joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10078680
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100f2010]
xor eax, ebp
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x100f4260]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100786ce
mov eax, dword [ebp - 0x10]
sub eax, 5
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 8]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100786f0
mov eax, 0xa
jmp 0x100787db
cmp dword [ebp + 0xc], 0
je 0x1007873c
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x10]
add ecx, 5
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 0xc]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x1007873a
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x1c]
mov byte [edx + 1], 0xf9
jmp 0x1007877c
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10078769
mov eax, dword [ebp - 0xc]
add eax, 0xc
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax]
mov dword [ecx], edx
mov dx, word [eax + 4]
mov word [ecx + 4], dx
mov al, byte [eax + 6]
mov byte [ecx + 6], al
jmp 0x1007877c
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov dword [edx], eax
mov cl, byte [ecx + 4]
mov byte [edx + 4], cl
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 1
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 0xfd
or cl, dl
mov edx, dword [ebp - 0xc]
mov byte [edx + 0x14], cl
mov al, byte [ebp + 0xc]
and al, 1
shl al, 2
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfb
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10084889
mov esp, ebp
pop ebp
ret
Function at 0x10078e70
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10078eb9
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x10078eb9
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x10078eb9
xor eax, eax
jmp 0x10078efa
mov dword [ebp - 4], 1
jmp 0x10078ecb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10078ef5
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x10078ef3
xor eax, eax
jmp 0x10078efa
jmp 0x10078ec2
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x1007ba20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100f2010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x10], 0
jg 0x1007ba4a
jl 0x1007ba41
cmp dword [ebp + 0xc], 0
ja 0x1007ba4a
xor eax, eax
xor edx, edx
jmp 0x1007bb8b
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x38], 0
je 0x1007ba6c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.1007c4c0
jmp 0x1007bb8b
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
call fcn.1007d760
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x1007badb
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
call fcn.1007bba0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.1007d8c0
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.1007e3d0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.1007d840
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x4c], 0
je 0x1007bb7c
mov ecx, dword [ebp - 0x10]
call fcn.1007d260
mov dword [ebp - 0x2c], 0xfff
cmp dword [ebp - 8], 0xfff
jbe 0x1007bb4b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1008db2a
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x18]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 0x18], 0xfff
je 0x1007bb49
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x1007bb8b
jmp 0x1007baf7
cmp dword [ebp - 8], 0
jbe 0x1007bb7c
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.1008db2a
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10084889
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1007c060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x100f2010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x38], ecx
call fcn.1007e2f0
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x50]
push ecx
call fcn.1007e350
add esp, 8
movzx edx, al
test edx, edx
je 0x1007c0a4
lea eax, [ebp + 8]
push eax
call fcn.1007e300
add esp, 4
jmp 0x1007c235
mov ecx, dword [ebp - 0x38]
call fcn.1007d8a0
test eax, eax
je 0x1007c0ea
mov ecx, dword [ebp - 0x38]
call fcn.1007d8a0
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.1007d820
cmp esi, eax
jae 0x1007c0ea
lea ecx, [ebp + 8]
push ecx
call fcn.1007c250
add esp, 4
mov byte [ebp - 0x39], al
mov ecx, dword [ebp - 0x38]
call fcn.1007d6d0
mov dl, byte [ebp - 0x39]
mov byte [eax], dl
mov eax, dword [ebp + 8]
jmp 0x1007c235
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x4c], 0
jne 0x1007c0fd
call fcn.1007e2f0
jmp 0x1007c235
mov ecx, dword [ebp - 0x38]
call fcn.1007d260
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x38], 0
jne 0x1007c156
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x54], eax
lea ecx, [ebp + 8]
push ecx
call fcn.1007c250
add esp, 4
mov byte [ebp - 0x3a], al
mov edx, dword [ebp - 0x54]
push edx
movzx eax, byte [ebp - 0x3a]
push eax
call fcn.1007ac60
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1007c146
mov edx, dword [ebp + 8]
mov dword [ebp - 0x48], edx
jmp 0x1007c14e
call fcn.1007e2f0
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x1007c235
mov dword [ebp - 0x5c], 0x20
lea eax, [ebp + 8]
push eax
call fcn.1007c250
add esp, 4
mov byte [ebp - 0x2a], al
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x58], edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x29]
push ecx
lea edx, [ebp - 0x2a]
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x58]
call fcn.1007d180
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x1007c1b3
cmp dword [ebp - 0x40], 1
je 0x1007c1b3
cmp dword [ebp - 0x40], 3
je 0x1007c200
jmp 0x1007c230
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x44], ecx
je 0x1007c1e5
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x44]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.1008d737
add esp, 0x10
cmp dword [ebp - 0x44], eax
je 0x1007c1e5
call fcn.1007e2f0
jmp 0x1007c235
mov ecx, dword [ebp - 0x38]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2a]
cmp dword [ebp - 0x34], edx
je 0x1007c1f9
mov eax, dword [ebp + 8]
jmp 0x1007c235
call fcn.1007e2f0
jmp 0x1007c235
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2a]
push edx
call fcn.1007ac60
add esp, 8
movzx eax, al
test eax, eax
je 0x1007c223
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x4c], ecx
jmp 0x1007c22b
call fcn.1007e2f0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
jmp 0x1007c235
call fcn.1007e2f0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10084889
mov esp, ebp
pop ebp
ret 4
Function at 0x1007d2f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x100f2010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x1007d317
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1007d31e
mov al, 1
jmp 0x1007d409
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x44], edx
call fcn.1007e2f0
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
call fcn.1007e2f0
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.1007e350
add esp, 8
movzx eax, al
test eax, eax
je 0x1007d364
xor al, al
jmp 0x1007d409
mov dword [ebp - 0x54], 0x20
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x50], edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x30]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x50]
call fcn.1007e520
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x1007d3a6
cmp dword [ebp - 0x34], 1
je 0x1007d3ad
cmp dword [ebp - 0x34], 3
je 0x1007d3fc
jmp 0x1007d407
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x1007d3dc
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 0x28]
push ecx
call fcn.1008d737
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x1007d3dc
xor al, al
jmp 0x1007d409
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x1007d3f0
mov dword [ebp - 0x3c], 1
jmp 0x1007d3f7
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x1007d409
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x3d], 0
mov al, 1
jmp 0x1007d409
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10084889
mov esp, ebp
pop ebp
ret
Function at 0x100804d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x100f2010]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
jne 0x1008064b
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp - 0x110]
add edx, 1
mov dword [ebp - 0x124], edx
mov eax, dword [ebp - 0x110]
mov cl, byte [eax]
mov byte [ebp - 0x109], cl
add dword [ebp - 0x110], 1
cmp byte [ebp - 0x109], 0
jne 0x1008051c
mov edx, dword [ebp - 0x110]
sub edx, dword [ebp - 0x124]
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x118], 0x100d7ac8
mov eax, dword [ebp - 0x128]
lea ecx, [ebp + eax - 0x108]
mov edx, 1
imul eax, edx, 7
sub ecx, eax
mov dword [ebp - 0x114], ecx
mov ecx, dword [ebp - 0x114]
mov dl, byte [ecx]
mov byte [ebp - 0x10a], dl
mov eax, dword [ebp - 0x118]
cmp dl, byte [eax]
jne 0x100805d1
cmp byte [ebp - 0x10a], 0
je 0x100805c5
mov ecx, dword [ebp - 0x114]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x10b], dl
mov eax, dword [ebp - 0x118]
cmp dl, byte [eax + 1]
jne 0x100805d1
add dword [ebp - 0x114], 2
add dword [ebp - 0x118], 2
cmp byte [ebp - 0x10b], 0
jne 0x10080573
mov dword [ebp - 0x11c], 0
jmp 0x100805dc
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 0x12c], edx
cmp dword [ebp - 0x12c], 0
je 0x10080609
push 0
push 0x100d7ad0
push str.RevLimiter_has_been_loaded_into_a_process_that_is_not_LFS.exe
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x10080650
call fcn.1007ace0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x10080350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x1008064b
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10084889
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10081e10
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100f2010]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
call dword [sym.imp.urlmon.dll_URLOpenBlockingStreamA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10081e44
xor al, al
jmp 0x10081ec7
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jge 0x10081e93
push 0x100e84e8
lea ecx, [ebp - 0x24]
call fcn.10081430
push 0x100f0cd4
lea eax, [ebp - 0x24]
push eax
call fcn.100878ca
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov byte [ecx + edx], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x14], 1
je 0x10081eb7
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0xc]
jne 0x10081e4b
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 8]
call edx
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10084889
mov esp, ebp
pop ebp
ret
Function at 0x100823e0
Capabilities:
Create directory
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac026
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x100f2010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push str.revlimiter
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1008250f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xb7
je 0x1008250f
push str.Cant_create_directory_revlimiter
lea ecx, [ebp - 0x12c]
call fcn.1007cb60
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xdc]
mov dword [ebp - 0xe0], ecx
push str._nError_code:
mov ecx, dword [ebp - 0xe0]
call fcn.1007ca40
mov dword [ebp - 0xf0], eax
mov edx, dword [ebp - 0xd0]
push edx
lea eax, [ebp - 0x114]
push eax
call fcn.10079770
add esp, 8
mov dword [ebp - 0xe4], eax
mov ecx, dword [ebp - 0xe4]
mov dword [ebp - 0xe8], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xe8]
mov dword [ebp - 0xec], edx
mov eax, dword [ebp - 0xec]
push eax
mov ecx, dword [ebp - 0xf0]
call fcn.1007ca70
push eax
lea ecx, [ebp - 0xfc]
call fcn.10079710
push 0x100f0cd4
lea ecx, [ebp - 0xfc]
push ecx
call fcn.100878ca
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x114]
call fcn.1007cab0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.1007cab0
mov dword [ebp - 0x14], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 0x14], 0x49a973b7
jne 0x10082543
mov dword [ebp - 0xd4], 1
jmp 0x1008254d
mov dword [ebp - 0xd4], 0
mov al, byte [ebp - 0xd4]
mov byte [0x100f420c], al
push 0xb8
lea ecx, [ebp - 0xcc]
call fcn.1007abe0
push 1
push 0x40
push 1
push str.d3d9.dll
lea ecx, [ebp - 0xcc]
call fcn.10082b30
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0xcc]
mov edx, dword [ecx + 4]
lea ecx, [ebp + edx - 0xcc]
call fcn.1007a930
mov byte [0x100f420f], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.100823b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10084889
mov esp, ebp
pop ebp
ret

Function at 0x100825d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100f2010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x40
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 5
push 0x41eed0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x100f4208
push 0x10082640
push 0x41eed0
call fcn.10078a50
test eax, eax
je 0x1008262f
push str.Unable_to_hook_DoVehicleCalculations__
lea ecx, [ebp - 0x18]
call fcn.10081430
push 0x100f0cd4
lea edx, [ebp - 0x18]
push edx
call fcn.100878ca
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10084889
mov esp, ebp
pop ebp
ret
Function at 0x1009be7b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1009bcf1
Function at 0x1009049
Capabilities:
Delete file

Disassembly:
push dword [0x105cd28]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x100907b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x100907b
cmp eax, 2
je 0x100907b
push dword [0x105cd28]
push 0x10019a8
push 0xffffffffffffffff
call fcn.01012301
ret
Function at 0x1009e46
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp byte [0x105c540], bl
je 0x1009f83
push esi
push edi
mov edi, dword [sym.imp.msvcrt.dll_strrchr]
push 0x5c
mov esi, 0x105c540
push esi
call edi
pop ecx
pop ecx
mov dword [0x105c644], eax
cmp eax, ebx
jne 0x1009e8b
push 0x3a
push esi
call edi
pop ecx
pop ecx
cmp eax, ebx
jne 0x1009e8b
mov dword [0x105c644], esi
jmp 0x1009e91
inc eax
mov dword [0x105c644], eax
push ebx
push 0x8000000
push 3
push ebx
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1009ebc
push esi
push 0x1004614
push 0xffffffffffffffff
call fcn.01012301
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x105c64c], eax
cmp eax, 0xffffffff
jne 0x1009ed6
push esi
push 0x10045e0
jmp 0x1009eb5
cmp eax, ebx
jne 0x1009ee3
push esi
push 0x10045b8
push ebx
jmp 0x1009eb7
push eax
call fcn.0101256d
push ebx
lea ecx, [ebp - 4]
push ecx
push dword [0x105c64c]
mov dword [0x105c530], eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1009f0d
push esi
push 0x1004590
jmp 0x1009eb5
mov eax, dword [0x105c64c]
cmp dword [ebp - 4], eax
je 0x1009f27
push eax
push dword [ebp - 4]
push esi
push 0x1004538
push ebx
call fcn.01012301
push 0x105c528
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x105c644]
call dword [sym.imp.msvcrt.dll__strupr]
pop ecx
push dword [0x105c644]
call fcn.010098a5
pop edi
pop esi
push dword [0x105c644]
test eax, eax
jne 0x1009f6a
push 0x10044fc
jmp 0x1009ee0
call fcn.01009995
test eax, eax
jne 0x1009fc9
push dword [0x105c644]
push 0x10044c4
jmp 0x1009ee0
mov dword [0x105c644], 0x10044b8
mov eax, 0x1004430
cmp dword [0x105c460], ebx
jne 0x1009f9f
mov eax, 0x1004360
mov dword [0x105c530], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1009fa7
sub eax, edx
mov dword [0x105c64c], eax
mov eax, dword [0x105c420]
mov dword [0x105c528], eax
mov eax, dword [0x105c424]
mov dword [0x105c52c], eax
pop ebx
leave
ret
Function at 0x100a4a9
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x8000000
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100a4e7
push dword [ebp + 8]
push 0x10047e4
push 0xffffffffffffffff
call fcn.01012301
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0xc]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x100a507
push dword [ebp + 8]
push 0x10047ac
jmp 0x100a4e0
cmp eax, edi
jne 0x100a516
push dword [ebp + 8]
push 0x1004780
push edi
jmp 0x100a4e2
cmp eax, 0x1fffe00
ja 0x100a571
cmp dword [ebp - 4], edi
jne 0x100a571
push eax
call fcn.0101256d
push edi
lea ecx, [ebp - 8]
push ecx
push dword [esi + 8]
mov dword [esi + 0xc], eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100a549
push dword [ebp + 8]
push 0x1004750
jmp 0x100a4e0
mov esi, dword [esi + 8]
cmp dword [ebp - 8], esi
je 0x100a563
push esi
push dword [ebp - 8]
push dword [ebp + 8]
push 0x10046f0
push edi
call fcn.01012301
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 8
push dword [ebp + 8]
push 0x10046b8
jmp 0x100a513

Function at 0x100a88d
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
push edi
push edi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
push 1
push edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x100a8c0
xor eax, eax
jmp 0x100a925
push ebx
mov ebx, dword [ebp + 0x14]
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0x18]
mov dword [ebp + 0x10], edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
cmp esi, edi
jne 0x100a909
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x100a918
push 1
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov esi, eax
cmp esi, edi
je 0x100a918
cmp dword [ebp + 0x10], ebx
je 0x100a918
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret 0x14
Function at 0x1012261
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x100
cmp dword [ebp + 8], 0xffffffff
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [0x101c158], 1
jne 0x101228e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
push 0x101c140
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [sym.imp.msvcrt.dll_printf]
push 0x1006a0c
call esi
mov eax, dword [sym.imp.msvcrt.dll__iob]
push ebx
add eax, 0x20
push edi
push eax
call dword [sym.imp.msvcrt.dll_vfprintf]
add esp, 0x10
cmp dword [ebp + 8], 0
je 0x10122de
push 0x100
lea eax, [ebp - 0x100]
push eax
push dword [ebp + 8]
call fcn.010121ab
push eax
push 0x1005964
call esi
pop ecx
pop ecx
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push eax
call dword [sym.imp.msvcrt.dll_fflush]
pop ecx
call fcn.0101218d
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]