joyce8/EMBER2024-capa huggingface dataset:
Function at 0x653100
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 8
test ecx, ecx
jne 0x653111
xor eax, eax
add esp, 8
ret
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
xor esi, esi
xor edi, edi
test ebx, ebx
jbe 0x653210
mov eax, 3
sub eax, ebp
cmp esi, ebx
mov dword [esp + 0x14], eax
jae 0x653141
mov al, byte [ecx + esi]
mov byte [esp + 0x12], al
jmp 0x653146
mov byte [esp + 0x12], 0
lea eax, [esi + 1]
cmp eax, ebx
jae 0x653157
mov dl, byte [esi + ecx + 1]
mov byte [esp + 0x13], dl
jmp 0x65315c
mov byte [esp + 0x13], 0
inc eax
cmp eax, ebx
jae 0x65316b
mov al, byte [esi + ecx + 2]
mov byte [esp + 0x11], al
jmp 0x653170
mov byte [esp + 0x11], 0
add esi, 3
test ebp, ebp
je 0x653205
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
lea edx, [edi + ebp]
add ecx, edx
cmp eax, ecx
jb 0x653201
movzx ecx, byte [esp + 0x12]
mov eax, ecx
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
movzx edx, byte [esp + 0x13]
and ecx, 3
shl ecx, 4
mov eax, edx
shr eax, 4
or eax, ecx
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
lea eax, [ebx + 2]
cmp esi, eax
mov byte [edi + ebp + 1], cl
mov cl, byte [esp + 0x11]
jne 0x6531cc
mov eax, 0x3d
jmp 0x6531e1
movzx eax, cl
and edx, 0xf
shr eax, 6
shl edx, 2
or eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
lea edx, [ebx + 1]
cmp esi, edx
mov byte [edi + ebp + 2], al
jb 0x6531f3
mov eax, 0x3d
jmp 0x6531fd
and ecx, 0x3f
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + ebp + 3], al
mov ecx, dword [esp + 0x1c]
add edi, 4
cmp esi, ebx
jb 0x653138
cmp byte [esp + 0x2c], 1
jne 0x653226
test ebp, ebp
je 0x653225
cmp dword [esp + 0x28], edi
jbe 0x653225
mov byte [edi + ebp], 0
inc edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x658300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x74
push ebx
push esi
xor eax, eax
mov esi, ecx
cmp word [esi + 0x1e], ax
push edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
jbe 0x658464
mov ebx, dword [ebp + 8]
mov dword [esp + 0x20], eax
lea ecx, [ecx]
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x20]
fld dword [eax + ecx]
mov edx, dword [eax + ecx + 8]
fld dword [eax + ecx + 4]
add eax, ecx
fxch st(1)
mov ecx, edx
fstp dword [eax]
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x18]
fstp dword [eax + 4]
mov dword [eax + 8], ecx
fild dword [esp + 0x1c]
mov dword [eax + 0xc], edx
cmp dword [esi + 4], 2
fst dword [esp + 0x24]
mov byte [esi + 0x18], 1
fld dword [esi + 0xc]
jne 0x65837f
movzx eax, word [esi + 0x1e]
fstp st(0)
dec eax
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
fxch st(1)
fcomp st(1)
fnstsw ax
fstp st(0)
test ah, 5
jp 0x658444
mov ecx, dword [esp + 0x24]
push 0
push ecx
lea edx, [esp + 0x58]
push edx
mov ecx, esi
call fcn.006497b0
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov edi, 1
cmp ebx, edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x28], edi
jl 0x658444
fild dword [ebp + 8]
fstp dword [esp + 0x2c]
fild dword [esp + 0x28]
push 0
push ecx
lea eax, [esp + 0x68]
fdiv dword [esp + 0x34]
mov ecx, esi
fadd dword [esp + 0x2c]
fstp dword [esp]
push eax
call fcn.006497b0
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0x34], edx
push ecx
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x40], eax
call fcn.0045f340
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
add esp, 8
fadd dword [esp + 0x18]
inc edi
cmp edi, ebx
fstp dword [esp + 0x18]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x28], edi
jle 0x6583d3
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
movzx ecx, word [esi + 0x1e]
inc eax
add edi, 0x10
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
jl 0x658330
mov edx, dword [esp + 0x18]
mov ecx, esi
mov dword [esi + 0x14], edx
call fcn.00649380
pop edi
mov byte [esi + 0x18], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x65b6e0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x58], 1
push edi
mov edi, dword [esp + 0xc]
jne 0x65b715
mov dword [esi + 4], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov byte [esi + 0x58], 0
mov eax, dword [esp + 0x10]
test eax, eax
jge 0x65b726
push edi
call fcn.00460c50
add esp, 4
mov ecx, dword [esi + 4]
and ecx, 0x3f
test eax, eax
jle 0x65b754
push ebp
mov ebp, eax
mov al, byte [edi]
mov byte [esi + ecx + 0x18], al
mov edx, dword [esi + 4]
inc ecx
inc edi
inc edx
cmp ecx, 0x40
mov dword [esi + 4], edx
jne 0x65b750
mov ecx, esi
call fcn.00650410
xor ecx, ecx
dec ebp
jne 0x65b733
pop ebp
pop edi
pop esi
ret 8
Function at 0x65c5a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87a0d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
fld dword [esp + 0x14]
push esi
fmul dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 8], esi
fadd dword [0x8933d4]
call fcn.007c4b80
push eax
mov ecx, esi
call fcn.0065c540
movzx eax, byte [esi + 5]
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esi + 0x2c], ecx
mov ecx, dword [esp + 0x1c]
shl eax, 2
push str.AverageWindow::TimeData
mov dword [esi + 0x28], ecx
push eax
mov ecx, 0x925b30
mov dword [esi], 0x8a8adc
mov dword [esi + 0x34], eax
call fcn.005d29d0
movzx ecx, byte [esi + 5]
shl ecx, 2
mov edx, ecx
mov edi, eax
shr ecx, 2
mov dword [esi + 0x30], edi
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x672858
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87a91f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x34]
lea ecx, [esi + 0x34]
push edi
call dword [eax + 0x40]
movsx ecx, word [eax + 0x10]
mov dword [esp + 8], ecx
mov ecx, dword [esi + 0xd0]
test ecx, ecx
fild dword [esp + 8]
fmul dword [0x890d60]
fstp dword [esp + 0xc]
movsx edx, word [eax + 0x12]
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul dword [0x890d60]
fstp dword [esp + 0x10]
movsx eax, word [eax + 0x14]
mov dword [esp + 8], eax
fild dword [esp + 8]
fmul dword [0x890d60]
fstp dword [esp + 0x14]
jne 0x6728fc
push ecx
push 8
mov ecx, 0x925b30
call fcn.005d29d0
mov dword [esp + 8], eax
test eax, eax
mov edi, dword [esp + 0x28]
mov dword [esp + 0x20], 0
je 0x6728f2
mov edx, dword [esi + 0x3c]
push 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x34]
push edi
push ecx
push edx
mov ecx, eax
call fcn.00667e70
mov dword [esi + 0xd0], eax
jmp 0x67291f
xor eax, eax
mov dword [esi + 0xd0], eax
jmp 0x67291f
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
push edx
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00668070
mov ecx, dword [esi + 0xd0]
mov eax, dword [ecx]
or dword [eax + 0x10], 0x100
fld dword [esp + 0x14]
lea edx, [edi + 0x30]
mov ecx, dword [edx]
lea eax, [esi + 0xb8]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
fmul dword [edi + 0x20]
fld dword [esp + 0x10]
push ecx
fmul dword [edi + 0x10]
faddp st(1)
fld dword [esp + 0x10]
fmul dword [edi]
faddp st(1)
fld dword [esp + 0x18]
fmul dword [edi + 0x28]
fld dword [esp + 0x14]
fmul dword [edi + 0x18]
faddp st(1)
fld dword [esp + 0x10]
fmul dword [edi + 8]
faddp st(1)
fld st(0)
fmul st(1)
fld st(2)
fmul st(3)
faddp st(1)
fstp dword [esp]
fstp st(0)
fstp st(0)
call fcn.005c5e80
mov ecx, dword [esp + 0x1c]
fstp dword [esi + 0xc4]
add esp, 4
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x677ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x87ab30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
mov esi, dword [esp + 0x80]
push 0
push 0
mov ebx, ecx
push esi
mov dword [esp + 0x14], ebx
call fcn.00456cb0
fld dword [esp + 0x88]
fcomp dword [0x89096c]
mov dword [esp + 0x78], 0
fnstsw ax
test ah, 1
jne 0x677d51
mov eax, dword [esp + 0x84]
push eax
mov ecx, ebx
call fcn.0045a840
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
add esp, 0x74
ret 0xc
fld dword [esp + 0x88]
fcomp dword [0x890968]
fnstsw ax
test ah, 0x41
jne 0x677f68
push esi
mov ecx, ebx
call fcn.0045a840
push 0
push 0
push str.part_upgrade
mov ecx, ebx
call fcn.00456d40
push eax
mov ecx, ebx
call fcn.0045be60
mov ecx, dword [esp + 0x84]
push 0
push 0
push ecx
lea ecx, [esp + 0x54]
call fcn.00456cb0
push 0
push 0
push esi
lea ecx, [esp + 0x68]
mov byte [esp + 0x84], 1
call fcn.00456cb0
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x7c], 2
call fcn.004547f0
mov esi, dword [esp + 0xc]
test esi, esi
je 0x677f4c
push ebp
push edi
jmp 0x677de0
mov esi, dword [esp + 0x14]
jmp 0x677de0
push esi
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x58]
call fcn.004546c0
push esi
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x6c]
mov byte [esp + 0x88], 3
call fcn.004546c0
lea ecx, [esp + 0x20]
mov byte [esp + 0x80], 4
call fcn.00452d40
lea ecx, [esp + 0x30]
mov edi, eax
call fcn.00452d40
cmp eax, edi
jbe 0x677e28
mov edi, eax
lea ecx, [esp + 0x20]
call fcn.00458660
lea ecx, [esp + 0x30]
mov ebp, eax
call fcn.00458660
cmp eax, ebp
jne 0x677f17
test edi, edi
jbe 0x677f17
push edi
push esi
mov ecx, ebx
call fcn.00459040
push esi
lea edx, [esp + 0x44]
push edx
mov ecx, ebx
call fcn.004546c0
lea ecx, [esp + 0x20]
mov byte [esp + 0x80], 5
call fcn.00458660
xor esi, esi
test edi, edi
mov ebp, eax
jbe 0x677f06
nop
cmp ebp, 0x3c16ec5e
je 0x677edd
cmp ebp, 0x4cb36381
je 0x677ebe
cmp ebp, 0x5763da41
je 0x677e9f
call fcn.0045cd20
jmp 0x677efd
mov ecx, dword [esp + 0x90]
lea eax, [esp + 0x40]
push eax
push ecx
push esi
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.00676320
jmp 0x677efa
mov edx, dword [esp + 0x90]
lea ecx, [esp + 0x40]
push ecx
push edx
push esi
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.00672bc0
jmp 0x677efa
mov eax, dword [esp + 0x90]
lea edx, [esp + 0x40]
push edx
push eax
push esi
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00676280
add esp, 0x14
inc esi
cmp esi, edi
jb 0x677e80
lea ecx, [esp + 0x40]
mov byte [esp + 0x80], 4
call fcn.00452bd0
lea ecx, [esp + 0x20]
mov byte [esp + 0x80], 3
call fcn.00452bd0
lea ecx, [esp + 0x30]
mov byte [esp + 0x80], 2
call fcn.00452bd0
lea ecx, [esp + 0x14]
call fcn.004543c0
test al, al
jne 0x677dd7
pop edi
pop ebp
lea ecx, [esp + 0x5c]
mov byte [esp + 0x78], 1
call fcn.0045a430
lea ecx, [esp + 0x48]
mov byte [esp + 0x78], 0
call fcn.0045a430
mov ecx, dword [esp + 0x70]
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x74
ret 0xc
Function at 0x677fe0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x87ab50
push eax
mov eax, dword [0x8f87a8]
mov dword fs:[0], esp
sub esp, 0x24
test eax, eax
push esi
mov esi, 0x8f87a0
je 0x67801e
mov eax, dword [esp + 0x3c]
jmp 0x678010
cmp dword [esi], eax
je 0x678030
mov ecx, dword [esi + 0x24]
add esi, 0x1c
test ecx, ecx
jne 0x678010
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x67801e
sub eax, 5
push edi
mov edi, dword [esp + 0x3c]
je 0x678062
dec eax
jne 0x67806f
push edi
call fcn.0066bb80
add esp, 4
test al, al
jne 0x67806f
pop edi
pop esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
push edi
call fcn.00672f50
add esp, 4
test eax, eax
je 0x6780e4
push 0
push 0x171737e9
mov ecx, edi
call fcn.00454810
test eax, eax
jne 0x67808b
push 0xc
call fcn.006269b0
add esp, 4
push 0
push 0
push eax
lea ecx, [esp + 0x24]
call fcn.00456cb0
lea ecx, [esp + 8]
mov dword [esp + 0x34], 0
call fcn.00452b30
mov ecx, dword [esi + 0x14]
lea eax, [esp + 8]
push eax
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 1
call fcn.00454760
test al, al
lea ecx, [esp + 8]
jne 0x6780f7
mov byte [esp + 0x34], 0
call fcn.00452bd0
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0xffffffff
call fcn.0045a430
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret
call fcn.00458660
cmp eax, 0x51ead18d
lea ecx, [esp + 8]
jne 0x6780c9
push ebx
call fcn.00452d40
test eax, eax
lea ecx, [esp + 0xc]
setne bl
mov byte [esp + 0x38], 0
call fcn.00452bd0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0045a430
mov ecx, dword [esp + 0x30]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x686c20
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x87b902
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
lea ebp, [esi + 0x2c]
mov dword [esp + 0x20], esi
mov dword [esi], 0x8aa5b0
mov dword [esi + 8], 0x8aa5a8
mov dword [ebp], 0x8aa518
mov dword [esi + 0x38], 0x8aa4f8
mov dword [esi + 0x40], 0x8aa4dc
mov dword [esp + 0x30], 8
call fcn.006809f0
mov eax, dword [esi + 0x7c]
push eax
mov ecx, esi
call fcn.006e9c90
mov eax, dword [ebp + 0x54]
xor ebx, ebx
cmp eax, ebx
je 0x686c96
mov edx, dword [ebp]
push eax
mov ecx, ebp
call dword [edx + 0x10]
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x54], ebx
mov ecx, dword [esi + 0xa8]
cmp ecx, ebx
je 0x686cac
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0xa8], ebx
mov eax, dword [esi + 0x88]
cmp eax, ebx
je 0x686cc4
push eax
mov ecx, esi
call fcn.006eea10
mov dword [esi + 0x88], ebx
mov eax, dword [esi + 0x58]
cmp eax, ebx
je 0x686cd9
push ebx
push 0x3c
push eax
mov ecx, 0x925b30
call fcn.005d0370
mov eax, dword [esi + 0x34]
push edi
push eax
call fcn.006f81a0
lea edi, [esi + 0x9c]
add esp, 4
mov ecx, edi
mov byte [esp + 0x34], 7
call fcn.0066dd70
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x686d0d
push ebx
push 0xc
push eax
mov ecx, 0x925b30
call fcn.005d0370
mov dword [edi + 4], ebx
mov eax, dword [esi + 0x94]
mov ecx, dword [eax]
lea edi, [esi + 0x90]
push eax
push ecx
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
mov byte [esp + 0x40], 6
call fcn.00683110
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x686d46
push ebx
push 0x18
push eax
mov ecx, 0x925b30
call fcn.005d0370
lea ecx, [esi + 0x64]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [esp + 0x34], 5
call fcn.0045a430
lea ecx, [esi + 0x4c]
mov byte [esp + 0x34], 4
call fcn.00682760
lea eax, [esi + 0x48]
cmp eax, ebx
pop edi
je 0x686d73
add eax, 0xffffffb8
jmp 0x686d75
xor eax, eax
push eax
mov ecx, 0x934d90
call fcn.0067da60
lea eax, [esi + 0x40]
mov dword [eax], 0x890970
mov ecx, dword [eax + 4]
push eax
mov byte [esp + 0x34], 2
call fcn.005d5a50
lea eax, [esi + 0x38]
mov dword [eax], 0x890970
mov ecx, dword [eax + 4]
push eax
mov byte [esp + 0x34], 1
call fcn.005d5a50
mov ecx, ebp
mov byte [esp + 0x30], bl
call fcn.0067e800
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
call fcn.006ee930
mov ecx, dword [esp + 0x28]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x686c3a
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x87b902
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
lea ebp, [esi + 0x2c]
mov dword [esp + 0x20], esi
mov dword [esi], 0x8aa5b0
mov dword [esi + 8], 0x8aa5a8
mov dword [ebp], 0x8aa518
mov dword [esi + 0x38], 0x8aa4f8
mov dword [esi + 0x40], 0x8aa4dc
mov dword [esp + 0x30], 8
call fcn.006809f0
mov eax, dword [esi + 0x7c]
push eax
mov ecx, esi
call fcn.006e9c90
mov eax, dword [ebp + 0x54]
xor ebx, ebx
cmp eax, ebx
je 0x686c96
mov edx, dword [ebp]
push eax
mov ecx, ebp
call dword [edx + 0x10]
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x54], ebx
mov ecx, dword [esi + 0xa8]
cmp ecx, ebx
je 0x686cac
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0xa8], ebx
mov eax, dword [esi + 0x88]
cmp eax, ebx
je 0x686cc4
push eax
mov ecx, esi
call fcn.006eea10
mov dword [esi + 0x88], ebx
mov eax, dword [esi + 0x58]
cmp eax, ebx
je 0x686cd9
push ebx
push 0x3c
push eax
mov ecx, 0x925b30
call fcn.005d0370
mov eax, dword [esi + 0x34]
push edi
push eax
call fcn.006f81a0
lea edi, [esi + 0x9c]
add esp, 4
mov ecx, edi
mov byte [esp + 0x34], 7
call fcn.0066dd70
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x686d0d
push ebx
push 0xc
push eax
mov ecx, 0x925b30
call fcn.005d0370
mov dword [edi + 4], ebx
mov eax, dword [esi + 0x94]
mov ecx, dword [eax]
lea edi, [esi + 0x90]
push eax
push ecx
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
mov byte [esp + 0x40], 6
call fcn.00683110
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x686d46
push ebx
push 0x18
push eax
mov ecx, 0x925b30
call fcn.005d0370
lea ecx, [esi + 0x64]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [esp + 0x34], 5
call fcn.0045a430
lea ecx, [esi + 0x4c]
mov byte [esp + 0x34], 4
call fcn.00682760
lea eax, [esi + 0x48]
cmp eax, ebx
pop edi
je 0x686d73
add eax, 0xffffffb8
jmp 0x686d75
xor eax, eax
push eax
mov ecx, 0x934d90
call fcn.0067da60
lea eax, [esi + 0x40]
mov dword [eax], 0x890970
mov ecx, dword [eax + 4]
push eax
mov byte [esp + 0x34], 2
call fcn.005d5a50
lea eax, [esi + 0x38]
mov dword [eax], 0x890970
mov ecx, dword [eax + 4]
push eax
mov byte [esp + 0x34], 1
call fcn.005d5a50
mov ecx, ebp
mov byte [esp + 0x30], bl
call fcn.0067e800
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
call fcn.006ee930
mov ecx, dword [esp + 0x28]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x68c2e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x87bdd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x14], 0
mov dword [esi], 0x8ab110
call fcn.00460bf0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0xc], edx
mov dl, byte [esp + 0x30]
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x10], eax
add esp, 4
mov byte [esi + 0x18], dl
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18

Function at 0x68c2f6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x87bdd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x14], 0
mov dword [esi], 0x8ab110
call fcn.00460bf0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0xc], edx
mov dl, byte [esp + 0x30]
mov dword [esi + 0x14], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x10], eax
add esp, 4
mov byte [esi + 0x18], dl
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18
Function at 0x699cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x78]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0xcc]
call fcn.004048c0
lea ecx, [esp + 0x1c]
call fcn.00487690
mov ebx, dword [edi + 0xec]
mov esi, dword [edi + 0x110]
lea ebp, [edi + 0x110]
add ebx, 0x3c
cmp esi, ebp
je 0x699d4f
mov eax, dword [esi + 0x44]
test al, 1
je 0x699d49
test al, 8
jne 0x699d49
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.0068b8b0
test al, al
je 0x699d49
mov ecx, dword [edi + 0x104]
push esi
lea edx, [edi + 0x64]
push edx
push ebx
lea eax, [esp + 0x28]
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], 3
call fcn.0077aa30
mov esi, dword [esi]
cmp esi, ebp
jne 0x699d03
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 4
Function at 0x69e2aa
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x87c522
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
push ebx
push ebp
push esi
mov esi, ecx
lea eax, [esi + 0x1b4]
push edi
xor edi, edi
lea ebp, [esi + 0x98]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ebx, dword [eax]
test ebx, ebx
je 0x69e2e7
lea ecx, [ebx + 0x9c]
call fcn.0045a430
push 0
push 0x140
push ebx
mov ecx, 0x925b30
call fcn.005d0370
cmp edi, 2
setb cl
mov byte [esp + 0x14], cl
mov edx, dword [esp + 0x14]
push edx
push ebp
call fcn.0066bee0
fstp dword [esp + 0x20]
add esp, 8
push 0
push 0x140
mov ecx, 0x925b30
call fcn.005d29d0
mov dword [esp + 0x1c], eax
test eax, eax
mov dword [esp + 0x64], 0
je 0x69e344
fld dword [esp + 0x18]
lea ecx, [esi + 0xac]
fmul dword [0x8933d4]
push ecx
push ebp
push edi
push ecx
mov ecx, eax
fstp dword [esp]
call fcn.0069d970
jmp 0x69e346
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
inc edi
add ecx, 4
cmp edi, 4
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x10], ecx
jl 0x69e2c0
mov ecx, dword [esi + 0x34]
mov edx, dword [ecx]
call dword [edx + 0x54]
mov edx, dword [eax]
lea ecx, [esp + 0x50]
push ecx
mov ecx, eax
call dword [edx + 0x4c]
mov ecx, dword [esi + 0xa0]
fld dword [ecx + 0x40]
mov eax, dword [esi + 0xc8]
fmul dword [0x890d60]
mov edx, dword [eax + 0x54]
mov dword [esp + 0x18], edx
pop edi
fsubr dword [eax + 0x20]
fstp dword [esp + 0x10]
fld dword [ecx + 0x44]
fmul dword [0x890d60]
fsubr dword [eax + 0x24]
mov eax, dword [eax + 0x64]
fld dword [esp + 0x10]
mov ecx, eax
fmul dword [0x891068]
mov edx, eax
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x1b4]
fstp dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
fld dword [esp + 0x50]
mov ecx, dword [esp + 0x1c]
fchs
add eax, 0x6c
fst dword [esp + 0x20]
mov dword [eax], ecx
fld dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
fmul dword [0x8933d4]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 4], edx
fstp dword [esp + 0x28]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0x1b8]
mov eax, dword [esp + 0x28]
fst dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
fld st(1)
fmul dword [0x891068]
add edx, 0x6c
mov dword [edx], eax
mov eax, dword [esp + 0x30]
fstp dword [esp + 0x34]
mov dword [edx + 4], ecx
mov dword [edx + 8], eax
mov ecx, dword [esi + 0x1bc]
fst dword [esp + 0x38]
fld dword [esp + 0xc]
mov edx, dword [esp + 0x34]
fsub dword [esp + 0x14]
mov eax, dword [esp + 0x38]
add ecx, 0x6c
mov dword [ecx], edx
fst dword [esp + 0x3c]
mov edx, dword [esp + 0x3c]
mov dword [ecx + 4], eax
fxch st(2)
fmul dword [0x8933d4]
mov dword [ecx + 8], edx
mov eax, dword [esi + 0x1c0]
add eax, 0x6c
fstp dword [esp + 0x40]
mov ecx, dword [esp + 0x40]
mov dword [eax], ecx
fstp dword [esp + 0x44]
mov edx, dword [esp + 0x44]
mov dword [eax + 4], edx
fstp dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
mov dword [eax + 8], ecx
pop esi
mov ecx, dword [esp + 0x54]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret