fcn.10039a60
push ebx
push esi
call fcn.10039710
mov cl, al
add esp, 0xc
mov byte [ebp + 0xb], cl
test cl, cl
je 0x10032545
cmp byte [edi + 0x36f8], 0
je 0x10032545
mov esi, dword [ebp - 4]
push esi
push ebx
call fcn.10042380
push esi
call fcn.10036390
mov cl, byte [ebp + 0xb]
add esp, 0xc
cmp dword [edi + 0x3e94], ebx
jne 0x100325a4
mov eax, dword [ebp - 4]
xor esi, esi
mov byte [edi + 0x3ea1], cl
mov ecx, dword [eax + 0xec]
mov eax, dword [eax + 0xf4]
mov eax, dword [eax + ecx*4 - 4]
mov dword [ebp - 8], eax
mov eax, dword [0x10449d50]
cmp byte [eax + esi + 0xdc0], 0
jne 0x10032580
mov byte [ebp + 0xb], 0
jmp 0x10032599
movss xmm1, dword [eax + 0x30]
movss xmm0, dword [eax + esi*4 + 0x3750]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae byte [ebp + 0xb]
call fcn.100424c0
cmp byte [ebp + 0xb], 0
jne 0x100325ec
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
or ebx, 0xffffffff
mov edx, 0x101924f1
mov al, 0x23
or esi, 0xffffffff
nop word [eax + eax]
cmp al, 0x23
jne 0x100325ce
cmp byte [edx], al
jne 0x100325ce
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10191290]
test al, al
jne 0x100325c0
mov esi, dword [ebp - 0x10]
not ebx
cmp byte [edi + 0x4950], 0
jne 0x1003262e
call fcn.10033a20
mov eax, dword [ebp - 8]
mov dword [edi + 0x496c], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x4968], ebx
mov byte [edi + 0x4950], 1
mov dword [edi + 0x4954], eax
mov dword [edi + 0x495c], esi
cmp ebx, dword [edi + 0x3e94]
jne 0x1003262e
mov byte [edi + 0x3ea2], 1
mov ebx, dword [ebp - 0xc]
mov eax, dword [edi + 0x3de8]
mov dword [edi + 0x4958], eax
mov byte [edi + 0x4951], 1
test bl, 1
jne 0x10032685
push 0
push 0
call fcn.100329b0
add esp, 8
cmp dword [edi + 0x49b8], 0
je 0x10032685
test dword [edi + 0x49ac], 0x1000
je 0x10032685
mov eax, dword [edi + 0x3e48]
mov byte [eax + 0xb7], 1
mov byte [eax + 0xb9], 1
mov byte [eax + 0xd4], 1
test bl, 0x12
jne 0x10032691
and dword [edi + 0x46c4], 0xfffffffe
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036a30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10449004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xec]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xf4]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10191290]
sub esi, 1
jne 0x10036a63
mov eax, dword [0x10449d50]
not ebx
cmp dword [eax + 0x3e7c], ebx
jne 0x10036a99
push esi
push edi
push 4
push ebx
call fcn.10034690
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ab082
mov esp, ebp
pop ebp
ret 4

Function at 0x10036b10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10449004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x14]
mov edi, 0x10
movss xmm1, dword [edx + 0x108]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x10c]
subss xmm0, xmm1
mov ecx, dword [edx + 0xec]
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xf4]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 8], xmm0
not edx
nop dword [eax + eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10191290]
sub edi, 1
jne 0x10036b90
mov ecx, dword [ebp - 4]
not edx
pop edi
xor ecx, ebp
mov eax, edx
pop esi
call fcn.100ab082
mov esp, ebp
pop ebp
ret 4
Function at 0x10037750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x10037762
mov dword [edi], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10037890
mov esi, eax
add esp, 8
test esi, esi
jne 0x1003777a
pop edi
pop esi
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp + 0x10], eax
cmp eax, 0xffffffff
je 0x10037871
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10037871
push esi
call ebx
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10037871
push 0
push dword [ebp + 0x10]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10037871
mov eax, dword [0x10449d50]
test eax, eax
je 0x100377e0
inc dword [eax + 0xb0]
push dword [0x10449d58]
mov eax, dword [ebp + 0x14]
add eax, ebx
push eax
call dword [0x1034b070]
add esp, 8
mov dword [ebp + 0x10], eax
test eax, eax
je 0x10037871
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, ebx
je 0x10037841
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x10449d50]
add esp, 4
test eax, eax
je 0x10037827
dec dword [eax + 0xb0]
push dword [0x10449d58]
mov eax, dword [ebp + 0x10]
push eax
call dword [0x1034b074]
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x10037859
push eax
mov eax, dword [ebp + 0x10]
add eax, ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x10037869
mov dword [edi], ebx
mov eax, dword [ebp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x10037b70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x10037bd3
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10037bb6
cmp edi, 2
jb 0x10037bb6
cmp byte [esi], cl
jne 0x10037bb6
cmp byte [esi + 1], cl
jne 0x10037bb6
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10191290]
jmp 0x10037b87
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10191290]
test edi, edi
jne 0x10037b87
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10037c08
nop word [eax + eax]
cmp cl, 0x23
jne 0x10037bef
cmp byte [esi], cl
jne 0x10037bef
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10191290]
test cl, cl
jne 0x10037be0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10037e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14
xor edx, edx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x10037e60
cmp eax, esi
jae 0x10037fd5
mov cl, byte [eax]
mov byte [ebp - 3], cl
test cl, cl
je 0x10037fd5
movzx ecx, cl
xor ebx, ebx
shr ecx, 3
mov edx, esi
movsx ecx, byte [ecx + 0x10191b00]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x10037e92
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp - 3]
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x10037ea7
mov bh, byte [esi]
jmp 0x10037ea9
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 3], bh
cmp esi, edx
jae 0x10037eb7
mov ch, byte [esi]
jmp 0x10037eb9
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x10037ec7
mov bl, byte [esi]
jmp 0x10037ec9
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [ebp - 1], bl
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx*4 + 0x10191b20]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x10191b48]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0xc]
cmp esi, dword [ebx*4 + 0x10191b34]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x10191b5c]
mov ebx, dword [ebp - 0x14]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x10037fbc
xor edx, edx
cmp byte [ebp - 4], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
mov edx, dword [ebp - 0x10]
inc edx
jmp 0x10037e4e
add eax, ebx
test esi, esi
je 0x10037fcb
mov edx, dword [ebp - 0x10]
inc edx
jmp 0x10037e4e
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
dec eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x10], ecx
lea eax, [ebx + eax*2]
mov dword [ebp - 0x18], eax
cmp ebx, eax
mov eax, dword [ebp + 0x10]
jae 0x100381fe
push esi
mov esi, dword [ebp + 0x14]
push edi
nop dword [eax]
test esi, esi
je 0x1003807c
cmp eax, esi
jae 0x100381f9
mov bl, byte [eax]
mov byte [ebp + 0xf], bl
test bl, bl
je 0x100381f9
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x10191b00]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x100380ae
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp + 0xf]
mov byte [ebp - 3], cl
cmp esi, edx
jae 0x100380c3
mov bh, byte [esi]
jmp 0x100380c5
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 2], bh
cmp esi, edx
jae 0x100380d3
mov ch, byte [esi]
jmp 0x100380d5
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 1], ch
cmp esi, edx
jae 0x100380e3
mov bl, byte [esi]
jmp 0x100380e5
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [ebp + 0xf], bl
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx*4 + 0x10191b20]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x10191b48]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0xc]
cmp esi, dword [ebx*4 + 0x10191b34]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x10191b5c]
mov ebx, dword [ebp - 0x14]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x100381d6
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp + 0xf], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
jmp 0x100381dc
add eax, ebx
test esi, esi
je 0x100381f6
mov ecx, dword [ebp - 0x10]
mov word [ecx], si
add ecx, 2
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x10038070
jmp 0x100381f9
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
pop edi
pop esi
xor edx, edx
mov word [ecx], dx
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x1003820c
mov dword [edx], eax
sub ecx, ebx
sar ecx, 1
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039ed0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x5a78], 0
lea esi, [edi + 0x5a7c]
je 0x10039f4b
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x10039f06
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.10047550
push dword [ebp + 0x10]
mov ecx, esi
mov dword [esi], 0
push dword [ebp + 0xc]
call fcn.100470f0
mov edx, dword [esi]
mov ecx, 0x10449d54
push dword [edi + 0x5a78]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5a84]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebp
ret
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
call fcn.100470f0
pop edi
pop esi
pop ebp
ret
Function at 0x10041dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10449d50]
push esi
mov esi, dword [ebp + 8]
mov dword [eax + 0x5a10], 0
test esi, esi
je 0x10041e29
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push edi
push eax
call fcn.10041e30
push 0x10192514
push esi
mov edi, eax
call fcn.10037890
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10041e28
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebp
ret

Function at 0x10045e10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [0x10449d50]
cmp byte [edi + 0x5a0d], 0
lea eax, [edi + 0x20]
jne 0x10045f5c
mov ecx, dword [eax]
push ebx
test ecx, ecx
je 0x10045f54
push esi
push 0x10192510
push ecx
call fcn.10037890
mov esi, eax
add esp, 8
test esi, esi
je 0x10045f50
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10045f46
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10045f46
push esi
call ebx
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10045f46
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10045f46
mov eax, dword [0x10449d50]
test eax, eax
je 0x10045eb4
inc dword [eax + 0xb0]
push dword [0x10449d58]
push ebx
call dword [0x1034b070]
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x10045f46
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x10045f0b
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x10449d50]
add esp, 4
test eax, eax
je 0x10045ef6
dec dword [eax + 0xb0]
push dword [0x10449d58]
mov esi, dword [ebp - 4]
push esi
call dword [0x1034b074]
add esp, 8
jmp 0x10045f50
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov esi, dword [ebp - 4]
add esp, 4
test ebx, ebx
je 0x10045f25
push ebx
push esi
call fcn.10039a90
add esp, 8
mov eax, dword [0x10449d50]
test eax, eax
je 0x10045f34
dec dword [eax + 0xb0]
push dword [0x10449d58]
push esi
call dword [0x1034b074]
add esp, 8
jmp 0x10045f50
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea eax, [edi + 0x20]
pop esi
mov byte [edi + 0x5a0d], 1
pop ebx
movss xmm0, dword [edi + 0x5a10]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x10045fad
subss xmm0, dword [edi + 0x18]
comiss xmm1, xmm0
movss dword [edi + 0x5a10], xmm0
jb 0x10045fad
mov eax, dword [eax]
test eax, eax
je 0x10045f9c
push eax
call fcn.10041dd0
add esp, 4
mov dword [edi + 0x5a10], 0
pop edi
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x98], 1
mov dword [edi + 0x5a10], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10047d20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f1223
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10449004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 2
mov eax, 0xffff
mov word [ecx + 0x3e], ax
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x3a], 0xffffffff
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov word [ecx + 0x38], ax
mov byte [ecx + 0x40], al
mov dword [ecx + 0x44], 0x3f800000
mov dword [ecx + 0x4c], eax
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x50], eax
mov word [ecx + 0x54], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004bce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f13d3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10449004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x54], ebx
jle 0x1004bd3e
xor edi, edi
mov eax, dword [esi + 0x5c]
mov ecx, dword [edi + eax]
test ecx, ecx
je 0x1004bd35
cmp byte [edi + eax + 8], 0
je 0x1004bd35
push ecx
call fcn.1003a000
mov eax, dword [esi + 0x5c]
add esp, 4
mov dword [edi + eax], 0
inc ebx
add edi, 0x78
cmp ebx, dword [esi + 0x54]
jl 0x1004bd11
xor edx, edx
cmp dword [esi + 0x3c], edx
jle 0x1004bd7e
mov eax, dword [esi + 0x44]
mov edi, dword [eax + edx*4]
mov eax, dword [esi + 0x5c]
mov ebx, dword [edi + 0x34]
cmp ebx, eax
jb 0x1004bd78
mov ecx, dword [esi + 0x54]
shl ecx, 4
sub ecx, dword [esi + 0x54]
lea eax, [eax + ecx*8]
cmp ebx, eax
jae 0x1004bd78
mov dword [edi + 0x34], 0
xor ecx, ecx
mov eax, dword [esi + 0x44]
mov eax, dword [eax + edx*4]
mov word [eax + 0x38], cx
inc edx
cmp edx, dword [esi + 0x3c]
jl 0x1004bd45
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1004bda3
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.1003a000
add esp, 4
mov dword [esi + 0x5c], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x1004bdc8
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.1003a000
add esp, 4
mov dword [esi + 0x50], 0
mov dword [esi + 0x474], 0xffffffff
mov dword [esi + 0x470], 0xffffffff
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x46c], 0xffffffff
mov dword [esi + 0x468], 0xffffffff
test eax, eax
je 0x1004be00
push eax
call fcn.1003a000
add esp, 4
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1004be10
push eax
call fcn.1003a000
add esp, 4
xor ebx, ebx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [esi + 0x19], 0
cmp dword [esi + 0x3c], ebx
jle 0x1004be99
nop dword [eax]
mov eax, dword [esi + 0x44]
mov edi, dword [eax + ebx*4]
mov dword [ebp - 0x10], edi
test edi, edi
je 0x1004be93
mov dword [ebp - 4], 2
mov ecx, edi
call fcn.1004bfc0
mov byte [ebp - 4], 1
mov eax, dword [edi + 0x28]
test eax, eax
je 0x1004be5f
push eax
call fcn.1003a000
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x1004be73
push eax
call fcn.1003a000
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edi + 8]
test eax, eax
je 0x1004be8a
push eax
call fcn.1003a000
add esp, 4
push edi
call fcn.1003a000
add esp, 4
inc ebx
cmp ebx, dword [esi + 0x3c]
jl 0x1004be30
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1004bebe
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.1003a000
add esp, 4
mov dword [esi + 0x44], 0
mov byte [esi + 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10051770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x10051797
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.1003a000
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x100517bc
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.1003a000
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x100517e1
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.1003a000
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x10051822
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.1003a000
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x10051847
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.1003a000
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1005186c
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.1003a000
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.1004bee0