joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404dc8
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403484
xor eax, eax
push ebp
push 0x404eca
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004027a0
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.004027a0
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403494
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x404eb4
mov eax, dword [ebp - 0x5c]
mov dword [esi], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x54]
mov dword [eax], edx
mov dword [edi], 0x10007
push edi
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetThreadContext
lea eax, [ebp - 8]
push eax
push 4
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadProcessMemory
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
jmp 0x404e97
cmp dword [ebp - 0x68], 0x10000
je 0x404eaa
add edi, dword [ebp - 0x6c]
push 0x1c
lea eax, [ebp - 0x78]
push eax
push edi
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x404e8b
mov eax, dword [ebp + 0xc]
sub edi, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ed1
lea eax, [ebp - 4]
call fcn.00403150
ret
Function at 0x405628
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x405647
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405268
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x1048], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x1044], ecx
inc edi
cmp edi, 9
jne 0x4056a9
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1000]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.00405268
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x4056f8
add ebx, 0x400
dec edi
jne 0x4056f6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405740
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffa0
push ebx
push esi
push edi
mov byte [ebp - 0x1049], cl
mov edi, edx
mov ebx, eax
mov eax, dword [ebp + 0x14]
call fcn.00403484
lea esi, [ebp - 0x1058]
xor eax, eax
push ebp
push 0x405933
push dword fs:[eax]
mov dword fs:[eax], esp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push esi
push edi
mov esi, 0x4070cc
lea edi, [ebp - 0x1048]
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
mov esi, 0x407114
lea edi, [ebp - 0x1000]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push ebp
mov eax, dword [ebp + 0x14]
call fcn.0040329c
push eax
mov eax, dword [ebp + 0x14]
call fcn.00403494
pop edx
call fcn.00405628
pop ecx
cmp byte [ebp - 0x1049], 0
je 0x4057ee
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 1
jmp 0x405804
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x1054], 0xffffffff
shr edi, 3
dec edi
test edi, edi
jl 0x40591d
inc edi
mov dword [ebp - 0x1060], edi
cmp dword [ebp + 0x10], 0
jne 0x405821
cmp dword [ebp + 0xc], 0
je 0x40589d
mov dword [esi], 7
lea eax, [ebp + 0xc]
add eax, dword [esi]
mov dl, byte [eax]
inc edx
and dl, 0xff
mov byte [eax], dl
lea eax, [ebp + 0xc]
add eax, dword [esi]
cmp byte [eax], 0
jne 0x405847
dec dword [esi]
cmp dword [esi], 0xffffffff
jne 0x405829
lea eax, [ebp + 0xc]
mov eax, dword [eax]
call fcn.0040523c
mov dword [esi], eax
lea eax, [ebp + 0xc]
add eax, 4
mov eax, dword [eax]
call fcn.0040523c
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.00405268
pop ecx
mov eax, dword [esi]
call fcn.0040523c
xor dword [ebx], eax
mov eax, dword [ebp - 0x105c]
call fcn.0040523c
lea edx, [ebx + 4]
xor dword [edx], eax
jmp 0x40590e
cmp byte [ebp + 8], 0
jne 0x4058f5
mov edi, ebx
mov eax, dword [edi]
call fcn.0040523c
mov dword [esi], eax
lea eax, [ebx + 4]
mov eax, dword [eax]
call fcn.0040523c
mov dword [ebp - 0x105c], eax
push ebp
mov eax, dword [ebp - 0x1054]
push eax
lea edx, [ebp - 0x105c]
mov eax, esi
mov ecx, dword [ebp - 0x1050]
call fcn.00405268
pop ecx
mov eax, dword [esi]
call fcn.0040523c
mov dword [edi], eax
mov eax, dword [ebp - 0x105c]
call fcn.0040523c
lea edx, [ebx + 4]
mov dword [edx], eax
jmp 0x40590e
push ebp
mov eax, dword [ebp - 0x1054]
push eax
mov edx, ebx
lea eax, [ebx + 4]
mov ecx, dword [ebp - 0x1050]
call fcn.00405268
pop ecx
add ebx, 8
dec dword [ebp - 0x1060]
jne 0x405817
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40593a
lea eax, [ebp + 0x14]
call fcn.00403150
ret
Function at 0x405c04
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403484
xor eax, eax
push ebp
push 0x405cff
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0xa
mov eax, dword [ebp - 4]
call fcn.00403494
push eax
mov eax, dword [0x409700]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x405cd3
push ebx
mov eax, dword [0x409700]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
test esi, esi
je 0x405cd3
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov ebx, eax
test ebx, ebx
je 0x405cd3
push esi
call sub.kernel32.dll_LockResource
mov esi, eax
test esi, esi
je 0x405cd3
push ebx
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x405be4]
call fcn.00403bcc
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, ebx
mov edx, esi
call fcn.0040407c
push 0
push 0
lea eax, [ebp - 0x14]
mov edx, dword [0x408124]
call fcn.00403254
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov edx, ebx
call fcn.00405944
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, ebx
call fcn.004050f0
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d06
lea eax, [ebp - 0x14]
call fcn.00403150
lea eax, [ebp - 0x10]
mov edx, dword [0x405be4]
call fcn.00403bd8
lea eax, [ebp - 4]
call fcn.00403150
ret
Function at 0x405d30
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403484
mov eax, dword [ebp - 8]
call fcn.00403484
xor eax, eax
push ebp
push 0x405e76
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0xa
mov eax, dword [ebp - 4]
call fcn.00403494
push eax
mov eax, dword [0x409700]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x405e45
push ebx
mov eax, dword [0x409700]
push eax
call sub.kernel32.dll_LoadResource
mov esi, eax
test esi, esi
je 0x405e45
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov ebx, eax
test ebx, ebx
je 0x405e45
push esi
call sub.kernel32.dll_LockResource
mov esi, eax
test esi, esi
je 0x405e45
push ebx
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x405d10]
call fcn.00403bcc
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, ebx
mov edx, esi
call fcn.0040407c
push 0
push 0
lea eax, [ebp - 0x18]
mov edx, dword [0x408124]
call fcn.00403254
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov edx, ebx
call fcn.00405944
push 0
push 0
push 2
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00403494
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x405e45
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0x14]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x405e3f
mov byte [ebp - 9], 1
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e7d
lea eax, [ebp - 0x18]
call fcn.00403150
lea eax, [ebp - 0x14]
mov edx, dword [0x405d10]
call fcn.00403bd8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403174
ret
Function at 0x42e003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call sub.KERNEL32.DLL_SetLastError
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.24k6pweh]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.24k6pweh]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.24k6pweh]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.24k6pweh]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.24k6pweh]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.24k6pweh]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x401b7e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, 0
mov dword [esp], 0
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [esp + 4], 0x40e000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
mov eax, 0
test edi, edi
je 0x401c23
jmp 0x401bc1
mov eax, 0
jmp 0x401c23
test byte [edi + 0xc], 0x10
jne 0x401c00
inc ebx
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_realloc
mov esi, eax
test eax, eax
je 0x401bba
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [eax + ebx - 1]
mov dword [esp], eax
call sub.msvcrt.dll_fread
test byte [edi + 0xc], 0x10
je 0x401bc7
lea eax, [ebx - 1]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00401b44
mov ebx, eax
mov dword [esp], esi
call sub.msvcrt.dll_free
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov eax, ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10001f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
cmp edi, 8
jl 0x10001fff
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
shl edx, 8
or edx, eax
xor ecx, edx
mov eax, ecx
shr eax, 0x10
movzx edx, al
mov eax, ecx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x100395f0]
xor edx, dword [eax*4 + 0x100391f0]
mov eax, ecx
shr eax, 0x18
xor edx, dword [eax*4 + 0x100399f0]
movzx eax, byte [esi + 6]
xor edx, dword [eax*4 + 0x100381f0]
movzx eax, byte [esi + 5]
xor edx, dword [eax*4 + 0x100385f0]
movzx eax, byte [esi + 7]
xor edx, dword [eax*4 + 0x10037df0]
movzx eax, byte [esi + 4]
add esi, 8
xor edx, dword [eax*4 + 0x100389f0]
movzx eax, cl
xor edx, dword [eax*4 + 0x10038df0]
mov ecx, edx
sub ebx, 1
jne 0x10001f70
pop ebx
test edi, edi
je 0x1000201f
movzx eax, byte [esi]
lea esi, [esi + 1]
mov edx, ecx
shl ecx, 8
shr edx, 0x18
xor edx, eax
xor ecx, dword [edx*4 + 0x10037df0]
sub edi, 1
jne 0x10002003
pop edi
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x10013a1d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10013893

Function at 0x1001c8b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001c8dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001c8dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10001740
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
push esi
push edi
lea edi, [ebp - 0x248]
mov ecx, 0x92
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
cmp dword [0xec040500], 0
je 0x1000181f
cmp dword [0xa8ea0400], 0
je 0x1000178b
mov eax, dword [ebp + 0x14]
push eax
call fcn.1000e730
add esp, 4
cmp eax, 0x40000000
jl 0x1000181f
cmp dword [0xa8ea0400], 0
jne 0x100017a3
mov ecx, dword [0x54350500]
push ecx
call fcn.10025b60
add esp, 4
mov edx, dword [0xa8ea0400]
mov dword [ebp - 0x208], edx
mov eax, dword [ebp - 0x208]
push eax
mov ecx, dword [0x54350500]
push ecx
push 0x68010400
lea edx, [ebp - 0x200]
push edx
mov eax, dword [0xa8ea0400]
add eax, 1
mov dword [0xa8ea0400], eax
call fcn.1000e630
add esp, 0x10
mov ecx, dword [ebp + 0x14]
push ecx
push 0x64010400
lea edx, [ebp - 0x200]
push edx
call fcn.1000e4f0
add esp, 0xc
mov dword [ebp + 0x14], eax
cmp dword [ebp + 0x14], 0
jne 0x1000181f
lea eax, [ebp - 0x200]
push eax
push 0x4c010400
push 0xa84c0400
call fcn.1000e1f0
add esp, 0xc
push 1
call fcn.1000e030
cmp dword [ebp + 0x10], 0
je 0x1000188d
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000dd90
add esp, 0x10
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jg 0x1000186d
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x30010400
push 0xa84c0400
call fcn.1000e1f0
add esp, 0x10
push 1
call fcn.1000e030
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 0x204]
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp + 0xc]
imul edx, dword [ebp - 0x204]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp + 8], eax
jmp 0x1000181f
pop edi
pop esi
pop ebx
add esp, 0x248
cmp ebp, esp
call fcn.1000dd50
mov esp, ebp
pop ebp
ret
Function at 0x10002e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
lea edi, [ebp - 0x74]
mov ecx, 0x1d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
push 0x4c050400
mov eax, dword [ebp + 8]
push eax
call fcn.10011bd0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10002e99
call fcn.10011ab0
mov ecx, dword [eax]
push ecx
call fcn.10011980
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
push 0x30050400
push 0xa84c0400
call fcn.1000e1f0
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x10003051
cmp dword [ebp - 8], 0x7fff
jle 0x10002ebb
mov dword [ebp - 0x20], 0x8000
jmp 0x10002ec1
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, 0x7ff
and eax, 0xfffff800
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
push 0x946a0400
call fcn.100110a0
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
push 0x946a0400
call fcn.10011770
add esp, 0x10
test eax, eax
jne 0x10002f22
mov ecx, dword [ebp + 8]
push ecx
push 0x14050400
push 0xa84c0400
call fcn.1000e1f0
add esp, 0xc
push 1
call fcn.1000e030
xor edx, edx
cmp dword [ebp - 8], 0x8000
setle dl
push edx
push 8
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp - 0xc]
push ecx
push 0x946a0400
call fcn.100010dc
add esp, 0x18
mov eax, dword [ebp - 0xc]
cdq
and edx, 0x7ff
add eax, edx
sar eax, 0xb
mov edx, dword [0xb4ea0400]
add edx, eax
mov dword [0xb4ea0400], edx
cmp dword [0x104c0400], 0
jle 0x10003043
mov ecx, dword [0x144c0400]
neg ecx
sbb ecx, ecx
and ecx, 0xffffee6c
add ecx, 0x1388
mov eax, dword [0xb4ea0400]
xor edx, edx
div ecx
mov ecx, edx
mov eax, dword [ebp - 0xc]
cdq
and edx, 0x7ff
add eax, edx
sar eax, 0xb
cmp ecx, eax
jge 0x10003043
lea edx, [ebp - 0x10]
push edx
call fcn.100115e0
add esp, 4
mov eax, dword [0xb4ea0400]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
fild qword [ebp - 0x28]
mov ecx, dword [0x8c040500]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0
fild qword [ebp - 0x30]
fmul qword [0x8050400]
fdivp st(1)
fstp qword [ebp - 0x1c]
fild dword [0x243f0500]
mov edx, dword [ebp - 0x10]
sub edx, dword [0x243f0500]
mov dword [ebp - 0x34], edx
fild dword [ebp - 0x34]
fdiv qword [ebp - 0x1c]
faddp st(1)
call fcn.10011c9c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.100115b0
add esp, 4
push eax
fld qword [ebp - 0x1c]
fmul qword [0xf8040400]
sub esp, 8
fstp qword [esp]
push 0xcc040400
push 0xa84c0400
call fcn.1000e1f0
add esp, 0x14
push 0xa84c0400
call fcn.10011300
add esp, 4
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jmp 0x10002e9f
mov edx, dword [ebp - 4]
push edx
call fcn.100111b0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x74
cmp ebp, esp
call fcn.1000dd50
mov esp, ebp
pop ebp
ret
Function at 0x1000c250
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
lea edi, [ebp - 0x44]
mov ecx, 0x11
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0xc], 0
je 0x1000c28a
push 0x9c0d0400
push 0xa84c0400
call fcn.1000e1f0
add esp, 8
push 1
call fcn.1000e030
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x18]
push edx
call fcn.1000f4b0
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.1000f4b0
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
cmp edx, dword [ebp + 0xc]
jne 0x1000c2d4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov dword [eax + 4], edx
jmp 0x1000c326
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 4], ecx
jmp 0x1000c2e7
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0
je 0x1000c307
mov edx, dword [ebp - 4]
mov eax, dword [edx]
cmp eax, dword [ebp + 0xc]
jne 0x1000c305
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ecx], eax
jmp 0x1000c307
jmp 0x1000c2df
cmp dword [ebp - 4], 0
jne 0x1000c326
push 0x600d0400
push 0xa84c0400
call fcn.1000e1f0
add esp, 8
push 1
call fcn.1000e030
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1000f4b0
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x44
cmp ebp, esp
call fcn.1000dd50
mov esp, ebp
pop ebp
ret