joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ea960
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
push 0xe
mov ecx, 0x104e2ce0
call fcn.100b6e90
movzx eax, al
test eax, eax
jne 0x100ea98c
xor al, al
jmp 0x100eab2f
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x30], 0x21
mov dword [ebp - 0x2c], 0x22
mov dword [ebp - 0x28], 0x23
mov dword [ebp - 0x24], 0x24
mov dword [ebp - 0x20], 0x25
mov dword [ebp - 0x1c], 0x26
mov dword [ebp - 4], 0
jmp 0x100ea9cf
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 7
jge 0x100eaa95
mov edx, dword [ebp - 4]
movzx eax, word [ebp + edx*4 - 0x34]
push eax
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx ecx, al
test ecx, ecx
je 0x100eaa90
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x34]
shl eax, 6
movzx ecx, byte [eax + 0x104e2d9d]
test ecx, ecx
je 0x100eaa90
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x34]
shl eax, 6
mov ecx, dword [ebp - 8]
sub ecx, dword [eax + 0x104e2d98]
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0x201
jne 0x100eaa47
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x34]
shl eax, 6
mov byte [eax + 0x104e2d9c], 1
mov al, 1
jmp 0x100eab2f
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*4 - 0x34]
shl edx, 6
mov byte [edx + 0x104e2d9c], 0
cmp dword [ebp - 0x10], 0x1f4
jae 0x100eaa68
xor al, al
jmp 0x100eab2f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0x34]
shl ecx, 6
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x104e2d98], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100eab40
jmp 0x100ea9c6
push 0x27
mov ecx, 0x104e2ce0
call fcn.100b6f20
movzx ecx, al
test ecx, ecx
je 0x100eab2d
mov edx, 0x40
imul eax, edx, 0x27
movzx ecx, byte [eax + 0x104e2d9d]
test ecx, ecx
jne 0x100eaac3
xor al, al
jmp 0x100eab2f
mov edx, 0x40
imul eax, edx, 0x27
mov ecx, dword [ebp - 8]
sub ecx, dword [eax + 0x104e2d98]
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0x201
jne 0x100eaaf3
mov edx, 0x40
imul eax, edx, 0x27
mov byte [eax + 0x104e2d9c], 1
mov al, 1
jmp 0x100eab2f
mov ecx, 0x40
imul edx, ecx, 0x27
mov byte [edx + 0x104e2d9c], 0
cmp dword [ebp - 0x18], 0x1f4
jae 0x100eab0f
xor al, al
jmp 0x100eab2f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x27
mov dword [edx + 0x104e2d98], eax
push 7
mov ecx, dword [ebp - 0xc]
call fcn.100eab40
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x100eafb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], ecx
push 0
push 0x80
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x100eafef
xor al, al
jmp 0x100eb130
push 0
lea ecx, [ebp - 0x18]
push ecx
push 6
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx ecx, word [ebp - 0x20]
movzx edx, word [ebp + 0xc]
cmp ecx, edx
jne 0x100eb017
cmp dword [ebp - 0x1e], 0x36
je 0x100eb028
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100eb130
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
jne 0x100eb03b
mov edx, dword [ebp - 0x34]
add edx, 4
mov dword [ebp - 0x38], edx
jmp 0x100eb044
mov eax, dword [ebp - 0x34]
add eax, 0x34
mov dword [ebp - 0x38], eax
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0x10
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x28], 0
jmp 0x100eb06c
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 4
jge 0x100eb08e
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + edx*4 + 0x64]
xor edx, dword [ebp + ecx*4 - 0x14]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + eax*4], edx
jmp 0x100eb063
push 0
lea edx, [ebp - 0x18]
push edx
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x2c], 0
jmp 0x100eb0b6
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 4
jge 0x100eb0d9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ecx + eax*4 + 0x64]
xor eax, dword [ebp + edx*4 - 0x14]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x38]
mov dword [edx + ecx*4 + 0x10], eax
jmp 0x100eb0ad
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x30], 0
jmp 0x100eb101
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x100eb124
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov ecx, dword [edx + ecx*4 + 0x64]
xor ecx, dword [ebp + eax*4 - 0x14]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov dword [eax + edx*4 + 0x20], ecx
jmp 0x100eb0f8
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100f37e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 7
mov ecx, 0x104e2ce0
call fcn.100b6e90
movzx eax, al
test eax, eax
jne 0x100f3875
push 8
mov ecx, 0x104e2ce0
call fcn.100b6e90
movzx ecx, al
test ecx, ecx
jne 0x100f3875
push 0xc
mov ecx, 0x104e2ce0
call fcn.100b6e90
movzx edx, al
test edx, edx
jne 0x100f3875
push 0xe
mov ecx, 0x104e2ce0
call fcn.100b6e90
movzx eax, al
test eax, eax
jne 0x100f3875
push 0xf
mov ecx, 0x104e2ce0
call fcn.100b6e90
movzx ecx, al
test ecx, ecx
jne 0x100f3875
push 0x41
mov ecx, 0x104e2ce0
call fcn.100b6e90
movzx edx, al
test edx, edx
jne 0x100f3875
push 0x4e
mov ecx, 0x104e2ce0
call fcn.100b6e90
movzx eax, al
test eax, eax
je 0x100f387a
jmp 0x100f3911
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
je 0x100f3911
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x104fb48c]
add edx, 0xfa
cmp eax, edx
jb 0x100f3911
cmp dword [0x10295ef0], 1
je 0x100f3911
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movsx edx, word [ecx]
test edx, edx
jge 0x100f38c2
jmp 0x100f3911
mov byte [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
push 8
push 1
push 0x79
lea ecx, [ebp - 0xc]
call fcn.100285f0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + 0x43]
mov byte [ebp - 6], dl
mov byte [ebp - 5], 0
movzx eax, byte [ebp - 0xb]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.1011a530
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x104fb48c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret

Function at 0x100f8730
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x8d
sub eax, dword [edx + 0x104e2d98]
cmp eax, 0x3e8
jae 0x100f875a
jmp 0x100f87dd
cmp dword [0xe61e18], 0x3e
jne 0x100f8781
push str.Camera3D_not_available_for_this_map
push 1
push 0x104e2ce0
call fcn.100b7d40
add esp, 0xc
mov ecx, 0x104fb490
call fcn.100f77a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x8d
mov dword [edx + 0x104e2d98], eax
mov ecx, 0x104fb490
call fcn.100f7770
mov ecx, 0x104fb490
call fcn.100f7740
movzx eax, al
test eax, eax
je 0x100f87c9
push str.Camera3D__On_
push 1
push 0x104e2ce0
call fcn.100b7d40
add esp, 0xc
jmp 0x100f87dd
push str.Camera3D__Off_
push 1
push 0x104e2ce0
call fcn.100b7d40
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100f87f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x8c
sub eax, dword [edx + 0x104e2d98]
cmp eax, 0x3e8
jae 0x100f8817
jmp 0x100f8849
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x8c
mov dword [edx + 0x104e2d98], eax
mov ecx, 0x104fb490
call fcn.100f7740
movzx eax, al
test eax, eax
je 0x100f8849
mov ecx, 0x104fb490
call fcn.100f77a0
mov esp, ebp
pop ebp
ret
Function at 0x10106350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
call fcn.101a432a
cdq
mov ecx, 0x3e8
idiv ecx
push edx
push str.DataItemTemp_t_d
mov edx, dword [ebp - 0xc]
add edx, 0xc
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x10102
push 2
push 0
push 7
push 0x40000000
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x101063b2
xor al, al
jmp 0x10106400
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
sub eax, 8
push eax
mov ecx, 1
shl ecx, 3
mov edx, dword [ebp - 0xc]
add ecx, dword [edx + 4]
push ecx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x101063f4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x10106400
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret

Function at 0x10106410
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 0x101f1ee7
mov eax, dword [ebp - 8]
add eax, 0xc
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0x10]
cmp dl, byte [eax]
jne 0x10106466
cmp byte [ebp - 1], 0
je 0x1010645d
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 1]
mov byte [ebp - 2], dl
mov eax, dword [ebp - 0x10]
cmp dl, byte [eax + 1]
jne 0x10106466
add dword [ebp - 0xc], 2
add dword [ebp - 0x10], 2
cmp byte [ebp - 2], 0
jne 0x10106429
mov dword [ebp - 0x14], 0
jmp 0x1010646e
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
je 0x10106483
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
jne 0x10106485
jmp 0x101064d7
mov ecx, dword [ebp - 8]
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10106498
jmp 0x101064d7
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.1014d811
add esp, 4
mov edx, dword [ebp - 8]
mov dword [edx + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
push 0x100
push 0
mov ecx, dword [ebp - 8]
add ecx, 0xc
push ecx
call fcn.1019bb90
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10108fb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
call fcn.10108f60
add esp, 4
call fcn.101d5570
mov word [ebp - 2], ax
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
call fcn.100a6a80
add esp, 4
call fcn.101d5570
mov word [ebp - 4], ax
movzx eax, word [ebp - 2]
push eax
movzx ecx, word [ebp - 4]
push ecx
cvttss2si edx, dword [ebp + 0x10]
movzx eax, dx
push eax
cvttss2si ecx, dword [ebp + 0xc]
movzx edx, cx
push edx
call fcn.100a6b10
add esp, 0x10
movzx eax, al
test eax, eax
je 0x10109167
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
je 0x101090c7
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x18]
divss xmm0, dword [ebp + 0x20]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x14]
divss xmm0, dword [ebp + 0x1c]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x18]
divss xmm0, dword [ebp + 0x20]
cvtss2sd xmm0, xmm0
mulsd xmm0, qword [0x101fa9f0]
cvtsd2ss xmm0, xmm0
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov edx, dword [ebp + 8]
push edx
mov eax, 0x637c60
call eax
add esp, 0x30
jmp 0x10109147
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x18]
divss xmm0, dword [ebp + 0x20]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x14]
divss xmm0, dword [ebp + 0x1c]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x18]
divss xmm0, dword [ebp + 0x20]
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov ecx, dword [ebp + 8]
push ecx
mov edx, 0x637c60
call edx
add esp, 0x30
push 1
mov eax, 0x791050
call eax
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x10109161
mov al, 2
jmp 0x101091e2
mov al, 1
jmp 0x101091e2
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x18]
divss xmm0, dword [ebp + 0x20]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x14]
divss xmm0, dword [ebp + 0x1c]
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov edx, dword [ebp + 8]
push edx
mov eax, 0x637c60
call eax
add esp, 0x30
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1010a350
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
cvttss2si eax, dword [ebp + 0x18]
push eax
cvttss2si ecx, dword [ebp + 0x14]
push ecx
cvttss2si edx, dword [ebp + 0x10]
push edx
cvttss2si eax, dword [ebp + 0xc]
push eax
call fcn.100a6b10
add esp, 0x10
movzx ecx, al
test ecx, ecx
je 0x1010a4e9
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x1010a430
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x1c]
divss xmm0, dword [ebp + 0x24]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
cvtss2sd xmm0, xmm0
mulsd xmm0, qword [0x101fa9f0]
cvtsd2ss xmm0, xmm0
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x637c60
call ecx
add esp, 0x30
jmp 0x1010a4b0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x1c]
divss xmm0, dword [ebp + 0x24]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov edx, dword [ebp + 8]
push edx
mov eax, 0x637c60
call eax
add esp, 0x30
push 1
mov ecx, 0x791050
call ecx
add esp, 4
movzx edx, al
test edx, edx
je 0x1010a4e5
push 0
push 0
push 0x19
mov eax, 0x6d6c20
call eax
add esp, 0xc
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
push edx
call dword [ebp - 8]
add esp, 4
jmp 0x1010a562
jmp 0x1010a562
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x1c]
divss xmm0, dword [ebp + 0x24]
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x637c60
call ecx
add esp, 0x30
mov esp, ebp
pop ebp
ret 0x28
Function at 0x10116bc0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101daf0b
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x424], ecx
lea ecx, [ebp - 0x414]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
mov eax, dword [ebp - 0x424]
add eax, 0xcb328
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x414]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10116c4e
mov byte [ebp - 0x419], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x419]
jmp 0x10116e1b
push 0
push 0x20
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0xffffffff
jne 0x10116c9a
mov byte [ebp - 0x41a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41a]
jmp 0x10116e1b
push 0
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3af48
je 0x10116ce1
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41b]
jmp 0x10116e1b
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0x3af48
mov ecx, dword [ebp - 0x424]
add ecx, 0x903dc
push ecx
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10116d42
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41c]
jmp 0x10116e1b
mov dword [ebp - 0x418], 0
jmp 0x10116d5d
mov ecx, dword [ebp - 0x418]
add ecx, 1
mov dword [ebp - 0x418], ecx
cmp dword [ebp - 0x418], 0x3af48
jae 0x10116def
mov edx, dword [ebp - 0x418]
shr edx, 8
and edx, 0xff
movzx eax, dl
xor eax, 0x6e
movzx ecx, al
mov edx, dword [ebp - 0x424]
add edx, dword [ebp - 0x418]
movzx eax, byte [edx + 0x903dc]
add eax, ecx
mov ecx, dword [ebp - 0x424]
add ecx, dword [ebp - 0x418]
mov byte [ecx + 0x903dc], al
mov edx, dword [ebp - 0x418]
and edx, 0xff
movzx eax, dl
xor eax, 0xe6
movzx ecx, al
mov edx, dword [ebp - 0x424]
add edx, dword [ebp - 0x418]
movzx eax, byte [edx + 0x903dc]
xor eax, ecx
mov ecx, dword [ebp - 0x424]
add ecx, dword [ebp - 0x418]
mov byte [ecx + 0x903dc], al
jmp 0x10116d4e
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret 4
Function at 0x10116e40
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101daf0b
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x1020b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x424], ecx
lea ecx, [ebp - 0x414]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
mov eax, dword [ebp - 0x424]
add eax, 0xcb324
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x414]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10116ece
mov byte [ebp - 0x419], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x419]
jmp 0x1011708a
push 0
push 0x20
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0xffffffff
jne 0x10116f1a
mov byte [ebp - 0x41a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41a]
jmp 0x1011708a
push 0
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x903d8
je 0x10116f61
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41b]
jmp 0x1011708a
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0x903d8
mov ecx, dword [ebp - 0x424]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10116fbf
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41c]
jmp 0x1011708a
mov dword [ebp - 0x418], 0
jmp 0x10116fda
mov ecx, dword [ebp - 0x418]
add ecx, 1
mov dword [ebp - 0x418], ecx
cmp dword [ebp - 0x418], 0x903d8
jae 0x1011705e
mov edx, dword [ebp - 0x418]
shr edx, 8
and edx, 0xff
movzx eax, dl
xor eax, 0x95
movzx ecx, al
mov edx, dword [ebp - 0x424]
add edx, dword [ebp - 0x418]
movzx eax, byte [edx + 4]
add eax, ecx
mov ecx, dword [ebp - 0x424]
add ecx, dword [ebp - 0x418]
mov byte [ecx + 4], al
mov edx, dword [ebp - 0x418]
and edx, 0xff
movzx eax, dl
xor eax, 0xda
movzx ecx, al
mov edx, dword [ebp - 0x424]
add edx, dword [ebp - 0x418]
movzx eax, byte [edx + 4]
xor eax, ecx
mov ecx, dword [ebp - 0x424]
add ecx, dword [ebp - 0x418]
mov byte [ecx + 4], al
jmp 0x10116fcb
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014d1c5
mov esp, ebp
pop ebp
ret 4