joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f9907
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.100f9986
jae 0x100f9913
xor ecx, ecx
call fcn.100f9986
jae 0x100f993d
xor eax, eax
call fcn.100f9986
jae 0x100f994e
mov al, 0x10
call fcn.100f9986
adc al, al
jae 0x100f992f
jne 0x100f997b
stosb byte es:[edi], al
jmp 0x100f9914
call fcn.100f9992
dec ecx
loop 0x100f995a
mov eax, ebp
call fcn.100f9990
jmp 0x100f997c
lodsb al, byte [esi]
shr eax, 1
je 0x100f99a2
adc ecx, 2
mov ebp, eax
jmp 0x100f997c
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.100f9990
cmp eax, 0x7d00
jae 0x100f997a
cmp eax, 0x500
jae 0x100f997b
cmp eax, 0x7f
ja 0x100f997c
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x100f9914
pop ebp
ret 8

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2f5579df
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x32ff74c2
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x408769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40c190
cmp edx, dword [eax]
je 0x40878b
add eax, 8
inc ecx
cmp eax, 0x40c220
jl 0x40877c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40c190]
jne 0x4088b9
mov eax, dword [0x40cbb0]
cmp eax, 1
je 0x408893
test eax, eax
jne 0x4087bc
cmp dword [0x40c0e4], 1
je 0x408893
cmp edx, 0xfc
je 0x4088b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4087f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00409670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00409490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00409490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b45c
push edi
call fcn.00409f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00409670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00409680
lea eax, [ebp - 0xa0]
push 0x40b43c
push eax
call fcn.00409680
push dword [esi + 0x40c194]
lea eax, [ebp - 0xa0]
push eax
call fcn.00409680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00409e75
add esp, 0x2c
pop edi
jmp 0x4088b9
lea eax, [ebp + 8]
lea esi, [esi + 0x40c194]
push 0
push eax
push dword [esi]
call fcn.00409490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x78b51d4d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
mov ecx, 0x308b2065
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x40915c
nop
mov ecx, 0x304d39dc
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x7b4f69d8
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x7cf04ec3
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x46bd594c
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x7300f9e0
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x7308c0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 1
mov esi, ebx
mov dword [ebp - 0x10], ebx
push 0x2000c
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
call dword [0x7308d148]
push eax
call dword [0x7308d13c]
test eax, eax
je 0x7300fa9b
lea ecx, [ebp - 0xc]
call fcn.73027560
mov esi, dword [ebp - 0xc]
mov edi, eax
test edi, edi
js 0x7303c4a0
mov eax, dword [ebp - 8]
lea ecx, [esi + 0x28]
mov dword [esi + 0x44], eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
mov dword [ebp - 8], ebx
push eax
call fcn.7301c4b7
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x10]
call fcn.7301c4b7
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
cmp dword [ebp - 8], ebx
jne 0x7303c4ac
test esi, esi
je 0x7300fa86
mov eax, dword [esi]
push esi
mov ebx, dword [eax + 4]
cmp ebx, 0x73021da0
jne 0x7303c4bd
call fcn.730119a0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7302e750
mov esp, ebp
pop ebp
ret 8
call dword [0x7308d028]
cmp eax, 0x3f0
je 0x7300fa21
jmp 0x7303c476
popal
insb byte es:[edi], dx
push edx
inc ebx
push 0x65

Function at 0x7300faf0
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x7308c0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x3c], eax
test byte [0x7308c948], 0x10
jne 0x7303c4cc
xor esi, esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], esi
test ebx, ebx
je 0x7303c4e9
test byte [0x7308c948], 0x10
jne 0x7303c4fa
mov dword [eax], esi
test ecx, ecx
jne 0x7300fdab
push 0x4c
xor esi, esi
push esi
push dword [0x7308c968]
mov dword [ebp - 0x30], esi
call dword [0x7308d094]
mov edi, eax
test edi, edi
je 0x7303c548
lea eax, [edi + 0x10]
mov dword [edi], 0x73001284
mov dword [edi + 4], 0x73001270
push eax
mov dword [edi + 8], 1
call dword [0x7308d210]
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], esi
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], esi
mov dword [edi + 0x44], esi
mov dword [edi + 0x48], esi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], esi
mov dword [edi + 0xc], esi
mov dword [edi + 0x40], esi
mov eax, dword [edi + 0x44]
mov eax, dword [ecx]
push ecx
mov esi, dword [eax]
mov ecx, esi
call dword [0x7308d3fc]
call esi
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x30], esi
jmp 0x7300fbff
inc ebp
popal
jb 0x7303c576
add byte [ebx], al
add byte [edx + 0x65], dl
inc ebx
push edx
inc ebp
Function at 0x7300fde0
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x7308c0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
mov ecx, dword [ebp + 8]
push esi
mov dword [ebp - 0x70], ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x40], ecx
test byte [0x7308c948], 0x10
jne 0x7303c696
xor eax, eax
mov dword [ebp - 0x44], 0
xor edi, edi
mov dword [ebp - 0x38], eax
xor esi, esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
cmp dword [ebx + 0x2c], eax
jne 0x7303c6ab
mov eax, dword [ebp - 0x18]
test al, 1
je 0x7300ffa6
xor eax, eax
mov dword [ebp - 0x50], esi
push 0x10
push eax
push dword [0x7308c968]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x50], edi
call dword [0x7308d094]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x7303c743
mov dword [eax], 0x730011d4
mov dword [eax + 4], 1
lea esp, [esp]
mov ecx, 1
lock xadd dword [0x7308cc94], ecx
inc ecx
je 0x7300fe90
mov dword [eax + 0xc], ecx
mov dword [eax + 8], esi
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], eax
mov eax, 0x7308cb44
push eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x6c], eax
call dword [0x7308d1f8]
mov ecx, dword [0x7308cca0]
mov eax, 1
mov edx, dword [0x7308cca4]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x68], eax
mov eax, ecx
or eax, edx
je 0x73010241
add ecx, 1
mov dword [0x7308cca0], ecx
mov ecx, 0x7308cb44
adc edx, esi
mov dword [0x7308cca4], edx
push ecx
call dword [0x7308d1fc]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x68], esi
call fcn.7301abf2
mov dword [ebp - 8], eax
insb byte es:[edi], dx
insd dword es:[edi], dx
inc ecx
jae 0x7303c78e
insd dword es:[edi], dx
Function at 0x730103a0
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x7308c0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], 0
test edi, edi
je 0x7303c97b
push esi
mov esi, dword [ebp + 0xc]
push 0x10
push 0x73003990
push esi
mov dword [edi], 0
call fcn.730302f2
add esp, 0xc
test eax, eax
je 0x73010460
push 0x10
push 0x73002cd0
push esi
call fcn.730302f2
add esp, 0xc
test eax, eax
je 0x73010465
push 0x10
push 0x73002c6c
push esi
call fcn.730302f2
add esp, 0xc
test eax, eax
je 0x73010454
push 0x10
push 0x73002cc0
push esi
call fcn.730302f2
add esp, 0xc
test eax, eax
jne 0x7301046a
mov eax, dword [ebp + 8]
cmp dword [eax + 0x30], 4
jae 0x7301046a
mov ecx, eax
test ecx, ecx
je 0x7301046a
mov dword [edi], ecx
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x7308d3fc]
call esi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.7302e750
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 8]
test eax, eax
je 0x7301046a
lea ecx, [eax + 4]
jmp 0x7301042a
mov eax, dword [ebp + 8]
jmp 0x73010428
mov eax, dword [ebp + 8]
jmp 0x73010428
mov dword [ebp - 8], 0x2e0
mov eax, 0x80004002
jmp 0x73010442
Function at 0x73010720
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x7308c0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
or esi, 0xffffffff
lock xadd dword [edi + 4], esi
dec esi
je 0x73010754
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.7302e750
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x73010740
mov dword [edi], 0x73001140
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x73010781
mov eax, dword [ecx]
push ebx
push ecx
mov ebx, dword [eax + 4]
cmp ebx, 0x73021da0
jne 0x73010792
call fcn.730119a0
mov dword [edi + 0xc], 0
pop ebx
push edi
push 0
push dword [0x7308c968]
call dword [0x7308d088]
jmp 0x73010740
cmp ebx, 0x73020e50
jne 0x7303cab4
call fcn.73010a50
jmp 0x73010779

Function at 0x73010aab
Capabilities:
Packed with generic packer

Disassembly:
adc eax, 0x7308d274
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [esi + 0x38]
push eax
call dword [0x7308d0b8]
mov esi, eax
xor edx, edx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi - 0x10]
call fcn.7301b9e0
test byte [0x7308cd40], 8
jne 0x7303cc94
mov ecx, dword [esi - 0x18]
push ebx
push edi
call fcn.73010bc1
mov edi, dword [esi - 0x1c]
mov ebx, eax
mov ecx, dword [edi]
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x1c], eax
cmp eax, 0x7301ed20
jne 0x73010b78
mov ecx, dword [edi + 0x2c]
mov edx, dword [edi + 0x38]
push edi
push edx
mov eax, dword [ecx]
mov dword [ebp - 0x1c], ecx
mov eax, dword [eax + 0x14]
cmp eax, 0x7300b7f0
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x34]
push eax
jne 0x7303ccab
call 0x72ffb3f0
pop edi
test ebx, ebx
pop ebx
jne 0x73010b9f
test byte [0x7308cd40], 8
jne 0x7303cce6
cmp dword [ebp - 8], 0
pop esi
je 0x73010b68
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push eax
push 2
call dword [0x7308d364]
test eax, eax
jg 0x7303ccfd
js 0x73010bb3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.7302e750
mov esp, ebp
pop ebp
ret 0xc
push dword [esi - 0x14]
cmp eax, 0x73014fa0
jne 0x73010b8b
mov ecx, edi
call fcn.73004ba0
jmp 0x73010b31
cmp eax, 0x730258d0
jne 0x7303ccc0
mov ecx, edi
call fcn.730154d0
jmp 0x73010b31
call dword [0x7308d388]
test byte [0x7308c948], 1
je 0x73010b37
jmp 0x7303ccd2
mov dword [ebp - 0x1c], 0x67
jmp 0x73010b68

Function at 0x73010bc1
Capabilities:
Packed with generic packer

Disassembly:
test ecx, ecx
jne 0x73010bc8
xor eax, eax
ret
push ecx
push 0
call dword [0x7308d114]
test eax, eax
je 0x7303cd0c
xor eax, eax
inc eax
ret
Function at 0x73010ce0
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x7308c0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x73002ca0
mov dword [ebp - 8], 0
mov esi, edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], 0x73002ca0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x73002ca0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x73002ca0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x48], 0x73002ca0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 8], 0
test byte [0x7308c948], 0x10
mov ebx, dword [ebp + 0x14]
jne 0x7303cd5c
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x73010dab
mov dword [eax], 0
test ebx, ebx
jne 0x7303cd78
lea eax, [ebp - 0x14]
xor edx, edx
push eax
mov eax, dword [ebp + 0x10]
push 0
push dword [ebp - 0x10]
mov ecx, dword [eax + 4]
call fcn.73011d00
mov ebx, eax
test ebx, ebx
js 0x7303cda7
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x73010de9
mov ecx, esi
call fcn.73011ce0
test eax, eax
jne 0x7303cdb3
mov dword [ebp - 8], 0x1f4
mov ebx, 0x80070490
mov esi, 0x73002ca0
test byte [0x7308c948], 0x10
jne 0x7303cfbe
cmp esi, 0x73002ca0
jne 0x7303cfd3
cmp edi, 0x73002ca0
jne 0x7303cfef
mov eax, dword [ebp - 0x48]
cmp eax, 0x73002ca0
jne 0x7303d00b
mov eax, dword [ebp - 0x24]
cmp eax, 0x73002ca0
jne 0x7303d027
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], 0x73002ca0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
cmp eax, 0x73002ca0
jne 0x7303d043
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], 0x73002ca0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
cmp eax, 0x73002ca0
jne 0x7303d05f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], 0x73002ca0
mov dword [ebp - 0x38], 0
add byte [eax], al
mov dword [ebp - 0x34], 0
test eax, eax
jne 0x7303d07b
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x73010ee0
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
jne 0x73010ee0
test esi, esi
je 0x73010ee0
mov eax, dword [esi + 4]
test eax, eax
je 0x73010ed5
mov edi, dword [0x7308cc60]
mov ecx, edi
push eax
call dword [0x7308d3fc]
call edi
mov dword [esi + 4], 0
push 8
push esi
call fcn.7302eb11
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
Function at 0x73010e90
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x7308c0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x73002ca0
mov dword [ebp - 8], 0
mov esi, edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], 0x73002ca0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x73002ca0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x73002ca0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x48], 0x73002ca0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 8], 0
test byte [0x7308c948], 0x10
mov ebx, dword [ebp + 0x14]
jne 0x7303cd5c
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x73010dab
mov dword [eax], 0
test ebx, ebx
jne 0x7303cd78
lea eax, [ebp - 0x14]
xor edx, edx
push eax
mov eax, dword [ebp + 0x10]
push 0
push dword [ebp - 0x10]
mov ecx, dword [eax + 4]
call fcn.73011d00
mov ebx, eax
test ebx, ebx
js 0x7303cda7
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x73010de9
mov ecx, esi
call fcn.73011ce0
test eax, eax
jne 0x7303cdb3
mov dword [ebp - 8], 0x1f4
mov ebx, 0x80070490
mov esi, 0x73002ca0
test byte [0x7308c948], 0x10
jne 0x7303cfbe
cmp esi, 0x73002ca0
jne 0x7303cfd3
cmp edi, 0x73002ca0
jne 0x7303cfef
mov eax, dword [ebp - 0x48]
cmp eax, 0x73002ca0
jne 0x7303d00b
mov eax, dword [ebp - 0x24]
cmp eax, 0x73002ca0
jne 0x7303d027
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], 0x73002ca0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
cmp eax, 0x73002ca0
jne 0x7303d043
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], 0x73002ca0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
cmp eax, 0x73002ca0
jne 0x7303d05f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], 0x73002ca0
mov dword [ebp - 0x38], 0
add byte [eax], al
mov dword [ebp - 0x34], 0
test eax, eax
jne 0x7303d07b
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x73010ee0
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
jne 0x73010ee0
test esi, esi
je 0x73010ee0
mov eax, dword [esi + 4]
test eax, eax
je 0x73010ed5
mov edi, dword [0x7308cc60]
mov ecx, edi
push eax
call dword [0x7308d3fc]
call edi
mov dword [esi + 4], 0
push 8
push esi
call fcn.7302eb11
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
Function at 0x73011290
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x7308c0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x1c]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x34], eax
test byte [0x7308c948], 0x10
jne 0x7303d339
xor esi, esi
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0x1c], 0
test byte [ebp + 0xc], 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x28], esi
mov word [ebp - 0x24], ax
je 0x7303d350
test byte [0x7308c948], 0x10
jne 0x7303d361
lea ebx, [edi + 0x10]
push ebx
call dword [0x7308d1f8]
cmp dword [edi + 8], esi
jne 0x7303d378
xor eax, eax
cmp dword [edi + 0x28], esi
jne 0x7303d3d0
push ebx
call dword [0x7308d1fc]
cmp dword [ebp - 0x2c], esi
jne 0x7303d3f5
mov edi, dword [edi + 0x2c]
push 0x1c
mov dword [ebp - 0x2c], esi
xor esi, esi
push esi
push dword [0x7308c968]
mov dword [ebp - 8], esi
call dword [0x7308d094]
test eax, eax
je 0x7303d423
xor ecx, ecx
mov dword [eax], 0x7300128c
mov dword [eax + 0xc], esi
xor ebx, ebx
mov dword [eax + 0x10], ecx
mov esi, eax
mov word [eax + 0x14], cx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], 1
mov dword [eax + 8], edi
mov dword [eax + 0x18], ecx
test esi, esi
je 0x7301138f
mov eax, dword [esi]
push esi
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x7308d3fc]
call edi
mov eax, dword [ebp - 0x34]
mov dword [eax], esi
test byte [0x7308c948], 0x10
jne 0x7303d43b
cmp dword [ebp - 0xc], 0
jne 0x7303d450
test esi, esi
je 0x730113c6
mov eax, dword [esi]
push esi
mov edi, dword [eax + 8]
cmp edi, 0x73021ff0
jne 0x7303d45d
call fcn.73011bf0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7302e750
mov esp, ebp
pop ebp
ret 0x18

Function at 0x730114a0
Capabilities:
Packed with generic packer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 8]
or esi, 0xffffffff
lock xadd dword [edi + 4], esi
dec esi
je 0x730114c2
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
test edi, edi
je 0x730114b8
cmp dword [edi + 8], 0
mov dword [edi], 0x730011d4
je 0x73011529
push 0x7308cb44
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x7308cb44
call dword [0x7308d1f8]
mov ecx, dword [0x7308cca0]
mov eax, ecx
mov edx, dword [0x7308cca4]
or eax, edx
mov dword [ebp - 4], 1
je 0x7303d4a1
add ecx, 0xffffffff
mov dword [0x7308cca0], ecx
adc edx, 0xffffffff
or ecx, edx
mov dword [0x7308cca4], edx
je 0x7301153d
push 0x7308cb44
call dword [0x7308d1fc]
push edi
push 0
push dword [0x7308c968]
call dword [0x7308d088]
jmp 0x730114b8
call fcn.7301ab8a
call fcn.730270a0
cmp dword [0x7308cc98], 0
jne 0x7303d4b5
call fcn.73019368
jmp 0x7301151e