joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008cca0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100809a1
mov dword [ebp - 0x14], eax
cmp dword [0x100e0ef0], esi
jne 0x1008cd93
push 0x800
push esi
push 0x1009f758
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1008cd20
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x57
jne 0x1008ce73
push esi
push esi
push 0x1009f758
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1008ce73
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x1008ce73
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x100e0ef0], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x100e0ef4], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
push 0x1009f7a0
push edi
mov dword [0x100e0ef8], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
mov dword [0x100e0f00], eax
test eax, eax
je 0x1008cd90
push 0x1009f7bc
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call ebx
mov dword [0x100e0efc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
je 0x1008cdb8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1008cdab
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1008cdcd
push 4
pop eax
jmp 0x1008ce75
cmp dword [ebp - 0x14], esi
je 0x1008cdcd
push dword [0x100e0ef0]
call dword [sym.imp.KERNEL32.DLL_DecodePointer]
push 3
jmp 0x1008cdb2
mov eax, dword [0x100e0efc]
mov ebx, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, edi
je 0x1008ce2b
cmp dword [0x100e0f00], edi
je 0x1008ce2b
push eax
call ebx
push dword [0x100e0f00]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1008ce2b
test eax, eax
je 0x1008ce2b
call ecx
test eax, eax
je 0x1008ce20
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1008ce20
test byte [ebp - 8], 1
jne 0x1008ce2b
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1008ce5b
mov eax, dword [0x100e0ef4]
cmp eax, edi
je 0x1008ce58
push eax
call ebx
test eax, eax
je 0x1008ce58
call eax
mov esi, eax
test esi, esi
je 0x1008ce58
mov eax, dword [0x100e0ef8]
cmp eax, edi
je 0x1008ce58
push eax
call ebx
test eax, eax
je 0x1008ce58
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x100e0ef0]
call ebx
test eax, eax
je 0x1008ce73
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1008ce75
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007aa10
mov esp, ebp
pop ebp
ret
Function at 0x401207
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x41a1e8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [0x41a1ec]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0xc], edx
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], 0x9e3779b9
mov dword [ebp - 0x18], eax
call fcn.00401200
add dword [ebp - 0xc], 0x23f
cmp dword [0x2d4384c], 0x14
jne 0x401263
push edx
lea eax, [ebp - 0x854]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov ecx, dword [0x41a1f0]
mov edx, dword [0x41a1f4]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov eax, esi
mov dword [ebp - 8], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0x2d4384c], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x2d43848]
cmove eax, dword [ebp - 8]
and dword [ebp - 8], 0
cmp dword [0x2d4384c], 0x3eb
mov dword [0x2d43848], eax
mov eax, dword [0x2d4379c]
cmove eax, dword [ebp - 8]
mov dword [0x2d4379c], eax
mov eax, dword [ebp - 0xc]
add eax, esi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
add dword [ebp - 0x10], edx
and dword [ebp - 8], 0
mov dword [0x2d43844], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
xor ecx, eax
cmp dword [0x2d4384c], 0x213
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
jne 0x401359
lea eax, [ebp - 0x40]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea eax, [ebp - 0x854]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x38]
push eax
push 0
lea eax, [ebp - 0x54]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov ecx, dword [ebp - 0x10]
sub ebx, ecx
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0xc]
shr edx, cl
add eax, ebx
mov ecx, dword [ebp - 4]
add edx, edi
xor ecx, eax
mov dword [ebp - 0x10], edx
cmp dword [0x2d4384c], 0xb03
mov dword [ebp - 4], ecx
jne 0x40139c
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
xor ecx, edx
sub esi, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0xc], eax
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
jne 0x40127f
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40bb37
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419c10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00406d87
mov dword [ebp - 0x14], eax
cmp dword [0x449f28], esi
jne 0x40bc2a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40bbb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40bd0a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40bd0a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40bd0a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x449f28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x449f2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x449f30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x449f38], eax
test eax, eax
je 0x40bc27
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x449f34], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40bc4f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40bc42
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40bc64
push 4
pop eax
jmp 0x40bd0c
cmp dword [ebp - 0x14], esi
je 0x40bc64
push dword [0x449f28]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40bc49
mov eax, dword [0x449f34]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40bcc2
cmp dword [0x449f38], edi
je 0x40bcc2
push eax
call ebx
push dword [0x449f38]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40bcc2
test eax, eax
je 0x40bcc2
call ecx
test eax, eax
je 0x40bcb7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40bcb7
test byte [ebp - 8], 1
jne 0x40bcc2
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40bcf2
mov eax, dword [0x449f2c]
cmp eax, edi
je 0x40bcef
push eax
call ebx
test eax, eax
je 0x40bcef
call eax
mov esi, eax
test esi, esi
je 0x40bcef
mov eax, dword [0x449f30]
cmp eax, edi
je 0x40bcef
push eax
call ebx
test eax, eax
je 0x40bcef
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x449f28]
call ebx
test eax, eax
je 0x40bd0a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40bd0c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040397d
mov esp, ebp
pop ebp
ret
Function at 0x10001a40
Capabilities:
Execute command
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push esi
lea eax, [ebp - 0x38]
push edi
push eax
call dword [sym.imp.MSVCR100.dll__time64]
lea ecx, [ebp - 0x38]
push ecx
call dword [sym.imp.MSVCR100.dll__localtime64]
push 0x100
mov esi, eax
mov dword [ebp - 0x30], 0x100127cc
mov dword [ebp - 0x2c], 0x100127d0
mov dword [ebp - 0x28], 0x100127d4
mov dword [ebp - 0x24], 0x100127d8
mov dword [ebp - 0x20], 0x100127dc
mov dword [ebp - 0x1c], 0x100127e0
mov dword [ebp - 0x18], 0x100127e4
mov dword [ebp - 0x14], 0x100127e8
mov dword [ebp - 0x10], 0x100127ec
mov dword [ebp - 0xc], 0x100127f0
mov dword [ebp - 8], 0x100127f4
mov dword [ebp - 4], 0x100127f8
call fcn.1000f6fb
mov edx, dword [esi + 0x14]
mov edi, eax
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + eax*4 - 0x30]
sub edx, 0x64
push edx
mov edx, dword [esi + 0xc]
push ecx
push edx
push str._02d_s_d
push edi
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x20
push str.C:WINDOWSFontsgc.mui
push 0x64
lea eax, [ebp - 0x9c]
push eax
push str.C:WINDOWSFontsgc.mui
push 0x10012808
push 0x1001280c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, edi
lea eax, [ebp - 0x9c]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001b30
test dl, dl
je 0x10001b2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001b30
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001b10
xor eax, eax
jmp 0x10001b35
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001b3f
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edi, 0x23d7ce76
lea esi, [ebp - 0x2d]
call fcn.1000e3b0
push 0x10
push 0x10012810
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, 0x844cdf51
lea esi, [ebp - 0x2a]
call fcn.1000e3f0
push eax
call dword [sym.imp.MSVCR100.dll_system]
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10001b80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10014a60
push 0x10010114
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov esi, ecx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp + 8], eax
push 4
push esi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
call edi
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x10001c03
push 4
lea eax, [esi + ebx]
push eax
call edi
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x10001c03
mov esi, dword [esi]
add esi, ebx
lea edx, [ebp + 8]
push edx
push 0x40
push 4
push esi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
test esi, esi
je 0x10001bf3
mov dword [esi], 0x3f4ce1c6
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 4
push esi
call edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10007830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10010738
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov ecx, 0x46
xor eax, eax
mov dl, byte [eax + str._0_n_____]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x20], dl
jns 0x1000786f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x10007852
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x10018bcc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
lea edx, [ebp - 0x20]
push edx
call eax
add eax, dword [0x1001883c]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
movzx eax, byte [eax]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10007a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10010758
push eax
mov dword fs:[0], esp
sub esp, 0xc
xor edx, edx
mov ecx, 0xb9
xor eax, eax
push ebx
mov bl, byte [eax + 0x100130e0]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x18], bl
jns 0x10007a62
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10007a45
mov byte [ebp - 0xd], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x10018bcc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
lea edx, [ebp - 0x18]
push edx
call eax
mov ecx, dword [ebp - 0xc]
add eax, dword [ebp + 8]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10010680
push eax
mov dword fs:[0], esp
sub esp, 0x1c
cmp dword [0x100188bc], 0
je 0x1000a15d
mov ecx, 0x10012ae4
sub ecx, 0x1e70f71
lea eax, [ebp - 0x15]
call fcn.1000e920
mov dword [ebp - 4], 0
mov ecx, dword [0x10018bcc]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x20]
call eax
cmp byte [eax], 9
mov dword [ebp - 4], 0xffffffff
sete cl
xor eax, eax
mov dword [ebp - 0x15], eax
mov dword [ebp - 0x11], eax
mov byte [ebp - 0xd], al
test cl, cl
je 0x1000a15d
push esi
lea esi, [eax + 0xc]
mov ecx, 0x70
xor eax, eax
mov dl, byte [eax + 0x100139e4]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x26], dl
jns 0x1000a124
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x10
jl 0x1000a107
mov byte [ebp - 0x16], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x10018bcc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
lea edx, [ebp - 0x26]
push edx
call eax
mov dword [eax + esi], 0
add esi, 4
mov dword [ebp - 4], 0xffffffff
cmp esi, 0x38
jl 0x1000a100
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000aa10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0x2d
call fcn.10001fd0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cwde
shr eax, 0x10
test eax, eax
je 0x1000aa56
cmp byte [0x10018000], 0
je 0x1000aa48
cmp dword [0x10018004], 0
je 0x1000aa5d
call esi
cmp dword [0x10018004], eax
ja 0x1000aa5d
mov byte [0x10018000], 1
mov eax, 1
jmp 0x1000aa5f
mov byte [0x10018000], 0
xor eax, eax
test al, 1
je 0x1000aa74
xor ecx, ecx
cmp dword [0x10016458], ecx
sete cl
mov dword [0x10016458], ecx
cmp dword [0x10017c1c], 0
je 0x1000aabc
push 0xa2
call fcn.10001f40
test ax, ax
je 0x1000aabc
lea edx, [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add edx, 2
mov dword [0x10016464], ecx
mov dword [0x10016468], edx
cmp dword [0x10016458], 0
je 0x1000ac3c
push 0x26
call fcn.10001fd0
cwde
shr eax, 0x10
test eax, eax
je 0x1000ab02
cmp byte [0x10017fc8], 0
je 0x1000aaf4
cmp dword [0x10017fcc], 0
je 0x1000ab09
call esi
cmp dword [0x10017fcc], eax
ja 0x1000ab09
mov byte [0x10017fc8], 1
mov eax, 1
jmp 0x1000ab0b
mov byte [0x10017fc8], 0
xor eax, eax
test al, 1
je 0x1000ab42
mov ecx, dword [0x10018c04]
mov eax, dword [0x10018c08]
mov edx, 2
nop
dec eax
jns 0x1000ab26
lea eax, [ecx - 1]
lea esi, [eax*8]
sub esi, eax
cmp dword [esi*4 + 0x10016c98], edx
je 0x1000ab20
mov dword [0x10018c08], eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x28
call fcn.10002060
test al, 1
mov eax, dword [0x10018c08]
je 0x1000ab83
mov ecx, dword [0x10018c04]
mov edx, 2
inc eax
cmp eax, ecx
jne 0x1000ab67
xor eax, eax
lea esi, [eax*8]
sub esi, eax
cmp dword [esi*4 + 0x10016c98], edx
je 0x1000ab60
mov dword [0x10018c08], eax
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [eax*8]
sub ecx, eax
cmp dword [ecx*4 + 0x10016c90], 0
je 0x1000ac3c
xor esi, esi
lea eax, [esi + 0x25]
call fcn.10002060
test al, 1
je 0x1000abc4
mov eax, dword [0x10018c08]
lea edx, [eax*8]
sub edx, eax
mov eax, dword [edx*4 + 0x10016c90]
cmp dword [eax], esi
jle 0x1000abc4
or esi, 0xffffffff
mov eax, 0x27
call fcn.10002060
mov ecx, dword [0x10018c08]
test al, 1
je 0x1000abfe
lea eax, [ecx*8]
sub eax, ecx
add eax, eax
mov edx, dword [eax + eax + 0x10016c94]
add eax, eax
mov eax, dword [eax + 0x10016c90]
dec edx
cmp dword [eax], edx
jge 0x1000abfe
mov esi, 1
jmp 0x1000ac02
test esi, esi
je 0x1000ac3c
lea eax, [ecx*8]
sub eax, ecx
add eax, eax
mov ecx, dword [eax + eax + 0x10016c90]
add dword [ecx], esi
add eax, eax
mov eax, dword [eax + 0x10016c98]
cmp eax, 1
jne 0x1000ac2d
mov dword [0x10018c04], 0
cmp eax, 4
jne 0x1000ac3c
mov dword [0x10018c04], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b310
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x10016454], 1
push esi
mov esi, dword [0x1001886c]
push edi
jne 0x1000b361
push 0x10016b4c
push str.Arial
push 2
push esi
call fcn.10001c50
push 0x10018bc4
push str.Hud_Small_Font
push 0
push esi
call fcn.10001c50
push esi
call fcn.10001d20
push esi
call fcn.10001dd0
mov dword [0x10016454], 0
cmp dword [0x10017b94], 0
je 0x1000b392
push 0x7b
call fcn.10001f40
mov ecx, 0x8000
test cx, ax
je 0x1000b392
mov edi, 0x85832720
lea esi, [ebp - 0x1f]
call fcn.1000f4a0
push eax
call dword [sym.imp.MSVCR100.dll_system]
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000cdc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
mov dword [0x10018afc], eax
jne 0x1000cdec
push 0
push 0
push eax
push 0x1000cce0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
Function at 0x1000dc70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10010b98
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x44], 0
je 0x1000de33
cmp byte [ebx + 0x49], 0
je 0x1000de33
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
jne 0x1000dcc6
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push esi
push edi
lea esi, [ebp - 0x28]
call fcn.1000dc10
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
lea ecx, [ecx]
mov edx, eax
cmp edi, 0x10
jae 0x1000dcec
lea edx, [ebp - 0x28]
mov eax, edx
add edx, dword [ebp - 0x18]
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebx + 0x44]
push edx
push eax
lea eax, [ebx + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x1000dd30
dec eax
je 0x1000dd34
sub eax, 2
lea esi, [ebp - 0x28]
je 0x1000de0e
call fcn.1000ce00
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov edx, eax
cmp edi, 0x10
jae 0x1000dd44
lea edx, [ebp - 0x28]
mov esi, dword [ebp + 8]
sub esi, edx
je 0x1000dd72
cmp edi, 0x10
jae 0x1000dd53
lea eax, [ebp - 0x28]
mov edx, dword [ebx + 0x54]
push edx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x1000de03
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
cmp byte [ebx + 0x49], 0
je 0x1000de0b
test esi, esi
jne 0x1000dce0
mov ecx, dword [ebp - 0x18]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x1000de28
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x1000de28
cmp edi, esi
jae 0x1000ddec
push ecx
push esi
lea eax, [ebp - 0x28]
push eax
call fcn.1000e020
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
test esi, esi
je 0x1000dce0
mov ecx, eax
cmp edi, 0x10
jae 0x1000ddc8
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], esi
jae 0x1000dde3
lea eax, [ebp - 0x28]
mov byte [eax + esi], 0
jmp 0x1000dcd7
test esi, esi
jne 0x1000ddbe
mov dword [ebp - 0x18], esi
cmp edi, 0x10
jae 0x1000ddfb
lea eax, [ebp - 0x28]
mov byte [eax], 0
jmp 0x1000dcd7
lea esi, [ebp - 0x28]
jmp 0x1000dd16
lea esi, [ebp - 0x28]
call fcn.1000ce00
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push str.string_too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
mov ecx, dword [ebp - 0xc]
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0xae
xor ecx, ecx
jmp 0x1000f370
mov al, byte [edi + ecx - 0x52973cbe]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1000f38d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1000f370
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1000fbd8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10016028]
jne 0x1000fbe2
repz ret
jmp fcn.1000ffe2