joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013c90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10013ca3
test al, 0x10
jne 0x10013ca3
mov al, 1
ret
xor al, al
ret

Function at 0x10015790
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4de9fc
call esi
mov eax, 0x10014ce0
mov byte [0x4de9fc], 0xe9
sub eax, 0x4dea01
mov dword [0x4de9fd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4de9fc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4c9bd9
call esi
lea eax, [esp + 4]
mov dword [0x4c9bd9], 0x1000f320
push eax
push dword [esp + 8]
push 4
push 0x4c9bd9
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x481b2b
call esi
mov eax, 0x10015770
sub eax, 0x481b2f
mov dword [0x481b2b], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x481b2b
call esi
pop esi
pop ecx
ret

Function at 0x10018e80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
push 0
mov edx, str.GraveContainersFix
mov ecx, str.Misc
call fcn.1000dcb0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x413970
setg byte [0x1015539e]
call esi
mov eax, 0x10018e50
mov byte [0x413970], 0xe9
sub eax, 0x413975
mov dword [0x413971], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x413970
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x412134
call esi
mov eax, 0x10018e60
mov byte [0x412134], 0xe9
sub eax, 0x412139
mov dword [0x412135], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x412134
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x411f2c
call esi
mov eax, 0x10018e70
mov byte [0x411f2c], 0xe9
sub eax, 0x411f31
mov dword [0x411f2d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x411f2c
call esi
pop esi
pop ecx
ret

Function at 0x10019790
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push 1
mov edx, str.CanSellUsedGeiger
mov ecx, str.Misc
call fcn.1000dcb0
test eax, eax
je 0x100197f8
cmp byte [0x10174f84], 0
je 0x100197f1
test byte [0x10174f88], 0x10
je 0x100197f1
mov edx, str.Applying_fix_patch_to_be_able_to_sell_used_geiger_counters_and_stealth_boys.
mov ecx, 0x10153db8
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
cmp dword [0x101553d8], 0
je 0x100197f1
mov edx, str.Applying_fix_patch_to_be_able_to_sell_used_geiger_counters_and_stealth_boys.
mov ecx, 0x10141e60
call fcn.10012cf0
push eax
call fcn.10012f90
add esp, 4
mov byte [0x10174f93], 1
lea eax, [esp]
push eax
push 0x40
push 5
push 0x474b2c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10019780
mov byte [0x474b2c], 0xe9
sub eax, 0x474b31
mov dword [0x474b2d], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push 0x474b2c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x1001b820
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4b3b54
call esi
mov eax, 0x100251c0
mov byte [0x4b3b54], 0xe9
sub eax, 0x4b3b59
mov dword [0x4b3b55], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4b3b54
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d8a8
call esi
mov eax, 0x1001b780
mov byte [0x42d8a8], 0xe9
sub eax, 0x42d8ad
mov dword [0x42d8a9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d8a8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d974
call esi
mov eax, 0x1001b790
mov byte [0x42d974], 0xe9
sub eax, 0x42d979
mov dword [0x42d975], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d974
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d9b4
call esi
mov eax, 0x1001b7a0
mov byte [0x42d9b4], 0xe9
sub eax, 0x42d9b9
mov dword [0x42d9b5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d9b4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x472768
call esi
mov eax, 0x1001b7b0
mov byte [0x472768], 0xe9
sub eax, 0x47276d
mov dword [0x472769], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x472768
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x472a64
call esi
mov eax, 0x1001b7c0
mov byte [0x472a64], 0xe9
sub eax, 0x472a69
mov dword [0x472a65], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x472a64
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d318
call esi
mov eax, 0x1001b7d0
mov byte [0x42d318], 0xe9
sub eax, 0x42d31d
mov dword [0x42d319], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d318
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d3a4
call esi
mov eax, 0x1001b7e0
mov byte [0x42d3a4], 0xe9
sub eax, 0x42d3a9
mov dword [0x42d3a5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d3a4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d210
call esi
mov eax, 0x1001aac0
mov byte [0x42d210], 0xe9
sub eax, 0x42d215
mov dword [0x42d211], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d210
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d0a8
call esi
mov eax, 0x1001b7f0
mov byte [0x42d0a8], 0xe9
sub eax, 0x42d0ad
mov dword [0x42d0a9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d0a8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42e32c
call esi
mov eax, 0x1001b800
mov byte [0x42e32c], 0xe9
sub eax, 0x42e331
mov dword [0x42e32d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42e32c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42d4f4
call esi
mov eax, 0x1001b810
mov byte [0x42d4f4], 0xe9
sub eax, 0x42d4f9
mov dword [0x42d4f5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42d4f4
call esi
pop esi
pop ecx
ret
Function at 0x1001c460
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47a5b4
call esi
mov eax, 0x1001c420
mov byte [0x47a5b4], 0xe9
sub eax, 0x47a5b9
mov dword [0x47a5b5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47a5b4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x479c20
call esi
mov eax, 0x1001c430
mov byte [0x479c20], 0xe9
sub eax, 0x479c25
mov dword [0x479c21], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x479c20
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47a4c4
call esi
mov eax, 0x1001c440
mov byte [0x47a4c4], 0xe9
sub eax, 0x47a4c9
mov dword [0x47a4c5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47a4c4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47a558
call esi
mov eax, 0x1001c450
mov byte [0x47a558], 0xe9
sub eax, 0x47a55d
mov dword [0x47a559], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47a558
call esi
pop esi
pop ecx
ret

Function at 0x1001d0c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
mov ecx, 0x1001c550
push esi
sub esp, 0x28
mov eax, esp
mov dword [eax + 0x24], 0
test ecx, ecx
je 0x1001d0e9
mov dword [eax], 0x101218c8
mov dword [eax + 4], 0x1001c550
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
mov ecx, 0x10154dd0
push eax
call fcn.1001d220
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1001d132
push dword [esp + 4]
mov edx, dword [esp + 0x10]
push ecx
call fcn.1000fa00
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.1000d8e0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45ea10
call esi
mov eax, 0x1001d080
mov byte [0x45ea10], 0xe9
sub eax, 0x45ea15
mov dword [0x45ea11], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45ea10
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45efec
call esi
mov eax, 0x1001d090
mov byte [0x45efec], 0xe9
sub eax, 0x45eff1
mov dword [0x45efed], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45efec
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45eda8
call esi
mov eax, 0x1001d0a0
mov byte [0x45eda8], 0xe9
sub eax, 0x45edad
mov dword [0x45eda9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45eda8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x45ebd8
call esi
mov eax, 0x1001d0b0
mov byte [0x45ebd8], 0xe9
sub eax, 0x45ebdd
mov dword [0x45ebd9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x45ebd8
call esi
pop esi
add esp, 0x10
ret
Function at 0x1001db40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov edi, edx
mov ecx, dword [ebx + 0x64]
cmp dword [edi + 0x64], ecx
jne 0x1001dc11
mov eax, dword [ebx + 0x78]
cmp eax, dword [edi + 0x78]
jne 0x1001dc11
cmp dword [edi], 0xfffffff
jg 0x1001dc11
test dword [ebx + 0x24], 0x7002000
jne 0x1001dc11
test dword [edi + 0x24], 0x7002000
jne 0x1001dc11
lea edx, [esp + 0x18]
call fcn.1003bdf0
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x20]
cmp eax, 1
je 0x1001dc11
cmp dword [ebx + 0x2c], 0
lea esi, [ebx + 0x2c]
jg 0x1001dc11
cmp dword [edi + 0x2c], 0
lea ebp, [edi + 0x2c]
jg 0x1001dc11
cmp eax, 4
je 0x1001dbc2
cmp dword [ebx + 0x64], 0x29
je 0x1001dbc2
mov byte [esp + 0x17], 0
jmp 0x1001dbd4
mov eax, dword [edi + 0x3c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x3c]
mov byte [esp + 0x17], 1
mov dword [edi + 0x3c], eax
xor edx, edx
sub ebp, esi
nop dword [eax + eax]
mov ecx, dword [esi]
lea esi, [esi + 4]
mov eax, dword [esi + ebp - 4]
cmp ecx, eax
jne 0x1001dbf3
inc edx
cmp edx, 0xe
jl 0x1001dbe0
cmp byte [esp + 0x17], 0
je 0x1001dc01
mov eax, dword [esp + 0x18]
mov dword [edi + 0x3c], eax
xor eax, eax
cmp edx, 0xe
setge al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x1001f0c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4716e8
call esi
mov eax, 0x1001f020
mov byte [0x4716e8], 0xe9
sub eax, 0x4716ed
mov dword [0x4716e9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4716e8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x477490
call esi
mov eax, 0x1001e600
mov byte [0x477490], 0xe9
sub eax, 0x477495
mov dword [0x477491], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x477490
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x477e98
call esi
mov eax, 0x1001f030
mov byte [0x477e98], 0xe9
sub eax, 0x477e9d
mov dword [0x477e99], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x477e98
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x479a20
call esi
mov eax, 0x1001f040
mov byte [0x479a20], 0xe9
sub eax, 0x479a25
mov dword [0x479a21], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x479a20
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x477b88
call esi
mov eax, 0x1001f050
mov byte [0x477b88], 0xe9
sub eax, 0x477b8d
mov dword [0x477b89], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x477b88
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4772b8
call esi
mov eax, 0x1001f060
mov byte [0x4772b8], 0xe9
sub eax, 0x4772bd
mov dword [0x4772b9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4772b8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478154
call esi
mov eax, 0x1001f070
mov byte [0x478154], 0xe9
sub eax, 0x478159
mov dword [0x478155], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478154
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4779f0
call esi
mov eax, 0x1001f080
mov byte [0x4779f0], 0xe9
sub eax, 0x4779f5
mov dword [0x4779f1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4779f0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49b8b0
call esi
mov eax, 0x1001f010
mov byte [0x49b8b0], 0xe9
sub eax, 0x49b8b5
mov dword [0x49b8b1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49b8b0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49b650
call esi
mov eax, 0x1001f090
mov byte [0x49b650], 0xe9
sub eax, 0x49b655
mov dword [0x49b651], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49b650
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49b73c
call esi
mov eax, 0x1001f0a0
mov byte [0x49b73c], 0xe9
sub eax, 0x49b741
mov dword [0x49b73d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49b73c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x472758
call esi
mov eax, 0x1001f0b0
mov byte [0x472758], 0xe9
sub eax, 0x47275d
mov dword [0x472759], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x472758
call esi
pop esi
pop ecx
ret
Function at 0x100207b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
call fcn.10020630
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x479898
call esi
mov eax, 0x100205b0
mov byte [0x479898], 0xe9
sub eax, 0x47989d
mov dword [0x479899], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x479898
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478040
call esi
mov eax, 0x100205c0
mov byte [0x478040], 0xe9
sub eax, 0x478045
mov dword [0x478041], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478040
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478b24
call esi
mov eax, 0x100205d0
mov byte [0x478b24], 0xe9
sub eax, 0x478b29
mov dword [0x478b25], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478b24
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478e5c
call esi
mov eax, 0x100205e0
mov byte [0x478e5c], 0xe9
sub eax, 0x478e61
mov dword [0x478e5d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478e5c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4786a0
call esi
mov eax, 0x100205f0
mov byte [0x4786a0], 0xe9
sub eax, 0x4786a5
mov dword [0x4786a1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4786a0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478714
call esi
mov eax, 0x10020600
mov byte [0x478714], 0xe9
sub eax, 0x478719
mov dword [0x478715], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478714
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x478a1c
call esi
mov eax, 0x10020610
mov byte [0x478a1c], 0xe9
sub eax, 0x478a21
mov dword [0x478a1d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x478a1c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x47910c
call esi
mov eax, 0x10020620
mov byte [0x47910c], 0xe9
sub eax, 0x479111
mov dword [0x47910d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x47910c
call esi
pop esi
pop ecx
ret

Function at 0x10021380
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x488cd5
call esi
mov eax, 0x10020f00
sub eax, 0x488cd9
mov dword [0x488cd5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x488cd5
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x488cd3
call esi
lea eax, [esp + 4]
mov byte [0x488cd3], 0xf1
push eax
push dword [esp + 8]
push 1
push 0x488cd3
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x48ac90
call esi
mov eax, 0x10021370
mov byte [0x48ac90], 0xe9
sub eax, 0x48ac95
mov dword [0x48ac91], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x48ac90
call esi
pop esi
pop ecx
ret
Function at 0x10021700
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
cmp byte [esi + 0x67], 1
je 0x1002172f
push str._nERROR:_Perk_adding_effect_was_called_on_non_critter_
call fcn.10016d20
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
js 0x10021724
cmp edi, 0x77
jl 0x10021750
push 1
call fcn.100bdd50
mov ebp, eax
test ebp, ebp
jne 0x10021759
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
imul ebp, edi, 0x4c
add ebp, 0x1016ec90
mov ebx, dword [ebp + 0x14]
cmp ebx, 0xffffffff
je 0x10021779
mov edx, ebx
mov ecx, esi
call fcn.100242d0
mov ecx, dword [ebp + 0x18]
mov edx, ebx
add ecx, eax
push ecx
mov ecx, esi
call fcn.10024480
cmp edi, 0x5c
jne 0x100217cb
mov edi, dword [0x6681b0]
inc edi
cmp edi, dword [0x51d8f4]
jge 0x100217f1
mov ecx, esi
call fcn.10021440
mov ebx, eax
mov ecx, edi
dec dword [ebx + 0x170]
call fcn.100c65b0
cmp eax, 0xfffffffe
jne 0x100217af
mov ecx, edi
call fcn.100223d0
sub eax, dword [0x6681b4]
xor edx, edx
mov ecx, eax
mov dword [0x51c124], eax
call fcn.10022590
inc dword [ebx + 0x170]
jmp 0x100217f1
cmp edi, 0x54
jl 0x100217f1
cmp edi, 0x5a
jg 0x100217f1
mov ecx, dword [esi + 0x64]
lea edx, [esp + 0x14]
call fcn.1003bdf0
cmp eax, 0xffffffff
je 0x100217f1
mov eax, dword [esp + 0x14]
inc dword [eax + edi*4 - 0x12c]
cmp dword [ebp + 0xc], 0xffffffff
jne 0x1002184b
xor ebx, ebx
mov edi, 0xb0
nop
xor ecx, ecx
cmp ebx, 0x22
ja 0x1002182f
cmp byte [esi + 0x67], 1
jne 0x1002182f
mov ecx, esi
call fcn.10088070
mov dword [esp + 0x14], eax
test eax, eax
jne 0x1002182c
mov ecx, dword [esi + 0x64]
lea edx, [esp + 0x14]
call fcn.1003bdf0
mov eax, dword [esp + 0x14]
mov ecx, dword [edi + eax]
mov eax, dword [edi + ebp - 0x80]
mov edx, ebx
add eax, ecx
mov ecx, esi
push eax
call fcn.10024480
add edi, 4
inc ebx
cmp edi, 0xcc
jl 0x10021800
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021860
Capabilities:
Check for software breakpoints

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
cmp byte [esi + 0x67], 1
je 0x10021882
push str._nERROR:_Perk_remove_effect_was_called_on_non_critter_
call fcn.10016d20
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test edi, edi
js 0x10021939
cmp edi, 0x77
jl 0x100218a2
push 0
call fcn.100bdd50
mov ebp, eax
test ebp, ebp
je 0x10021939
jmp 0x100218ab
imul ebp, edi, 0x4c
add ebp, 0x1016ec90
mov ebx, dword [ebp + 0x14]
cmp ebx, 0xffffffff
je 0x100218c9
mov edx, ebx
mov ecx, esi
call fcn.100242d0
sub eax, dword [ebp + 0x18]
mov edx, ebx
push eax
mov ecx, esi
call fcn.10024480
cmp edi, 0x5c
jne 0x100218e2
mov edx, dword [0x6681b4]
lea ecx, [edi - 0x5a]
sub edx, dword [0x51c124]
call fcn.10022350
cmp dword [ebp + 0xc], 0xffffffff
jne 0x10021939
xor ebx, ebx
mov edi, 0xb0
nop
xor eax, eax
cmp ebx, 0x22
ja 0x1002191f
cmp byte [esi + 0x67], 1
jne 0x1002191f
mov ecx, esi
call fcn.10088070
mov dword [esp + 0x10], eax
test eax, eax
jne 0x1002191c
mov ecx, dword [esi + 0x64]
lea edx, [esp + 0x10]
call fcn.1003bdf0
mov eax, dword [esp + 0x10]
mov eax, dword [edi + eax]
sub eax, dword [edi + ebp - 0x80]
mov edx, ebx
push eax
mov ecx, esi
call fcn.10024480
add edi, 4
inc ebx
cmp edi, 0xcc
jl 0x100218f0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10021b90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49678c
call esi
mov eax, 0x10021b40
mov byte [0x49678c], 0xe9
sub eax, 0x496791
mov dword [0x49678d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49678c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49680c
call esi
mov eax, 0x10021b50
mov byte [0x49680c], 0xe9
sub eax, 0x496811
mov dword [0x49680d], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49680c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x496bfc
call esi
mov eax, 0x10021b60
mov byte [0x496bfc], 0xe9
sub eax, 0x496c01
mov dword [0x496bfd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x496bfc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x496ce0
call esi
mov eax, 0x10021b70
mov byte [0x496ce0], 0xe9
sub eax, 0x496ce5
mov dword [0x496ce1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x496ce0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x496b78
call esi
mov eax, 0x10021b80
mov byte [0x496b78], 0xe9
sub eax, 0x496b7d
mov dword [0x496b79], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x496b78
call esi
pop esi
pop ecx
ret
Function at 0x10022a90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4af9a0
call esi
mov eax, 0x10022a40
mov byte [0x4af9a0], 0xe9
sub eax, 0x4af9a5
mov dword [0x4af9a1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4af9a0
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4221b4
call esi
mov eax, 0x10022a50
mov byte [0x4221b4], 0xe9
sub eax, 0x4221b9
mov dword [0x4221b5], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4221b4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4afab8
call esi
mov eax, 0x10022a60
mov byte [0x4afab8], 0xe9
sub eax, 0x4afabd
mov dword [0x4afab9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4afab8
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4afc38
call esi
mov eax, 0x10022a70
mov byte [0x4afc38], 0xe9
sub eax, 0x4afc3d
mov dword [0x4afc39], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4afc38
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x42e220
call esi
mov eax, 0x10022a80
mov byte [0x42e220], 0xe9
sub eax, 0x42e225
mov dword [0x42e221], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x42e220
call esi
pop esi
pop ecx
ret

Function at 0x10022bc0
Capabilities:
Terminate process

Disassembly:
push ecx
push str._nError:_Cant_find__d_msg_num_in_proto.msg_
call fcn.10016d20
add esp, 8
push 1
call fcn.100f669f
int3

Function at 0x10023a40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49ad88
call esi
mov eax, 0x10023a00
mov byte [0x49ad88], 0xe9
sub eax, 0x49ad8d
mov dword [0x49ad89], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49ad88
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49ad78
call esi
mov eax, 0x10023a10
mov byte [0x49ad78], 0xe9
sub eax, 0x49ad7d
mov dword [0x49ad79], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49ad78
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49eafc
call esi
mov eax, 0x10023a20
mov byte [0x49eafc], 0xe9
sub eax, 0x49eb01
mov dword [0x49eafd], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49eafc
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49f8a0
call esi
mov eax, 0x10023a30
mov byte [0x49f8a0], 0xe9
sub eax, 0x49f8a5
mov dword [0x49f8a1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49f8a0
call esi
pop esi
pop ecx
ret