joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52f427
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
aaa
idiv byte [edi + 0x610a0858]
or byte [ecx - 0x18], al
sbb eax, 0x61d54f04
inc ecx
call 0xd5a1f853
popal
fcomp qword [esi + 6]
push es
mov esp, dword [0xd1903c9b]
rcl dword [eax + 0x61], 0x23
mov edi, 0xa2c1fef9
sub byte [ebx], ah
loopne 0x52f4b0
arpl word [eax], si
out dx, al
and dword [ecx - 0x257627c5], ebx
mov eax, eax
stc
fild word [ebp + 0x1e]
pushal
lea edx, [ecx + 0x7c2bbc59]
dec ecx
cmpsd dword [esi], dword es:[edi]
nop
sal dword [esi + 0x306e7d1c], 0xa6
invalid
sar byte [eax - 0xf], cl
stc
and ebp, dword [edi + 0x12]
rol byte [ebx - 0x23], cl
loope 0x52f4f5
xor dword [edx], ebp
push ss
mov dl, byte [eax - 0x18]
mov eax, dword [0x79623599]
leave
jne 0x52f430
das
xor edi, dword [edx + 0x47]
in eax, 0x28
sub cl, cl
mov al, byte [0x78f01f17]
fsub dword [edi]
js 0x52f48a
daa
mov ecx, 0x71d1d930
pop es
stosd dword es:[edi], eax
push esp
clc
mov cl, 0x8b
cmpsb byte [esi], byte es:[edi]
iretd
out 0x7c, al
xor eax, dword [ecx - 0x674f2afe]
inc ebp
add dword [edx], 0x4598b0d5
loope 0x52f56d
push esi
sub byte [eax], bl
sub al, 0xd5
mov dword [0x704800f3], eax
pop esp
jo 0x52f564
mov dl, 0x28
scasd eax, dword es:[edi]
mov ebx, dword [0xe3180a68]
fnstenv [esi]
cli
fcompp
jae 0x52f4f2
push ecx
pop ds
add esp, dword [edx + 0x3c8983c1]
jne 0x52f506
adc byte [eax + 4], cl
pop esp
mov dword [0x6168865a], eax
sbb al, 0x42
arpl di, di
mov dl, 0xe
ljmp 0x8503
wait
dec ebp
inc ecx
mov ebp, 0x7c3a89b3
sbb byte [eax - 0x1b], ch
xor dword [ecx + 0x6c24f1c6], ebx
push 0xc69931e5
int1
and al, 0x6c
bound esp, qword [ecx - 0x31]
jge 0x52f5bc
call dword [edi - 0x69753cbe]
inc eax
invalid
hlt
Function at 0x548138
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0xe
mov edx, 0xc33cee5b
and dword [0xa90927be], ecx
invalid
ja 0x54813b
and al, byte [esi]
cmp eax, 0x83f359fa
mov ah, 0xf7
mov dl, dh
loopne 0x5480c4
fadd qword cs:[ebx + 0x11d85624]
fcom dword [ecx]
mov byte [esi - 0x57], bl
pop ebx
call 0x84b0ffda
xchg eax, eax
loopne 0x548149
aas
popal
dec eax
xor ecx, dword [esi]
mov edx, 0x2f099518
enter 0x7008, 0xffffffffffffffa7
imul ebx
mov word [0x48e887d5], ss
sbb ebp, ecx
xor byte [ecx], 0x70
shr dword [ecx + esi*4 - 0x35], 1
shr dword [ecx - 0x7b0bd646], cl
idiv eax
jno 0x54810c
clc
daa
daa
or eax, 0x415ed80a
pop esi
inc ecx
jecxz 0x5480f6
mov edx, 0x98a1a975
inc ecx
invalid
jne 0x5480e7
mov eax, dword [0xe58d4198]
jl 0x548109
dec eax
push ecx
fild qword [esi + 0x15636077]
add eax, 0xd4ee1af8
sar dword [ecx - 0x22], 1
scasb al, byte es:[edi]
ja 0x5481ac
arpl word [0xee1af805], dx
aam 0xd1
jns 0x548134
push esp
lds edx, [edx - 0x72]
rcr bl, 0xd
js 0x5480f0
clc
dec esi
js 0x548192
push 0x12b64596
xor dword [eax + 0x31], ebx
cmp dword [edi - 0x66], esp
int1
jmp 0x5480fb
xor ebx, dword [eax - 0x35]
jbe 0x548106
ja 0x54810e
adc edi, dword [ebx + 0x189585a1]
test dword [esi + 0x24], esp
inc ecx
mov dword [0x28e168c9], eax
daa
cmp esi, dword [eax + 0x41]
loopne 0x54818f
leave
out 0x2e, al
pop ebp
in al, 0x89
int 0x1f
push edi
push esi
sub byte [esi + 0x7c], ch
mov eax, dword [0xf5ce8176]
push 0xffffffffffffffdc
sbb ah, byte [0x7f0c61d1]
popal
or al, 0x7f
push edi
mov ebx, 0xa1110551
cld
sub al, 0xc8
mov esi, 0xb7bf444b
popfd
dec edx
outsb dx, byte [esi]
jne 0x54823b
xor esi, 2
dec esi
leave
mov byte [ebx - 0x26e50fca], dl
xchg edi, eax
movsd dword es:[edi], dword [esi]
xchg al, dh
outsb dx, byte [esi]
cmp byte [edi + 0x36a39b14], ah
mov ebp, dword [edi + ecx]
or dword [ebx + 0x78], esi
popal
rcr dword [esi - 0x6c67840], 1
imul esp, dword [ebx - 0x3b33aeaa], 0x47
std
loopne 0x548177
iretd
js 0x548290
nop
hlt
Function at 0x55cf78
Capabilities:
Encode data using xor

Disassembly:
pop ebx
call 0x848781fd
mov byte [0x7ec9888], al
jo 0x55cfa6
or byte [eax], ah
dec esp
xchg ecx, eax
popfd
jmp 0x55cfad
loope 0x55cff4
xchg ecx, eax
cmp eax, 0x48f078d1
dec eax
dec esi
cdq
sbb edi, esp
inc ecx
invalid
lea edx, cs:[edx - 0x14]
lea edx, [edx - 0x14]
jne 0x55cfb7
inc ebp
insb byte es:[edi], dx
sbb al, 0x59
nop
mov es, word cs:[ebp - 0x2bc659f8]
pop ss
cmp dword [ebx + ebx*2], 0x2558d501
fadd dword [eax - 0x14]
invalid
pop ebx
add ebp, edx
pop eax
and eax, 0xf0ec40d8
fsub qword [ecx + 0x79]
push esp
call 0xc8d2768e
and al, 0xf8
push edx
push esp
jnp 0x55d04b
push ebp
xchg ebp, eax
lodsd eax, dword [esi]
xchg ecx, eax
sbb al, 0x55
mov al, byte [0xb04517b1]
sar ah, 1
push esp
jns 0x55d01a
and eax, 0x11cc35cf
push 0x9831bb47
int 0x59
popfd
sub byte [ebp - 0x1ef61ef2], al
pop esi
test dword [ecx], ebx
xchg esp, eax
sub al, 0xb1
iretd
dec edx
and ch, byte [ecx + edx*2]
loop 0x55d054
jns 0x55d03a
cdq
xor eax, 0x72ac0498
lcall 0x7c85, 0x8c658870
shr byte [ecx + edi + 0x4b], 1
jb 0x55cfb6
jo 0x55cfa6
mov word gs:[ebp + 0x396cd07c], es
dec ebx
fstp qword [ebx - 0x31]
dec esp
and ah, byte [si - 0xfb6]
test dword [0x706d5aa8], esp
fdiv qword [eax - 0x34]
adc eax, edi
mov dword gs:[eax - 0x43], edx
jne 0x55cfcc
cmp ebp, dword [esi - 0x4d]
cmp byte [ecx - 0x6eb355f7], ah
sub esp, esp
jns 0x55d00d
cli
jno 0x55d064
push ecx
stosd dword es:[edi], eax
mov bl, 0x3b
aas
sub al, 0x9f
xor al, 0x50
mov byte [0xd975b901], al
and dword [ecx + 0x38b56ba5], ebp
mov eax, 0xfd4ce068
sub ebp, edx
int1
cld
cmc
sbb al, 0x51
loopne 0x55d01e
div dword [ebp - 0x3b]
invalid
Function at 0x572f68
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a6458
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x57308b
push ecx
lea ecx, [esi + 0x18]
call fcn.00592788
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5730a2
push ecx
lea ecx, [esi + 0x24]
call fcn.00592698
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x593388
Capabilities:
Encode data using xor

Disassembly:
dec ebx
push 0x3b0ca115
stc
push ebx
or dword [eax - 0x2f], esi
ja 0x593279
retf 0x85dd
je 0x5932db
dec eax
sub byte [ebx + 0x59e3566d], bl
insb byte es:[edi], dx
jns 0x5932a7
int 0xc9
or al, 0x38
invalid
cmpsb byte [esi], byte es:[edi]
sbb esi, dword [ebp + 0x1b]
fimul word [ebx]
hlt
dec ecx
pop esi
jecxz 0x593326
jg 0x593263
mov ebx, 0xf90b94c8
enter 0xb94, 0xfffffffffffffff9
jb 0x59328c
jg 0x593289
mov ebx, 0x6888f6cc
cmp ebp, esp
xor dword [ebp - 0x7950636], esi
mov ah, 0xf4
fcmovu st(0), st(6)
sbb dword cs:[ebp - 0x2c], edi
add byte [ebp + 0x22], dl
cmpsd dword [esi], dword es:[edi]
dec edx
pop ebx
adc cl, byte [ebp - 0x40]
xchg dword [ebp + edx*8 + 0x46], edi
dec esp
and eax, 0xd57c87c0
inc esi
imul esi, dword [ecx + 0xf], 0x31148fad
test al, 0xc1
mov dl, 0x81
inc esi
xor dword [eax + 0x4681b2c1], ebp
cmp eax, 0xfa6be847
and dword [edi + 0x48], 0x72
xor dword [edx], esp
mov ch, 0x4e
and bh, byte [esi]
mov ch, 0x4e
jne 0x5932ce
fnsave dword [ebx]
test al, 0x48
je 0x5932a3
xor ebp, dword [eax + 0x3aad7448]
jns 0x593362
cmp bh, byte [ecx + 0x69]
sub cl, byte [edx]
mov esi, 0x8c291dc2
sub cl, byte [edx - 0x77]
or si, word [eax]
push 0x19
dec edx
mov edx, 0xb05b9904
retf
rcr al, 1
mov eax, ebp
push 0x38
test al, 0x8d
jle 0x5932a6
imul edi, dword [ebx + 0x47], 0x9fa278e6
insb byte es:[edi], dx
cdq
jne 0x5932eb
les ebx, [edi + 0x42cab907]
pop edx
jne 0x59339b
lahf
pop es
mov ecx, 0x755a42ca
insb byte es:[edi], dx
enter 0x6526, 0x3e
into
mov esi, esp
mov dword [0x226f57c4], eax
and ebp, ebx
wait
lodsd eax, dword [esi]
cmp eax, 0x6be36978
and ah, byte [ecx]
fstp qword [ebx + 0x69783dad]
jecxz 0x5933af
jp 0x593312
inc eax
mov dl, byte [ebp - 0x53b47db3]
add dword [ebx], ecx
push ebp
mov cl, 0xb7
cmp ebp, eax
xchg byte [eax], al
xchg ecx, eax
out dx, eax
dec ebp
or byte [ebx - 0x54], 1
or edx, dword [ebp - 0x4f]
mov bh, 0x3b
call 0xefea33de
inc edi
jo 0x59333a
sbb edi, edx
jb 0x5932f0
out dx, eax
mov al, byte [0xe697e5b]
jle 0x5933cd
push cs
dec ebx
push esp
test dword [eax], ecx
xor ebp, edi
das
pushal
push cs
invalid
add byte [esi], 0xcb
adc dl, byte [ecx - 0x2c]
pop esp
or al, 0xd5
and al, 8
fnstcw word [ebx - 0x66738635]
stosb byte es:[edi], al
cli
cli
cli
push 0xe
jg 0x593349
in al, dx
mov dword [0x151e6659], eax
mov bl, byte [eax]
xor esp, dword [esi + 0x639202b]
and edi, ecx
scasb al, byte es:[edi]
cdq
cwde
and dword [ecx + ebp*8 - 0x6ca6dd56], ebx
and dword [edi + eax*8 - 0x187716d9], ebp
pop es
inc esp
aad 0x93
push 0xffffffffffffffcb
inc ebp
mov edi, 0x42e8ed2a
inc edx
sub byte [esi + esi - 0x5731d608], al
mov eax, 0x68c24008
sub cl, bh
imul edi, edi, 0x6044c0fe
add esi, eax
pushfd
invalid

Function at 0x5ef798
Capabilities:
Check for software breakpoints

Disassembly:
xchg esp, eax
imul ecx, dword [esi - 0x40fba8ff], 0xffffffc5
pop ds
Function at 0x64d15d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654338
cmp edx, dword [eax]
je 0x64d17f
add eax, 8
inc ecx
cmp eax, 0x6543c8
jl 0x64d170
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x654338]
jne 0x64d2ad
mov eax, dword [0xa57c90]
cmp eax, 1
je 0x64d287
test eax, eax
jne 0x64d1b0
cmp dword [0x654264], 1
je 0x64d287
cmp edx, 0xfc
je 0x64d2ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d1e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064db40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064dfd0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d22a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064dfd0
mov edi, eax
lea eax, [ebp - 0x1a4]
test dword [esi + edi*8 - 1], ebx
inc dword [ebx + 0x36a3be8]
lea eax, [ebp + 8]
lea esi, [esi + 0x65433c]
push 0
push eax
push dword [esi]
call fcn.0064dfd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x1001a692
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1001a6a1
pop dword [ebp - 0x1c]
mov eax, 0xf6ecea25
sub eax, 0xe6eb4384
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x44dac
push 0
mov eax, 0xfdca1843
sub eax, 0xedc6a75b
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x59b4
xor edi, edi
add edi, eax
mov ebx, 0xec709052
sub ebx, 0xdc6cc452
add ebx, dword [ebp - 0x1c]
mov edx, 0x673e0f5f
add edx, 0xfbbddd3d
sub dword [ebp - 0x18], esi
mov esi, dword [ebx]
add dword [ebp - 8], eax
sub esi, edx
mov dword [ebp - 0x18], 0xd19bb18b
mov dword [edi], esi
xor dword [ebp - 0xc], 0x5c63306a
add edi, 4
add ebx, 0x966db5e5
sub ebx, 0x966db5e1
loop 0x1001a6fc
add eax, 0x159a3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5a50fea0
add ecx, 0xb5af0160
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x100285c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x10033060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10036104]
test dword [ebp + 8], eax
je 0x1002866a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a692
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10036100]
test eax, eax
je 0x1002865d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a692
mov eax, dword [0x10033058]
pop ecx
pop ecx
test eax, eax
jle 0x1002866a
push esi
mov esi, dword [0x10036108]
push edi
mov edi, dword [0x1003610c]
cdq
push edx
push eax
push edi
push esi
call fcn.100291e0
add esi, 1
mov dword [0x10036108], esi
adc edi, 0
or eax, edx
mov dword [0x1003610c], edi
pop edi
pop esi
jne 0x1002866a
push dword [0x10036100]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x1002866a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028910
leave
ret
Function at 0x10003d66
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x10161380]
push ebx
xor ebx, ebx
push esi
cmp byte [eax + 0x29b], bl
je 0x10003e27
push edi
push ebx
push 0xffffffffffffffff
call fcn.100299e1
mov edi, eax
pop ecx
pop ecx
movzx ecx, byte [edi + 0x718]
imul edx, ecx, 0x1c
mov esi, dword [edx + edi + 0x5a0]
mov ecx, dword [edx + edi + 0x5ac]
mov dword [edx + edi + 0x5a8], ecx
cmp esi, 0x16
je 0x10003ded
cmp esi, 0x17
je 0x10003ded
cmp esi, 0x18
je 0x10003ded
cmp esi, 0x1a
je 0x10003ded
cmp esi, 0x1b
je 0x10003ded
cmp esi, 0x1c
je 0x10003ded
cmp esi, 0x1d
je 0x10003ded
cmp esi, 0x1e
je 0x10003ded
cmp esi, 0x1f
je 0x10003ded
cmp esi, 0x20
je 0x10003ded
cmp esi, 0x25
je 0x10003ded
cmp esi, 0x26
je 0x10003ded
cmp esi, 0x29
je 0x10003ded
cmp esi, 0x2a
jne 0x10003e26
mov ecx, dword [0x104190b4]
mov eax, dword [ecx]
call dword [eax + 0x6c]
movzx ecx, byte [edi + 0x718]
mov esi, eax
imul ecx, ecx, 0x1c
cmp dword [ecx + edi + 0x5a8], 1
jne 0x10003e26
mov ecx, dword [0x104190b4]
push ebx
mov edx, dword [ecx]
call dword [edx + 0x70]
mov ecx, dword [0x104190b4]
push esi
mov eax, dword [ecx]
call dword [eax + 0x70]
pop edi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10127380]
cmp eax, 0x3e8
jbe 0x10003e49
inc dword [0x10127374]
call esi
mov dword [0x10127380], eax
mov ecx, dword [0x10127374]
test ecx, ecx
jle 0x10003e73
mov eax, dword [0x10161380]
cmp byte [eax + 0x2b4], 1
jne 0x10003e73
mov byte [eax + 0x2b4], bl
mov eax, dword [0x10161380]
mov byte [eax + 0x2af], 1
mov eax, dword [0x10127378]
cmp ecx, 0x3b
jle 0x10003e89
inc eax
mov dword [0x10127374], ebx
mov dword [0x10127378], eax
cmp eax, 0x3b
jle 0x10003e9a
inc dword [0x1012737c]
mov dword [0x10127378], ebx
pop esi
pop ebx
ret
Function at 0x100067dd
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x14]
test esi, esi
jg 0x100067fd
jl 0x100067f4
test edi, edi
jne 0x100067fd
xor eax, eax
xor edx, edx
jmp 0x100068c4
cmp dword [ebp + 0x38], 0
je 0x10006813
push esi
push edi
push dword [esp + 0x18]
call fcn.100068ce
jmp 0x100068c4
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10006857
mov eax, dword [ebp + 0x2c]
cmp dword [eax], 0
jbe 0x10006857
cmp dword [eax], edi
mov esi, edi
mov ebx, dword [esp + 0x14]
cmovb esi, dword [eax]
push esi
push ecx
push ebx
call fcn.1005f040
mov eax, dword [ebp + 0x2c]
add ebx, esi
mov dword [esp + 0x20], ebx
add esp, 0xc
mov ebx, edi
sub ebx, esi
sub dword [eax], esi
mov eax, dword [ebp + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x1000685f
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [ebp + 0x4c], 0
mov ecx, ebx
je 0x100068ba
mov ecx, ebp
call fcn.100044fa
mov edx, dword [esp + 0x14]
mov ecx, ebx
jmp 0x1000689a
push dword [ebp + 0x4c]
push eax
push 1
push edx
call fcn.10063eb4
mov edx, dword [esp + 0x24]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [esp + 0x14], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x100068ca
mov eax, 0xfff
cmp ebx, eax
ja 0x10006876
test ecx, ecx
je 0x100068ba
push dword [ebp + 0x4c]
push ebx
push 1
push edx
call fcn.10063eb4
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
sub edi, ebx
jmp 0x100068bc
Function at 0x10007801
Capabilities:
Check for time delay via gettickcount

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0xc8
cmp dword [0x101273b4], eax
jae 0x1000781f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101273b4], eax
ret
Function at 0x100100dc
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1008353b
call fcn.1005ccdc
sub esp, 0x38
push ebx
push esi
push edi
mov eax, 0x40e4e0
mov esi, ecx
call eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
movzx eax, ax
xor ebx, ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.1000f85c
pop ecx
mov dword [ebp - 0x24], eax
mov eax, ebx
mov dword [ebp - 4], ebx
mov edi, 0xb7d0b8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
mov ebx, dword [edi]
test ebx, ebx
je 0x100101dc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebx]
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
cmp dword [eax + 0x20], 0x534030
je 0x10010188
mov eax, edi
mov dword [ebp - 0x1c], 0x78
cdq
sub eax, edx
sar eax, 1
cdq
idiv dword [ebp - 0x1c]
push eax
movzx eax, word [esi + 0x22]
push edx
push eax
push esi
lea eax, [ebp - 0x44]
push str.Entity_0x_08x__with_model__d__at_ARRAY_StreamSectors__d__d__is_invalid_n
push eax
call fcn.1000f9d8
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x10010177
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x44]
call fcn.100045b4
jmp 0x100101c9
mov ecx, dword [0x101273c8]
movzx eax, word [esi + 0x22]
push eax
mov edx, dword [ecx]
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, word [ebp - 0x18]
jne 0x100101c9
test dword [esi + 0x1c], 0x2400
jne 0x100101c9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [esi + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000f873
mov eax, dword [ebx + 4]
mov ebx, eax
test eax, eax
jne 0x10010134
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add edi, 4
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp edi, 0xb992b8
jl 0x10010127
mov edi, 0xb992c0
mov dword [ebp - 0x14], edi
mov esi, dword [edi]
test esi, esi
je 0x10010252
mov edi, dword [ebp - 0x18]
mov ebx, dword [esi]
mov ecx, dword [0x101273c8]
mov dword [ebp - 0x1c], ebx
movzx eax, word [ebx + 0x22]
mov edx, dword [ecx]
push eax
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, di
jne 0x10010248
test dword [ebx + 0x1c], 0x2400
jne 0x10010248
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [ebx + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000f873
mov esi, dword [esi + 4]
test esi, esi
jne 0x10010203
mov edi, dword [ebp - 0x14]
add edi, 0xc
mov dword [ebp - 0x14], edi
cmp edi, 0xb99ec0
jl 0x100101fa
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, eax
je 0x10010297
movzx eax, word [esi + 0xe]
push eax
mov eax, 0x4089a0
call eax
movzx eax, word [esi + 0xe]
imul eax, eax, 0x14
pop ecx
lea ecx, [ebp - 0x18]
mov byte [eax + 0x8e4cd0], 0
call fcn.1000deab
mov esi, dword [ebp - 0x18]
cmp esi, dword [ebp - 0x24]
jne 0x1001026c
lea eax, [ebp - 0x24]
push eax
mov ecx, eax
call fcn.1000f905
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x10018042
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x100831d3
call fcn.1005ccdc
sub esp, 0x20
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x10018178
push 0x10086af4
push dword [ebp + 8]
call fcn.10063b2f
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10018178
push 0xc
call fcn.1005cc97
pop ecx
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
test eax, eax
je 0x10018093
mov ecx, eax
call fcn.1000b30e
mov esi, eax
jmp 0x10018095
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x2c]
push 8
pop ecx
push ebx
xor eax, eax
push 1
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push 0x20
push eax
call fcn.10063eb4
add esp, 0x10
cmp byte [ebp - 0x2c], 0x43
jne 0x1001815c
cmp byte [ebp - 0x2b], 0x4f
jne 0x1001815c
cmp byte [ebp - 0x2a], 0x4c
jne 0x1001815c
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
call fcn.1005cc89
mov ecx, dword [ebp - 0x28]
mov edi, eax
push ebx
push 1
add ecx, 0xffffffe8
push ecx
push edi
call fcn.10063eb4
mov al, byte [ebp - 0x29]
add esp, 0x14
cmp al, 0x4c
jne 0x1001810f
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
push edi
call dword [0x100b4188]
add esp, 0xc
jmp 0x1001814a
cmp al, 0x32
jne 0x1001812c
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
push edi
call dword [0x100b418c]
jmp 0x10018147
cmp al, 0x33
jne 0x1001814a
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
push edi
call dword [0x100b4190]
add esp, 0x10
push edi
call fcn.1005ccd5
push ebx
call fcn.1006351f
pop ecx
pop ecx
mov eax, esi
jmp 0x1001817a
test esi, esi
je 0x10018171
mov ecx, esi
call fcn.1000b340
push 0xc
push esi
call fcn.1005ccc7
pop ecx
pop ecx
push ebx
call fcn.1006351f
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1002958e
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0x2c]
sub esp, 0x24
mov ecx, dword [0x104193f4]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10184650]
push ebp
push esi
push edi
cmp eax, dword [ecx + 4]
jg 0x100296b4
mov ebp, dword [esp + 0x38]
xor edi, edi
and dword [esp + 0x10], 0
inc edi
and dword [esp + 0x38], 0
mov ecx, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
test ecx, ecx
je 0x100296aa
mov esi, dword [0x1018464c]
xor edx, edx
mov eax, ebx
mov dword [esp + 0x3c], 1
div esi
sub esi, edx
cmp ecx, esi
cmovle esi, ecx
test ebx, ebx
je 0x10029637
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10029637
cmp dword [esp + 0x28], 0x1000
jne 0x10029637
test byte [esp + 0x2c], 0xee
je 0x10029637
mov ecx, dword [esp + 0x24]
cmp esi, ecx
ja 0x10029637
mov eax, ebx
sub ecx, esi
sub eax, dword [esp + 0x18]
cmp eax, ecx
jbe 0x1002965e
lea eax, [esp + 0x10]
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10029656
xor edi, edi
push esi
push edi
push ebp
call fcn.1005f5c0
jmp 0x1002966a
mov dword [esp + 0x38], 1
push esi
push ebx
push ebp
call fcn.1005f040
mov edi, dword [esp + 0x48]
add esp, 0xc
cmp dword [esp + 0x38], 0
je 0x10029696
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10029696
push ebx
push str.__page_read___could_not_restore_original_permissions_for_ptr__p
call fcn.1005b50c
pop ecx
pop ecx
mov ecx, dword [esp + 0x40]
add ebp, esi
add ebx, esi
sub ecx, esi
mov dword [esp + 0x40], ecx
jne 0x100295d6
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov esi, 0x10184650
push esi
call fcn.1005cef4
cmp dword [0x10184650], 0xffffffff
pop ecx
jne 0x100295b5
call fcn.100296e3
push esi
mov dword [0x1018464c], eax
call fcn.1005ceaa
pop ecx
jmp 0x100295b5

Function at 0x100296e3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100e141c]
sub esp, 0x24
cmp eax, 0xffffffff
jne 0x10029705
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [0x100e141c], eax
leave
ret