joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007cc90
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x1013cd3c]
push esi
cmp dword [eax], 0xffffffff
je 0x1001c622
cmp dword [0x518f14], 0
jne 0x1001c622
mov ecx, dword [0x519024]
call fcn.10075500
mov esi, dword [0x10175044]
test esi, esi
je 0x1001c618
mov ecx, dword [esi]
call fcn.10075500
mov ecx, dword [esi + 4]
call fcn.10075500
mov dword [0x518f14], 1
pop esi
jmp fcn.10044120
cmp dword [0x10143a5c], 0
push esi
je 0x1007ccce
mov dl, byte [0x10155921]
test dl, dl
jne 0x1007ccad
cmp dword [0x518f14], 0
jne 0x1007ccce
lea eax, [ecx - 0x10]
cmp eax, 2
ja 0x1007ccfc
test dl, dl
jne 0x1007ccce
mov esi, dword [0x1015eec4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test esi, esi
jne 0x1007ccd0
mov dword [0x1015eec4], eax
pop esi
ret
mov edx, eax
mov ecx, eax
sub edx, esi
sub ecx, esi
cmp eax, esi
cmovae ecx, edx
cmp ecx, 0xfa
jbe 0x1007ccce
mov dword [0x1015eec4], 0
mov byte [0x10155921], 1
pop esi
jmp 0x1001c5e0
pop esi
jmp fcn.1007cd10
Function at 0x1007d450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47d52a
call esi
mov eax, 0x1007d3c0
sub eax, 0x47d52e
mov dword [0x47d52a], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47d52a
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47ed8d
call esi
mov eax, 0x1007d3d0
sub eax, 0x47ed91
mov dword [0x47ed8d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47ed8d
call esi
lea eax, [esp + 0xc]
mov dword [esp + 4], 0x47cc0f
lea ecx, [esp + 4]
mov dword [esp + 8], 0x47be3d
push eax
push ecx
mov ecx, 0x1007d3f0
call fcn.100122c0
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47c628
call esi
mov eax, 0x1007d410
sub eax, 0x47c62c
mov dword [0x47c628], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47c628
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x47d430
call esi
mov eax, 0x1007d430
sub eax, 0x47d434
mov dword [0x47d430], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x47d430
call esi
pop esi
add esp, 8
ret

Function at 0x1007de20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 8], 0x41b979
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x43f560
push eax
push ecx
mov ecx, 0x1007ddf0
mov dword [esp + 0x18], 0x490005
mov dword [esp + 0x1c], 0x490961
call fcn.100122c0
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x490eac
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x491546
push eax
push ecx
mov ecx, 0x1007de00
call fcn.100122c0
mov esi, dword [0x1013cf00]
lea eax, [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push 0x49042a
call edi
lea eax, [esp + 8]
mov dword [0x49042a], esi
push eax
push dword [esp + 0xc]
push 4
push 0x49042a
call edi
mov esi, dword [0x1013cf04]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x490436
call edi
lea eax, [esp + 8]
mov dword [0x490436], esi
push eax
push dword [esp + 0xc]
push 4
push 0x490436
call edi
mov esi, dword [0x1013cf04]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x49075f
call edi
lea eax, [esp + 8]
mov dword [0x49075f], esi
push eax
push dword [esp + 0xc]
push 4
push 0x49075f
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007e480
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x10143a74]
sub esp, 8
test eax, eax
jns 0x1007e498
mov dword [0x10143a74], 0
jmp 0x1007e4a7
mov ecx, 2
cmp eax, ecx
cmovg eax, ecx
mov dword [0x10143a74], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44e7e4
call edi
mov eax, 0x1007e320
sub eax, 0x44e7e8
mov dword [0x44e7e4], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44e7e4
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44ea76
call edi
mov eax, 0x1007e400
sub eax, 0x44ea7a
mov dword [0x44ea76], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44ea76
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4877d0
call edi
lea eax, [esp + 8]
mov dword [0x4877d0], 0x1007e0c0
push eax
push dword [esp + 0xc]
push 4
push 0x4877d0
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x487813
call edi
lea eax, [esp + 8]
mov dword [0x487813], 0x1007e160
push eax
push dword [esp + 0xc]
push 4
push 0x487813
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x4f5d40
call edi
mov eax, 0x1007e0b0
mov byte [0x4f5d40], 0xe8
sub eax, 0x4f5d45
mov dword [0x4f5d41], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x4f5d40
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x48738f
call edi
mov eax, fcn.1007b360
sub eax, 0x487393
mov dword [0x48738f], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x48738f
call edi
mov esi, dword [0x1013cf00]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x487580
call edi
lea eax, [esp + 8]
mov dword [0x487580], esi
push eax
push dword [esp + 0xc]
push 4
push 0x487580
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4875bf
call edi
mov eax, 0x1007e2c0
sub eax, 0x4875c3
mov dword [0x4875bf], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4875bf
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4875c5
call edi
lea eax, [esp + 8]
mov byte [0x4875c5], 0xeb
push eax
push dword [esp + 0xc]
push 1
push 0x4875c5
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x44e6b2
call edi
mov eax, 0x1007e2d0
mov byte [0x44e6b2], 0xe8
sub eax, 0x44e6b7
mov dword [0x44e6b3], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x44e6b2
call edi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x44eac9
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x44eadd
push eax
push ecx
mov ecx, 0x1007e2f0
call fcn.10012340
pop edi
pop esi
add esp, 8
ret
Function at 0x100837c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fa1e
call edi
mov eax, 0x10083720
sub eax, 0x43fa22
mov dword [0x43fa1e], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43fa1e
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43f805
call edi
mov eax, 0x100837b0
sub eax, 0x43f809
mov dword [0x43f805], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43f805
call edi
mov esi, dword [0x1013cf04]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44065a
call edi
lea eax, [esp + 8]
mov dword [0x44065a], esi
push eax
push dword [esp + 0xc]
push 4
push 0x44065a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x440024
call edi
mov eax, 0x100831c0
sub eax, 0x440028
mov dword [0x440024], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x440024
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44004f
call edi
mov eax, fcn.100831f0
sub eax, 0x440053
mov dword [0x44004f], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44004f
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44012a
call edi
mov eax, 0x100833d0
sub eax, 0x44012e
mov dword [0x44012a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44012a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x44063a
call edi
mov eax, 0x10083510
sub eax, 0x44063e
mov dword [0x44063a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x44063a
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fde4
call edi
mov eax, 0x100835a0
sub eax, 0x43fde8
mov dword [0x43fde4], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43fde4
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fc81
call edi
mov eax, 0x10083540
sub eax, 0x43fc85
mov dword [0x43fc81], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43fc81
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x43fc75
call edi
lea eax, [esp + 8]
mov byte [0x43fc75], 0x56
push eax
push dword [esp + 0xc]
push 1
push 0x43fc75
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x440072
call edi
lea eax, [esp + 8]
mov dword [0x440072], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x440072
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43fc94
call edi
lea eax, [esp + 8]
mov dword [0x43fc94], 0x441f0f
push eax
push dword [esp + 0xc]
push 4
push 0x43fc94
call edi
pop edi
pop esi
pop ecx
ret

Function at 0x10083f50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x40
push 4
push 0x442b0c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10083f40
sub eax, 0x442b10
mov dword [0x442b0c], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x442b0c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x10084070
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
lea eax, [esp]
push eax
push 0x40
push 4
push 0x4c3306
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10084050
sub eax, 0x4c330a
mov dword [0x4c3306], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x4c3306
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
mov dword [esp], 0x4c3312
push eax
lea edx, [esp + 4]
mov dword [esp + 8], 0x4c332d
mov cl, 0x7f
call fcn.10084100
lea eax, [esp + 8]
mov dword [esp], 0x4c3321
push eax
lea edx, [esp + 4]
mov dword [esp + 8], 0x4c333b
mov cl, 0x7c
call fcn.10084100
mov esp, ebp
pop ebp
ret

Function at 0x10084100
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push edi
mov edi, edx
mov byte [esp + 0xf], cl
sub ebp, edi
xor ecx, ecx
add ebp, 3
shr ebp, 2
cmp edi, dword [esp + 0x14]
cmova ebp, ecx
test ebp, ebp
je 0x10084159
push esi
mov esi, dword [edi]
lea eax, [esp + 0x18]
push eax
push 0x40
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esp + 0x13]
mov byte [esi], al
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
lea edi, [edi + 4]
cmp ebx, ebp
jne 0x10084126
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x10085120
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0x40
push 4
push 0x482c27
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10085110
sub eax, 0x482c2b
mov dword [0x482c27], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push 0x482c27
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x28
mov ecx, 0x10154dc4
mov eax, esp
mov dword [eax], 0x10125198
mov dword [eax + 0x24], eax
lea eax, [esp + 0x2c]
push eax
call fcn.1001d220
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x100851b0
push dword [esp]
mov edx, dword [esp + 0xc]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0xc]
mov eax, 0x66666667
mov ecx, dword [esp + 4]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
sub esp, 0x28
mov ecx, 0x10154e0c
mov eax, esp
mov dword [eax], 0x101251b0
mov dword [eax + 0x24], eax
lea eax, [esp + 0x2c]
push eax
call fcn.1001d220
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x10085206
push dword [esp]
mov edx, dword [esp + 0xc]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0xc]
mov eax, 0x66666667
mov ecx, dword [esp + 4]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
add esp, 0x10
ret
Function at 0x10085770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4b15f7
call edi
mov esi, 0x100855a0
lea eax, [esi - 0x4b15fb]
mov dword [0x4b15f7], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4b15f7
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4b1566
call edi
lea eax, [esp + 8]
sub esi, 0x4b156a
push eax
push dword [esp + 0xc]
mov dword [0x4b1566], esi
push 4
push 0x4b1566
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x483ef1
call edi
mov esi, 0x10085620
lea eax, [esi - 0x483ef5]
mov dword [0x483ef1], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x483ef1
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x483f54
call edi
lea eax, [esp + 8]
sub esi, 0x483f58
push eax
push dword [esp + 0xc]
mov dword [0x483f54], esi
push 4
push 0x483f54
call edi
pop edi
pop esi
pop ecx
ret
Function at 0x10085ba0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x10143a90]
sub esp, 0x10
push esi
test eax, eax
jg 0x10085bb9
mov dword [0x10143a90], 0x1e0
jmp 0x10085bc8
mov ecx, 0x140
cmp eax, ecx
cmovl eax, ecx
mov dword [0x10143a90], eax
mov eax, dword [0x10143a8c]
test eax, eax
jg 0x10085bdd
mov dword [0x10143a8c], 0x190
jmp 0x10085bec
mov ecx, 0xf0
cmp eax, ecx
cmovl eax, ecx
mov dword [0x10143a8c], eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4b2ac1
call esi
mov eax, 0x10085910
sub eax, 0x4b2ac5
mov dword [0x4b2ac1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x4b2ac1
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4b2262
call esi
mov eax, 0x100859a0
sub eax, 0x4b2266
mov dword [0x4b2262], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x4b2262
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4b2bf8
call esi
mov eax, 0x100859d0
sub eax, 0x4b2bfc
mov dword [0x4b2bf8], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x4b2bf8
call esi
push 1
push 0x10085b70
mov edx, 0x48c66b
mov cl, 0xe8
call fcn.10012100
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x48c5f4
call esi
mov eax, 0x10085b90
sub eax, 0x48c5f8
mov dword [0x48c5f4], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x48c5f4
call esi
mov eax, dword [0x1013cf04]
mov dword [0x10154090], eax
mov eax, dword [0x1013cf00]
mov dword [0x10154094], eax
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x45c886
call esi
lea eax, [esp + 4]
mov dword [0x45c886], 0x10154088
push eax
push dword [esp + 8]
push 4
push 0x45c886
call esi
call fcn.10085120
call fcn.10085770
sub esp, 0x28
mov ecx, 0x10154db8
mov eax, esp
mov dword [eax], 0x101251c8
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
push eax
call fcn.1001d220
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x10085d6a
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
sub esp, 0x28
mov ecx, 0x10154dc4
mov eax, esp
mov dword [eax], 0x101251e0
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
push eax
call fcn.1001d220
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x10085dc1
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
pop esi
add esp, 0x10
ret
Function at 0x100866f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push esi
mov ecx, 0x532424
call fcn.1003d6c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43edaa
call esi
lea eax, [esp + 8]
mov dword [0x43edaa], 0x10155900
push eax
push dword [esp + 0xc]
push 4
push 0x43edaa
call esi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43edea
call esi
mov eax, 0x100866e0
sub eax, 0x43edee
mov dword [0x43edea], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x43edea
call esi
pop esi
add esp, 8
ret
Function at 0x10086c70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x20
push esi
push 1
mov edx, str.BoostScriptDialogLimit
mov dword [esp + 0xc], 0x4c0348
mov ecx, str.Misc
mov dword [esp + 0x10], 0x4c045c
mov dword [esp + 0x14], 0x4c0672
mov dword [esp + 0x18], 0x4c065a
mov dword [esp + 0x1c], 0x4c2e5e
mov dword [esp + 0x20], 0x4c2e56
mov dword [esp + 0x24], 0x4c2eb6
call fcn.1000dcb0
test eax, eax
je 0x10086dac
push 0x13880
call fcn.100ea148
add esp, 4
mov dword [esp + 4], eax
test eax, eax
je 0x10086d07
mov ecx, eax
mov edx, 0x2710
nop dword [eax]
nop word [eax + eax]
mov dword [ecx], 0
lea ecx, [ecx + 8]
mov dword [ecx - 4], 0
sub edx, 1
jne 0x10086cf0
jmp 0x10086d09
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x10175058], eax
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4c0361
call esi
lea eax, [esp + 4]
mov dword [0x4c0361], 0x2710
push eax
push dword [esp + 8]
push 4
push 0x4c0361
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4c0479
call esi
lea eax, [esp + 4]
mov dword [0x4c0479], 0x2710
push eax
push dword [esp + 8]
push 4
push 0x4c0479
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4c0666
call esi
lea eax, [esp + 4]
mov dword [0x4c0666], 0x13880
push eax
push dword [esp + 8]
push 4
push 0x4c0666
call esi
mov ecx, dword [0x10175058]
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0xc]
call fcn.10011f50
pop esi
add esp, 0x20
ret

Function at 0x100873e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push edi
mov edi, edx
mov word [esp + 0xe], cx
sub ebp, edi
xor ecx, ecx
add ebp, 3
shr ebp, 2
cmp edi, dword [esp + 0x14]
cmova ebp, ecx
test ebp, ebp
je 0x1008743c
push esi
mov esi, dword [edi]
lea eax, [esp + 0x18]
push eax
push 0x40
push 2
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ax, word [esp + 0x12]
mov word [esi], ax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push 2
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
lea edi, [edi + 4]
cmp ebx, ebp
jne 0x10087407
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x10087480
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x40ac8c
call esi
mov eax, 0x10087470
mov byte [0x40ac8c], 0xe9
sub eax, 0x40ac91
mov dword [0x40ac8d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x40ac8c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x40a461
call esi
mov eax, 0x10087450
mov byte [0x40a461], 0xe8
sub eax, 0x40a466
mov dword [0x40a462], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x40a461
call esi
push str.StartYear
mov edx, 0x10125370
mov cl, 0xe
call fcn.10084100
push 0x1012536c
mov edx, 0x10125330
mov cl, 0x3f
call fcn.10084100
push 0x10125330
mov edx, 0x10125300
mov cl, 0x40
call fcn.10084100
push 0x101252f8
mov edx, 0x101252d0
mov cl, 0xc0
call fcn.10084100
pop esi
pop ecx
ret
Function at 0x10088380
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov edx, dword [0x101540f8]
mov eax, 0x2aaaaaab
sub edx, dword [0x101540f4]
imul edx
push ebx
push esi
sar edx, 2
mov ebx, ecx
push edi
mov eax, edx
shr eax, 0x1f
push ebx
add eax, edx
push 1
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push 4
push eax
call fcn.100f5ff9
mov eax, dword [esp + 0x20]
add esp, 0x10
xor edi, edi
test eax, eax
je 0x100883e8
xor esi, esi
mov eax, dword [0x101540f4]
push ebx
push 1
add eax, esi
push 0x14
push eax
call fcn.100f5ff9
mov eax, dword [esp + 0x20]
inc edi
add esp, 0x10
add esi, 0x18
cmp edi, eax
jb 0x100883c7
push eax
push str._nLOADSAVE:_Critters_save_base_stats:_total__d
call fcn.100124e0
mov ecx, dword [0x101540ec]
mov eax, 0x2aaaaaab
sub ecx, dword [0x101540e8]
imul ecx
push ebx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push 1
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push 4
push eax
call fcn.100f5ff9
mov eax, dword [esp + 0x28]
add esp, 0x18
xor edi, edi
test eax, eax
je 0x10088453
xor esi, esi
mov eax, dword [0x101540e8]
push ebx
push 1
add eax, esi
push 0x14
push eax
call fcn.100f5ff9
mov eax, dword [esp + 0x20]
inc edi
add esp, 0x10
add esi, 0x18
cmp edi, eax
jb 0x10088432
push eax
push str._nLOADSAVE:_Critters_save_bonus_stats:_total__d
call fcn.100124e0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x10088820
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x1008888f
cmp dword [ecx], edi
jne 0x10088887
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x10088897
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x10088897
cmp dword [ecx], edi
jne 0x1008889b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x100888c4
push eax
call fcn.100e9b8b
add esp, 4
mov dword [edi + 0xc], 0
push edi
call fcn.100e9b9e
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
ret 8

Function at 0x10088ad0
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [0x101540bc]
push edi
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [0x101540c8]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea ebx, [edx + ecx*4]
mov edx, dword [0x101540b4]
cmp edi, edx
jne 0x10088b30
mov ecx, edx
jmp 0x10088b35
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10088b5a
mov ecx, dword [eax + 8]
cmp ecx, dword [esi]
je 0x10088b44
mov eax, dword [eax]
jmp 0x10088b28
mov ecx, dword [esi]
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x10]
pop edi
cmovne eax, edx
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
ret 8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], edx
ret 8