joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030814
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003091c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10030904
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10030902
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100308a3
mov ecx, dword [ebp - 8]
call fcn.1003deca
movzx eax, al
test eax, eax
jne 0x10030902
push 0x1653
push 0x6146
push 0x649e
push 0x44
push dword [ebp - 4]
push dword [ebp - 8]
push 0x3f1e
push 0xb19
push 0x4969
push 0x29a1
push 1
push 1
push 1
push 0x5ef
push 0x5953
push dword [ebp - 0x34]
call fcn.1002d88d
add esp, 0x40
push 0x2697
push dword [ebp - 0xc]
push 1
push 0x2ec7
push 0
call fcn.1002e264
add esp, 0x14
jmp 0x1003091a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x10030939
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
push 0x6072
push 0
push 0x731c
push dword [ebp - 0x38]
call fcn.10033429
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10003be4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10003c5c
cmp byte [esi + 0x3d], 0
je 0x10003c5c
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10003c2e
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10003c32
sub eax, 1
je 0x10003c36
dec eax
sub eax, 1
je 0x10003c5c
xor al, al
jmp 0x10003c5e
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10003c53
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10057c77
add esp, 0x10
cmp edi, eax
jne 0x10003c2e
cmp byte [esi + 0x3d], 0
sete al
jmp 0x10003c5e
mov al, 1
pop edi
pop esi
leave
ret

Function at 0x100057d4
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x100057ee
xor eax, eax
jmp 0x100058bc
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x1000581c
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x1000581c
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x100058bb
cmp dword [esi + 0x4c], 0
je 0x100058b9
mov ecx, esi
call fcn.100040f2
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x10005848
push dword [esi + 0x4c]
push eax
call fcn.10001fe0
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x100058b9
mov byte [esp + 0x10], al
lea eax, [esp + 0x3c]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x100058b9
cmp eax, 1
jle 0x1000588a
cmp eax, 3
jne 0x100058b9
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x1000583a
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x18]
sub ebp, eax
je 0x100058a9
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.10057c77
add esp, 0x10
cmp ebp, eax
jne 0x100058b9
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x100058bb
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x10006573
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x10006594
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.1000664c
jmp 0x10006646
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ecx, dword [eax]
mov dword [esp + 0x10], ebx
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x10], esi
test ecx, ecx
je 0x100065b7
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x100065b9
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test ebx, ebx
jl 0x10006637
jg 0x100065cc
test esi, esi
je 0x10006637
test eax, eax
jl 0x10006608
jg 0x100065d6
test ebp, ebp
je 0x10006608
cmp ebx, eax
jg 0x100065e6
jl 0x100065e0
cmp esi, ebp
jae 0x100065e6
mov ebp, esi
mov dword [esp + 0x20], ebx
push ebp
push ecx
push dword [esp + 0x24]
call fcn.100523e0
mov eax, dword [edi + 0x2c]
add esp, 0xc
add dword [esp + 0x1c], ebp
sub esi, ebp
sbb ebx, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [edi + 0x1c]
add dword [eax], ebp
mov ebp, dword [esp + 0x1c]
test ebx, ebx
jl 0x10006637
jg 0x10006616
test esi, esi
je 0x10006637
cmp dword [edi + 0x4c], 0
je 0x10006637
mov ecx, edi
call fcn.100040f2
push dword [edi + 0x4c]
push esi
push 1
push ebp
call fcn.1005760a
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
pop esi
pop ebp
sbb edx, ebx
pop ebx
pop edi
pop ecx
pop ecx
ret 0xc

Function at 0x10006720
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10006741
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.100067f6
jmp 0x100067f0
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10006764
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10006766
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100067e1
jg 0x10006779
test esi, esi
je 0x100067e1
test eax, eax
jl 0x100067b9
jg 0x10006783
test ebp, ebp
je 0x100067b9
cmp edi, eax
jg 0x10006793
jl 0x1000678d
cmp esi, ebp
jae 0x10006793
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call fcn.100523e0
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebx + 0x30]
add ecx, ebp
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
jmp 0x100067bd
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x100067e1
jg 0x100067c7
test esi, esi
je 0x100067e1
cmp dword [ebx + 0x4c], 0
je 0x100067e1
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.10057c77
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc
Function at 0x10010000
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x10074ce5
call fcn.100500cc
sub esp, 0x38
push ebx
push esi
push edi
mov eax, 0x40e4e0
mov esi, ecx
call eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
xor ebx, ebx
movzx eax, ax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.100103a9
mov dword [ebp - 0x24], eax
mov eax, ebx
mov dword [ebp - 4], ebx
mov ebx, 0xb7d0b8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ebx
mov edi, dword [ebx]
test edi, edi
je 0x100100fe
mov ebx, dword [ebp - 0x10]
mov esi, dword [edi]
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
cmp dword [eax + 0x20], 0x534030
je 0x100100a5
mov eax, ebx
cdq
sub eax, edx
push 0x78
pop ecx
sar eax, 1
cdq
idiv ecx
push eax
movzx eax, word [esi + 0x22]
push edx
push eax
push esi
lea eax, [ebp - 0x44]
push str.Entity_0x_08x__with_model__d__at_ARRAY_StreamSectors__d__d__is_invalid_n
push eax
call fcn.1000f8d5
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x10010094
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x44]
call fcn.100041ad
jmp 0x100100eb
mov ecx, dword [0x101173d4]
movzx eax, word [esi + 0x22]
push eax
mov edx, dword [ecx]
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, word [ebp - 0x18]
jne 0x100100eb
test dword [esi + 0x1c], 0x2400
jne 0x100100eb
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [esi + 0x22]
lea ecx, [ebp - 0x24]
push dword [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.1000f768
mov eax, dword [edi + 4]
mov edi, eax
test eax, eax
jne 0x10010056
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add ebx, 4
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ebx
cmp ebx, 0xb992b8
jl 0x10010049
mov edi, 0xb992c0
mov dword [ebp - 0x14], edi
mov esi, dword [edi]
test esi, esi
je 0x10010179
mov edi, dword [ebp - 0x18]
mov ebx, dword [esi]
mov ecx, dword [0x101173d4]
mov dword [ebp - 0x1c], ebx
movzx eax, word [ebx + 0x22]
mov edx, dword [ecx]
push eax
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, di
jne 0x1001016f
test dword [ebx + 0x1c], 0x2400
jne 0x1001016f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [ebx + 0x22]
lea ecx, [ebp - 0x24]
push dword [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
call fcn.1000f768
mov esi, dword [esi + 4]
test esi, esi
jne 0x10010125
mov edi, dword [ebp - 0x14]
add edi, 0xc
mov dword [ebp - 0x14], edi
cmp edi, 0xb99ec0
jl 0x1001011c
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, eax
je 0x100101be
movzx eax, word [esi + 0xe]
push eax
mov eax, 0x4089a0
call eax
movzx eax, word [esi + 0xe]
imul eax, eax, 0x14
pop ecx
lea ecx, [ebp - 0x18]
mov byte [eax + 0x8e4cd0], 0
call fcn.1000daa6
mov esi, dword [ebp - 0x18]
cmp esi, dword [ebp - 0x24]
jne 0x10010193
lea ecx, [ebp - 0x24]
call fcn.1000f916
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x100180dc
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x100749d7
call fcn.100500cc
sub esp, 0x20
cmp dword [ebp + 8], 0
jne 0x100180f6
xor eax, eax
jmp 0x10018219
push ebx
push 0x1007b414
push dword [ebp + 8]
call fcn.1005f87a
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10018218
push esi
push 0xc
call fcn.1005008d
pop ecx
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
test eax, eax
je 0x1001812f
mov ecx, eax
call fcn.1000adcf
mov esi, eax
jmp 0x10018131
xor esi, esi
or dword [ebp - 4], 0xffffffff
xor eax, eax
push edi
push 8
pop ecx
push ebx
lea edi, [ebp - 0x2c]
push 1
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push 0x20
push eax
call fcn.1005760a
add esp, 0x10
cmp byte [ebp - 0x2c], 0x43
jne 0x100181f8
cmp byte [ebp - 0x2b], 0x4f
jne 0x100181f8
cmp byte [ebp - 0x2a], 0x4c
jne 0x100181f8
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
call fcn.10050084
mov ecx, dword [ebp - 0x28]
mov edi, eax
push ebx
push 1
add ecx, 0xffffffe8
push ecx
push edi
call fcn.1005760a
mov al, byte [ebp - 0x29]
add esp, 0x14
cmp al, 0x4c
jne 0x100181ac
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
push edi
call dword [0x100a5210]
add esp, 0xc
jmp 0x100181e7
cmp al, 0x32
jne 0x100181c9
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
push edi
call dword [0x100a5214]
jmp 0x100181e4
cmp al, 0x33
jne 0x100181e7
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
push edi
call dword [0x100a5218]
add esp, 0x10
push edi
call fcn.100500ec
push ebx
call fcn.10056db1
pop ecx
mov eax, esi
jmp 0x10018215
test esi, esi
je 0x1001820d
mov ecx, esi
call fcn.1000ae01
push 0xc
push esi
call fcn.100500bd
pop ecx
pop ecx
push ebx
call fcn.10056db1
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100299de
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101885a8]
push ebx
push ebp
push esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10159508]
push edi
cmp eax, dword [ecx + 4]
jg 0x10029abf
mov ebx, dword [esp + 0x18]
xor eax, eax
and dword [esp + 0x10], 0
inc eax
and dword [esp + 0x18], 0
mov ebp, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
test ebp, ebp
je 0x10029ab9
mov esi, dword [0x10159504]
xor edx, edx
mov eax, edi
mov dword [esp + 0x1c], 1
div esi
sub esi, edx
cmp ebp, esi
cmovle esi, ebp
push esi
push edi
call fcn.1002a552
pop ecx
pop ecx
test al, al
je 0x10029a75
lea eax, [esp + 0x10]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10029a6d
and dword [esp + 0x1c], eax
push esi
push eax
push ebx
call fcn.10052960
jmp 0x10029a7d
mov dword [esp + 0x18], 1
push esi
push edi
push ebx
call fcn.100523e0
add esp, 0xc
cmp dword [esp + 0x18], 0
je 0x10029aa9
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10029aa9
push edi
push str.__page_read___could_not_restore_original_permissions_for_ptr__p
call fcn.1004e50c
pop ecx
pop ecx
add ebx, esi
add edi, esi
sub ebp, esi
jne 0x10029a24
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov esi, 0x10159508
push esi
call fcn.10050654
cmp dword [0x10159508], 0xffffffff
pop ecx
jne 0x10029a03
call fcn.10029aee
push esi
mov dword [0x10159504], eax
call fcn.1005060a
pop ecx
jmp 0x10029a03

Function at 0x10029aee
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100d2648]
sub esp, 0x24
cmp eax, 0xffffffff
jne 0x10029b10
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [0x100d2648], eax
leave
ret
Function at 0x10029b12
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101885a8]
push ebx
push ebp
push esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10159500]
push edi
cmp eax, dword [ecx + 4]
jg 0x10029be3
mov edi, dword [esp + 0x18]
xor ebp, ebp
and dword [esp + 0x10], 0
inc ebp
and dword [esp + 0x18], 0
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x10029bdb
mov esi, dword [0x101594fc]
xor edx, edx
mov eax, edi
xor ebp, ebp
div esi
inc ebp
sub esi, edx
cmp ebx, esi
cmovle esi, ebx
push esi
push edi
call fcn.1002a568
pop ecx
pop ecx
test al, al
je 0x10029b96
lea eax, [esp + 0x10]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10029b8e
xor ebp, ebp
jmp 0x10029ba4
mov dword [esp + 0x18], 1
push esi
push dword [esp + 0x20]
push edi
call fcn.100523e0
add esp, 0xc
cmp dword [esp + 0x18], 0
je 0x10029bcd
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10029bcd
push edi
push str.__page_write___could_not_restore_original_permissions_for_ptr__p
call fcn.1004e50c
pop ecx
pop ecx
add dword [esp + 0x1c], esi
add edi, esi
sub ebx, esi
jne 0x10029b54
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
mov esi, 0x10159500
push esi
call fcn.10050654
cmp dword [0x10159500], 0xffffffff
pop ecx
jne 0x10029b37
call fcn.10029aee
push esi
mov dword [0x101594fc], eax
call fcn.1005060a
pop ecx
jmp 0x10029b37
Function at 0x1003ddbe
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp + 4]
mov cl, byte [edx]
test cl, cl
je 0x1003ddea
cmp byte [edx + 1], 0
jne 0x1003ddea
cmp cl, 0x61
jl 0x1003dddf
cmp cl, 0x7a
jg 0x1003dddf
movsx eax, cl
sub eax, 0x20
ret
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x1003ddea
movsx eax, cl
ret
cmp cl, 0x26
jne 0x1003ddfa
lea eax, [edx + 1]
push eax
call fcn.1003de58
pop ecx
ret
mov eax, dword [0x100d509c]
xor ecx, ecx
push ebx
push esi
jmp 0x1003de38
mov esi, edx
mov bl, byte [eax]
cmp bl, byte [esi]
jne 0x1003de27
test bl, bl
je 0x1003de23
mov bl, byte [eax + 1]
cmp bl, byte [esi + 1]
jne 0x1003de27
add eax, 2
add esi, 2
test bl, bl
jne 0x1003de07
xor eax, eax
jmp 0x1003de2c
sbb eax, eax
or eax, 1
test eax, eax
je 0x1003de4f
mov eax, dword [ecx*8 + 0x100d50a4]
inc ecx
test eax, eax
jne 0x1003de05
push edx
push str.Unknown_key:__s
call fcn.1004e50c
pop ecx
pop ecx
or eax, 0xffffffff
pop esi
pop ebx
ret
mov eax, dword [ecx*8 + 0x100d5098]
jmp 0x1003de4c

Function at 0x1003e6c6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
sub ecx, eax
push 3
pop edx
movss xmm0, dword [ecx + eax]
xorps xmm0, xmmword [0x1007d440]
movss dword [eax], xmm0
lea eax, [eax + 4]
sub edx, 1
jne 0x1003e6d3
ret
Function at 0x100423a3
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x100764bf
call fcn.100500cc
sub esp, 0x2d0
cmp dword [0x1017aacc], 0
je 0x1004255e
call fcn.1002a149
test eax, eax
jne 0x1004255e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x10188064]
add ecx, 0x3e8
cmp eax, ecx
jbe 0x1004255e
push 1
lea ecx, [ebp - 0xdc]
call fcn.10002528
xor eax, eax
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x24], al
push str.Enemys.ini
push 0x10188090
push str._scandy_sa_s
lea eax, [ebp - 0x2dc]
mov byte [ebp - 4], 1
push 0x200
push eax
call fcn.100068fa
add esp, 0x14
lea eax, [ebp - 0x2dc]
lea ecx, [ebp - 0xdc]
push 0x40
push 1
push eax
call fcn.1000573e
mov eax, dword [0x10151388]
push 0x29c8
add eax, 0x2ae1
push 0
push eax
call fcn.10052960
and dword [0x10188060], 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.10001aea
add esp, 0x14
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x10042535
push esi
push edi
mov ecx, dword [0x1017aacc]
xor esi, esi
movzx eax, word [ecx]
cmp eax, esi
je 0x100424dd
cmp dword [ecx + esi*4 + 0x26], 0
je 0x100424dd
cmp dword [ebp - 0x10], 0x10
lea edi, [ebp - 0x24]
push esi
cmovae edi, dword [ebp - 0x24]
call fcn.1003f377
pop ecx
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x100424ce
test cl, cl
je 0x100424ca
mov cl, byte [edi + 1]
cmp cl, byte [eax + 1]
jne 0x100424ce
add edi, 2
add eax, 2
test cl, cl
jne 0x100424ae
xor eax, eax
jmp 0x100424d3
sbb eax, eax
or eax, 1
test eax, eax
je 0x100424e8
mov ecx, dword [0x1017aacc]
inc esi
cmp esi, 0x3ec
jl 0x1004248e
jmp 0x10042511
mov ecx, dword [0x10188060]
mov eax, dword [0x10151388]
mov dword [eax + ecx*4 + 0x3fc5], esi
inc ecx
mov eax, dword [0x10151388]
mov dword [0x10188060], ecx
mov dword [eax + esi*4 + 0x2ae1], 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.10001aea
pop ecx
pop ecx
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x10042486
pop edi
pop esi
lea ecx, [ebp - 0xdc]
call fcn.10004851
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x24]
mov dword [0x10188064], eax
call fcn.100041ad
lea ecx, [ebp - 0xdc]
call fcn.10002eb7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x100428b6
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x100764bf
call fcn.100500cc
sub esp, 0x2d0
cmp dword [0x1017aacc], 0
je 0x10042a71
call fcn.1002a149
test eax, eax
jne 0x10042a71
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1018805c]
add ecx, 0x3e8
cmp eax, ecx
jbe 0x10042a71
push 1
lea ecx, [ebp - 0xdc]
call fcn.10002528
xor eax, eax
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x24], al
push str.Friends.ini
push 0x10188090
push str._scandy_sa_s
lea eax, [ebp - 0x2dc]
mov byte [ebp - 4], 1
push 0x200
push eax
call fcn.100068fa
add esp, 0x14
lea eax, [ebp - 0x2dc]
lea ecx, [ebp - 0xdc]
push 0x40
push 1
push eax
call fcn.1000573e
mov eax, dword [0x10151388]
push 0x29c8
add eax, 0x115
push 0
push eax
call fcn.10052960
and dword [0x10188058], 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.10001aea
add esp, 0x14
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x10042a48
push esi
push edi
mov ecx, dword [0x1017aacc]
xor esi, esi
movzx eax, word [ecx]
cmp eax, esi
je 0x100429f0
cmp dword [ecx + esi*4 + 0x26], 0
je 0x100429f0
cmp dword [ebp - 0x10], 0x10
lea edi, [ebp - 0x24]
push esi
cmovae edi, dword [ebp - 0x24]
call fcn.1003f377
pop ecx
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x100429e1
test cl, cl
je 0x100429dd
mov cl, byte [edi + 1]
cmp cl, byte [eax + 1]
jne 0x100429e1
add edi, 2
add eax, 2
test cl, cl
jne 0x100429c1
xor eax, eax
jmp 0x100429e6
sbb eax, eax
or eax, 1
test eax, eax
je 0x100429fb
mov ecx, dword [0x1017aacc]
inc esi
cmp esi, 0x3ec
jl 0x100429a1
jmp 0x10042a24
mov ecx, dword [0x10188058]
mov eax, dword [0x10151388]
mov dword [eax + ecx*4 + 0x15f9], esi
inc ecx
mov eax, dword [0x10151388]
mov dword [0x10188058], ecx
mov dword [eax + esi*4 + 0x115], 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.10001aea
pop ecx
pop ecx
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x10042999
pop edi
pop esi
lea ecx, [ebp - 0xdc]
call fcn.10004851
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x24]
mov dword [0x1018805c], eax
call fcn.100041ad
lea ecx, [ebp - 0xdc]
call fcn.10002eb7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x10042f34
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1fc
push ebp
push esi
push str.LoadSpriteTexture__
call fcn.1004e932
pop ecx
mov ecx, dword [0x10182770]
xor ebp, ebp
mov esi, ebp
test ecx, ecx
je 0x10042f5b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [0x1018276c]
mov edx, 0x100
push ebp
push 0x10182770
push 1
push 0x15
push ebp
push 1
push edx
mov dword [0x10182770], ebp
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x5c]
test eax, eax
jns 0x10042f8b
push str.Failed_to_create_sprite_texture_
jmp 0x10042fef
push str.candy_sa.raw
push 0x10188090
push str._scandy_sa_s
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.100068fa
lea eax, [esp + 0x24]
push 0x1007b414
push eax
call fcn.1005f87a
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x10042fd3
lea eax, [esp + 0x10]
push eax
push str.Failed_to_open__s_
call fcn.1004e50c
pop ecx
jmp 0x10042ff4
mov eax, dword [0x10182770]
lea edx, [esp + 8]
push ebp
push ebp
push edx
mov ecx, dword [eax]
push ebp
push eax
call dword [ecx + 0x4c]
test eax, eax
jns 0x10043018
push str.Failed_to_lock_texture_
call fcn.1004e50c
pop ecx
mov ecx, dword [0x10182770]
test ecx, ecx
je 0x1004300b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x10182770], ebp
test esi, esi
je 0x10043082
push esi
call fcn.10056db1
pop ecx
jmp 0x10043082
push ebx
push edi
mov edi, dword [esp + 0x14]
push 0x78
pop ebx
push esi
push 1
lea eax, [esp + 0x124]
push 0xf0
push eax
call fcn.1005760a
add esp, 0x10
lea edx, [edi + 2]
mov cl, byte [esp + ebp + 0x11c]
mov al, cl
shl cl, 5
and al, 0xf8
mov byte [edx + 1], cl
inc ebp
mov byte [edx - 2], al
mov byte [edx - 1], al
mov byte [edx], al
lea edx, [edx + 4]
cmp ebp, 0xf0
jl 0x1004303c
add edi, dword [esp + 0x10]
push 0
pop ebp
sub ebx, 1
jne 0x10043021
mov eax, dword [0x10182770]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
push esi
call fcn.10056db1
pop ecx
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x1fc
ret