joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001224e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1001225d
pop dword [ebp - 0x44]
mov eax, 0xf0c3012b
sub eax, 0xe0c1dece
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xfb6be8ac
sub dword [ebp - 0x54], 0xad19a361
mov dword [ebp - 0x50], 0x950a0fd8
add dword [ebp - 0x50], 0x9d293c6d
mov dword [ebp - 0x4c], 0x8d4306b0
sub dword [ebp - 0x4c], 0x40f6c282
mov dword [ebp - 0x48], 0xe2453f50
add dword [ebp - 0x48], 0x1dbac0b0
lea eax, [ebp - 0x54]
push eax
mov eax, 0x1ddb28d
add eax, 0xe239e0b
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x9cddf015
sub dword [ebp - 0x54], 0x286b86bf
mov dword [ebp - 0x50], 0x8b1228e1
sub dword [ebp - 0x50], 0x49a5c76c
mov dword [ebp - 0x4c], 0x4034c099
sub dword [ebp - 0x4c], 0xdcc5542d
mov dword [ebp - 0x48], 0x5df95899
add dword [ebp - 0x48], 0xa206a767
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x60128446
sub eax, 0x501133aa
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3a37e
push 0
call eax
mov ecx, 0x4e91
mov edx, eax
mov edi, 0x3c04cb7f
add edi, 0xd3ff5081
add edi, dword [ebp - 0x44]
mov esi, 0xad75c48e
add esi, 0xfa891637
sub dword [ebp - 0x3c], esi
mov ebx, dword [edi]
add dword [ebp - 0x2c], eax
sub ebx, esi
sub dword [ebp - 4], edx
mov dword [edx], ebx
xor dword [ebp - 0x40], edi
add edx, 0x4a8a471d
sub edx, 0x4a8a4719
add edi, 4
loop 0x10012379
add eax, 0x470290f9
sub eax, 0x470163e2
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x4045f7
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x406af3
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404616
mov al, 1
jmp 0x4046e2
test esi, esi
je 0x4046e0
xor ebx, ebx
cmp word [esi], bx
je 0x4046e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4046e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x4046e0
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00406016
pop ecx
pop ecx
mov esi, dword [0x40a010]
xor edi, edi
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4046d1
lea eax, [ebp - 0x28]
push eax
call fcn.00406016
pop ecx
test al, al
jne 0x4046d1
cmp dword [ebp - 0x18], esi
jbe 0x4046d1
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4046d1
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x4046d1
push 0x4075c8
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
movzx ebx, bl
pop ecx
pop ecx
cmovne ebx, edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], edi
call fcn.00406016
mov al, bl
jmp 0x4046e2
xor al, al
call fcn.004054b6
ret
Function at 0x40477f
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push 0x230
mov eax, 0x406b23
call fcn.004054fb
xor eax, eax
mov byte [ebp - 0x231], al
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.kernel32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x4048fd
push str.__alloweddir
mov byte [ebp - 0x231], 1
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x238], esi
pop ecx
cmp dword [ebp - 0x23c], eax
jle 0x4048f6
cmp dword [ebx + edi*4], 0
je 0x4048e9
push esi
push str.__alloweddir
push dword [ebx + edi*4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4048e9
mov eax, dword [ebx + edi*4]
xor ecx, ecx
mov byte [ebp - 0x231], cl
lea esi, [eax + esi*2]
cmp word [esi], cx
je 0x4048e3
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
cmp eax, 0x104
jae 0x4048e3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4048e3
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4048e3
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.00406016
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 0x220], eax
je 0x4048cd
mov ecx, 0x104
cmp dword [ebp - 0x220], ecx
jae 0x4048cd
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push ecx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test eax, eax
jne 0x4048cd
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x4048cd
lea eax, [ebp - 0x218]
mov ecx, section..data
push eax
call fcn.00404a8c
mov byte [ebp - 0x231], 1
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], 1
call fcn.00406016
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x238]
inc edi
cmp edi, dword [ebp - 0x23c]
jl 0x4047e5
push ebx
call dword [sym.imp.kernel32.dll_LocalFree]
mov al, byte [ebp - 0x231]
call fcn.004054b6
ret

Function at 0x404b45
Capabilities:
Accept command line arguments

Disassembly:
push esi
push 1
call fcn.00406016
pop ecx
push 2
call dword [sym.imp.kernel32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov esi, eax
call fcn.0040477f
test al, al
jne 0x404b74
xor eax, eax
inc eax
jmp 0x404b83
push esi
call fcn.00404986
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop esi
ret 0x10
Function at 0x406016
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x406025
pop dword [ebp - 0x50]
mov eax, 0x5759e670
sub eax, 0x5719864b
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xb7a291d1
add dword [ebp - 0x60], 0x96afb37a
mov dword [ebp - 0x5c], 0x24861a89
add dword [ebp - 0x5c], 0xdad31bc
mov dword [ebp - 0x58], 0xb0fd5b78
add dword [ebp - 0x58], 0x9b4ee8b6
mov dword [ebp - 0x54], 0xe2f0b483
sub dword [ebp - 0x54], 0xe2f0b483
lea eax, [ebp - 0x60]
push eax
mov eax, 0x3cfe3b77
add eax, 0xc34234a5
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xc9c835be
add dword [ebp - 0x60], 0xaaaa3398
mov dword [ebp - 0x5c], 0x62fe3472
sub dword [ebp - 0x5c], 0x2191d2fd
mov dword [ebp - 0x58], 0x1d1c22ea
sub dword [ebp - 0x58], 0xb9acb67e
mov dword [ebp - 0x54], 0x2d578611
add dword [ebp - 0x54], 0xd2a879ef
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x3f60f2e8
sub eax, 0x3f2082c8
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x34960
push 0
call eax
mov ecx, 0x405df9de
sub ecx, 0x405dbe79
mov edi, eax
mov ebx, 0x3055a452
add ebx, 0xcfeb23ae
add ebx, dword [ebp - 0x50]
mov esi, 0x4ecca6f4
sub dword [ebp - 0x28], esi
mov edx, dword [ebx]
xor edx, esi
add dword [ebp - 0x3c], eax
mov dword [edi], edx
add dword [ebp - 0x40], 0x2ecacf82
add edi, 0xd9ef01de
sub edi, 0xd9ef01da
add ebx, 0xca4b3543
sub ebx, 0xca4b353f
loop 0x406141
add eax, 0x40714e7d
sub eax, 0x40706e16
mov ebx, eax
add eax, 0x95b70a6d
sub eax, 0x95b70a68
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10009100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10025768
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1002d7d8]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x1002d7d8]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x74]
mov ebp, dword [esp + 0x78]
mov edi, ecx
mov ecx, dword [esp + 0x7c]
lea edx, [esp + 0x20]
mov dword [esp + 0x18], ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
call fcn.10001190
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x74], 0
call fcn.10007380
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.10015db0
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x58], 0xffffffff
test eax, eax
je 0x100091ef
push 0
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.10015db0
mov eax, dword [edi + 4]
test eax, eax
jbe 0x100091cd
cmp eax, 0xffffffff
jae 0x100091cd
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.1000f167
test esi, esi
je 0x100091ef
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x68], 0
mov edx, dword [esp + 0x64]
jne 0x10009238
test edx, edx
je 0x1000922d
mov eax, dword [edx + 0x20]
cmp dword [eax], 0
je 0x10009215
mov ecx, dword [edx + 0x30]
cmp dword [ecx], 0
jle 0x10009215
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x10009222
mov eax, dword [edx]
mov ecx, edx
mov edx, dword [eax + 0x10]
call edx
mov edx, dword [esp + 0x64]
cmp eax, 0xffffffff
je 0x1000922d
mov byte [esp + 0x69], al
jmp 0x10009233
xor edx, edx
mov dword [esp + 0x64], edx
mov byte [esp + 0x68], 1
cmp byte [esp + 0x70], 0
mov ecx, dword [esp + 0x6c]
jne 0x10009274
test ecx, ecx
je 0x10009272
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x1000925e
mov esi, dword [ecx + 0x30]
cmp dword [esi], 0
jle 0x1000925e
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x1000926d
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x64]
cmp eax, 0xffffffff
jne 0x10009274
xor ecx, ecx
test edx, edx
jne 0x1000927e
test ecx, ecx
je 0x10009282
jmp 0x10009286
test ecx, ecx
je 0x10009286
or dword [ebp], 1
lea ecx, [esp + 0x2c]
cmp dword [esp + 0x14], ecx
je 0x100092a3
cmp dword [esp + 0x10], 0
jne 0x100092a3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
jmp 0x100092a7
or dword [ebp], 2
mov eax, dword [esp + 0x24]
mov dword [eax], edx
mov edx, dword [esp + 0x68]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10011cf3
add esp, 0x4c
ret 0x20
Function at 0x100092e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10025768
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1002d7d8]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebp
push esi
push edi
mov eax, dword [0x1002d7d8]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x74]
mov ebp, dword [esp + 0x78]
mov edi, ecx
mov ecx, dword [esp + 0x7c]
lea edx, [esp + 0x20]
mov dword [esp + 0x18], ecx
push edx
mov ecx, esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
call fcn.10001190
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x40]
push ecx
push edi
mov dword [esp + 0x74], 0
call fcn.10007380
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.10015db0
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x58], 0xffffffff
test eax, eax
je 0x100093cf
push 0
lea ecx, [esp + 0x2c]
mov edi, eax
call fcn.10015db0
mov eax, dword [edi + 4]
test eax, eax
jbe 0x100093ad
cmp eax, 0xffffffff
jae 0x100093ad
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x28]
and esi, edi
call fcn.1000f167
test esi, esi
je 0x100093cf
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x68], 0
mov edx, dword [esp + 0x64]
jne 0x10009418
test edx, edx
je 0x1000940d
mov eax, dword [edx + 0x20]
cmp dword [eax], 0
je 0x100093f5
mov ecx, dword [edx + 0x30]
cmp dword [ecx], 0
jle 0x100093f5
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x10009402
mov eax, dword [edx]
mov ecx, edx
mov edx, dword [eax + 0x10]
call edx
mov edx, dword [esp + 0x64]
cmp eax, 0xffffffff
je 0x1000940d
mov byte [esp + 0x69], al
jmp 0x10009413
xor edx, edx
mov dword [esp + 0x64], edx
mov byte [esp + 0x68], 1
cmp byte [esp + 0x70], 0
mov ecx, dword [esp + 0x6c]
jne 0x10009454
test ecx, ecx
je 0x10009452
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x1000943e
mov esi, dword [ecx + 0x30]
cmp dword [esi], 0
jle 0x1000943e
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x1000944d
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x64]
cmp eax, 0xffffffff
jne 0x10009454
xor ecx, ecx
test edx, edx
jne 0x1000945e
test ecx, ecx
je 0x10009462
jmp 0x10009466
test ecx, ecx
je 0x10009466
or dword [ebp], 1
lea ecx, [esp + 0x2c]
cmp dword [esp + 0x14], ecx
je 0x10009483
cmp dword [esp + 0x10], 0
jne 0x10009483
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
jmp 0x10009487
or dword [ebp], 2
mov eax, dword [esp + 0x24]
mov dword [eax], edx
mov edx, dword [esp + 0x68]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10011cf3
add esp, 0x4c
ret 0x20
Function at 0x100094c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10025798
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1002d7d8]
xor eax, esp
mov dword [esp + 0x40], eax
push ebp
push esi
push edi
mov eax, dword [0x1002d7d8]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov eax, dword [esp + 0x64]
mov esi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
mov edi, ecx
mov ecx, dword [esp + 0x80]
lea edx, [esp + 0x20]
mov dword [esp + 0x18], ecx
push edx
mov ecx, esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0
call fcn.10001190
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x44]
push ecx
push edi
mov dword [esp + 0x78], 0
call fcn.10007380
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.10015db0
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x28], edx
mov dword [esp + 0x5c], 0xffffffff
test eax, eax
je 0x100095b6
push 0
lea ecx, [esp + 0x30]
mov edi, eax
call fcn.10015db0
mov eax, dword [edi + 4]
test eax, eax
jbe 0x10009594
cmp eax, 0xffffffff
jae 0x10009594
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x2c]
and esi, edi
call fcn.1000f167
test esi, esi
je 0x100095b6
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edx, dword [esp + 0x68]
jne 0x100095ff
test edx, edx
je 0x100095f4
mov eax, dword [edx + 0x20]
cmp dword [eax], 0
je 0x100095dc
mov ecx, dword [edx + 0x30]
cmp dword [ecx], 0
jle 0x100095dc
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x100095e9
mov eax, dword [edx]
mov ecx, edx
mov edx, dword [eax + 0x10]
call edx
mov edx, dword [esp + 0x68]
cmp eax, 0xffffffff
je 0x100095f4
mov byte [esp + 0x6d], al
jmp 0x100095fa
xor edx, edx
mov dword [esp + 0x68], edx
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x74], 0
mov ecx, dword [esp + 0x70]
jne 0x1000963b
test ecx, ecx
je 0x10009639
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x10009625
mov esi, dword [ecx + 0x30]
cmp dword [esi], 0
jle 0x10009625
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x10009634
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x68]
cmp eax, 0xffffffff
jne 0x1000963b
xor ecx, ecx
test edx, edx
jne 0x10009645
test ecx, ecx
je 0x10009649
jmp 0x1000964d
test ecx, ecx
je 0x1000964d
or dword [ebp], 1
lea ecx, [esp + 0x30]
cmp dword [esp + 0x14], ecx
je 0x10009671
cmp dword [esp + 0x10], 0
jne 0x10009671
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], ecx
jmp 0x10009675
or dword [ebp], 2
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esp + 0x6c]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.10011cf3
add esp, 0x50
ret 0x20
Function at 0x100096b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10025798
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1002d7d8]
xor eax, esp
mov dword [esp + 0x40], eax
push ebp
push esi
push edi
mov eax, dword [0x1002d7d8]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov eax, dword [esp + 0x64]
mov esi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
mov edi, ecx
mov ecx, dword [esp + 0x80]
lea edx, [esp + 0x20]
mov dword [esp + 0x18], ecx
push edx
mov ecx, esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0
call fcn.10001190
mov esi, dword [esi + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x44]
push ecx
push edi
mov dword [esp + 0x78], 0
call fcn.10007380
add esp, 0x18
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.10015db0
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x28], edx
mov dword [esp + 0x5c], 0xffffffff
test eax, eax
je 0x100097a6
push 0
lea ecx, [esp + 0x30]
mov edi, eax
call fcn.10015db0
mov eax, dword [edi + 4]
test eax, eax
jbe 0x10009784
cmp eax, 0xffffffff
jae 0x10009784
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x2c]
and esi, edi
call fcn.1000f167
test esi, esi
je 0x100097a6
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x6c], 0
mov edx, dword [esp + 0x68]
jne 0x100097ef
test edx, edx
je 0x100097e4
mov eax, dword [edx + 0x20]
cmp dword [eax], 0
je 0x100097cc
mov ecx, dword [edx + 0x30]
cmp dword [ecx], 0
jle 0x100097cc
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x100097d9
mov eax, dword [edx]
mov ecx, edx
mov edx, dword [eax + 0x10]
call edx
mov edx, dword [esp + 0x68]
cmp eax, 0xffffffff
je 0x100097e4
mov byte [esp + 0x6d], al
jmp 0x100097ea
xor edx, edx
mov dword [esp + 0x68], edx
mov byte [esp + 0x6c], 1
cmp byte [esp + 0x74], 0
mov ecx, dword [esp + 0x70]
jne 0x1000982b
test ecx, ecx
je 0x10009829
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x10009815
mov esi, dword [ecx + 0x30]
cmp dword [esi], 0
jle 0x10009815
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x10009824
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x68]
cmp eax, 0xffffffff
jne 0x1000982b
xor ecx, ecx
test edx, edx
jne 0x10009835
test ecx, ecx
je 0x10009839
jmp 0x1000983d
test ecx, ecx
je 0x1000983d
or dword [ebp], 1
lea ecx, [esp + 0x30]
cmp dword [esp + 0x14], ecx
je 0x10009861
cmp dword [esp + 0x10], 0
jne 0x10009861
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 4], ecx
jmp 0x10009865
or dword [ebp], 2
mov eax, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esp + 0x6c]
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.10011cf3
add esp, 0x50
ret 0x20
Function at 0x10009aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x100257f8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x1002d7d8]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebp
push esi
push edi
mov eax, dword [0x1002d7d8]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov eax, dword [esp + 0x80]
mov edx, dword [esp + 0x9c]
mov ebp, dword [esp + 0x98]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
mov esi, ecx
mov ecx, dword [esp + 0x94]
push eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0
call fcn.10001190
lea ecx, [esp + 0x10]
push ecx
push eax
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x40]
push ecx
push esi
mov dword [esp + 0x90], 0
call fcn.100078d0
add esp, 0x14
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.10015db0
fstp qword [esp + 0x38]
mov edi, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x78], 0xffffffff
test edi, edi
je 0x10009b9c
push 0
lea ecx, [esp + 0x28]
call fcn.10015db0
mov eax, dword [edi + 4]
test eax, eax
jbe 0x10009b7a
cmp eax, 0xffffffff
jae 0x10009b7a
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x24]
and esi, edi
call fcn.1000f167
test esi, esi
je 0x10009b9c
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [esp + 0x88], 0
mov edx, dword [esp + 0x84]
jne 0x10009bf7
test edx, edx
je 0x10009be6
mov eax, dword [edx + 0x20]
cmp dword [eax], 0
je 0x10009bc8
mov ecx, dword [edx + 0x30]
cmp dword [ecx], 0
jle 0x10009bc8
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x10009bd8
mov eax, dword [edx]
mov ecx, edx
mov edx, dword [eax + 0x10]
call edx
mov edx, dword [esp + 0x84]
cmp eax, 0xffffffff
je 0x10009be6
mov byte [esp + 0x89], al
jmp 0x10009bef
xor edx, edx
mov dword [esp + 0x84], edx
mov byte [esp + 0x88], 1
cmp byte [esp + 0x90], 0
mov ecx, dword [esp + 0x8c]
jne 0x10009c3f
test ecx, ecx
je 0x10009c3d
mov eax, dword [ecx + 0x20]
cmp dword [eax], 0
je 0x10009c23
mov esi, dword [ecx + 0x30]
cmp dword [esi], 0
jle 0x10009c23
mov eax, dword [eax]
movzx eax, byte [eax]
jmp 0x10009c38
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x84]
cmp eax, 0xffffffff
jne 0x10009c3f
xor ecx, ecx
test edx, edx
jne 0x10009c49
test ecx, ecx
je 0x10009c4d
jmp 0x10009c51
test ecx, ecx
je 0x10009c51
or dword [ebp], 1
lea ecx, [esp + 0x30]
cmp dword [esp + 0x14], ecx
je 0x10009c6e
cmp dword [esp + 0x10], 0
jne 0x10009c6e
fld qword [esp + 0x28]
mov eax, dword [esp + 0x18]
fstp qword [eax]
jmp 0x10009c72
or dword [ebp], 2
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x88]
mov dword [eax], edx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.10011cf3
add esp, 0x6c
ret 0x20