joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001fb0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov ebx, 1
push ebx
lea eax, [esp + 0x18]
push 4
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
call fcn.1000e456
mov ax, word [0x1002b4d8]
add esp, 0x10
cmp ax, bx
jne 0x10001ff2
cmp word [0x1002b4dc], 0
jmp 0x10001ffe
test ax, ax
jne 0x10002027
cmp word [0x1002b4dc], bx
jne 0x10002027
mov eax, dword [esp + 0x10]
xor edx, edx
mov dh, byte [esp + 0x12]
mov ecx, eax
shr ecx, 0x18
or ecx, edx
mov edx, eax
and edx, 0xff00
shl edx, 8
or ecx, edx
shl eax, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
push esi
push ebx
lea eax, [esp + 0x10]
push 4
push eax
call fcn.1000e456
mov ax, word [0x1002b4d8]
add esp, 0x10
cmp ax, bx
jne 0x10002072
cmp word [0x1002b4dc], 0
jne 0x100020a5
mov eax, dword [esp + 8]
xor edx, edx
mov dh, byte [esp + 0xa]
mov ecx, eax
shr ecx, 0x18
or ecx, edx
mov edx, eax
and edx, 0xff00
shl edx, 8
or ecx, edx
shl eax, 0x18
or eax, ecx
jmp 0x100020a9
test ax, ax
jne 0x100020a5
cmp word [0x1002b4dc], bx
jne 0x100020a5
mov eax, dword [esp + 8]
xor edx, edx
mov dh, byte [esp + 0xa]
mov ecx, eax
shr ecx, 0x18
or ecx, edx
mov edx, eax
and edx, 0xff00
shl edx, 8
or ecx, edx
shl eax, 0x18
or eax, ecx
jmp 0x100020a9
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [ebp + 0x2f8], eax
mov byte [ebp + 0x2f0], bl
mov dword [ebp + 0x2f4], ecx
mov byte [ebp + 0x2a4], bl
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x10002120
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 1
lea eax, [esp + 0x14]
push 4
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
call fcn.1000e456
mov ax, word [0x1002b4d8]
add esp, 0x10
cmp ax, 1
jne 0x1000215e
cmp word [0x1002b4dc], 0
jmp 0x1000216b
test ax, ax
jne 0x10002194
cmp word [0x1002b4dc], 1
jne 0x10002194
mov eax, dword [esp + 0xc]
xor edx, edx
mov dh, byte [esp + 0xe]
mov ecx, eax
shr ecx, 0x18
or ecx, edx
mov edx, eax
and edx, 0xff00
shl edx, 8
or ecx, edx
shl eax, 0x18
or eax, ecx
mov dword [esp + 0xc], eax
push esi
push 1
lea eax, [esp + 0xc]
push 4
push eax
call fcn.1000e456
mov ax, word [0x1002b4d8]
add esp, 0x10
cmp ax, 1
jne 0x100021e1
cmp word [0x1002b4dc], 0
jne 0x10002215
mov eax, dword [esp + 4]
xor edx, edx
mov dh, byte [esp + 6]
mov ecx, eax
shr ecx, 0x18
or ecx, edx
mov edx, eax
and edx, 0xff00
shl edx, 8
or ecx, edx
shl eax, 0x18
or eax, ecx
jmp 0x10002219
test ax, ax
jne 0x10002215
cmp word [0x1002b4dc], 1
jne 0x10002215
mov eax, dword [esp + 4]
xor edx, edx
mov dh, byte [esp + 6]
mov ecx, eax
shr ecx, 0x18
or ecx, edx
mov edx, eax
and edx, 0xff00
shl edx, 8
or ecx, edx
shl eax, 0x18
or eax, ecx
jmp 0x10002219
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x68], ecx
mov byte [ebp + 0x64], 1
mov byte [ebp], 1
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x10002270
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 1
lea eax, [esp + 0x14]
push 4
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], 0
call fcn.1000e456
mov ax, word [0x1002b4d8]
add esp, 0x10
cmp ax, 1
jne 0x100022ae
cmp word [0x1002b4dc], 0
jmp 0x100022bb
test ax, ax
jne 0x100022e4
cmp word [0x1002b4dc], 1
jne 0x100022e4
mov eax, dword [esp + 0xc]
xor edx, edx
mov dh, byte [esp + 0xe]
mov ecx, eax
shr ecx, 0x18
or ecx, edx
mov edx, eax
and edx, 0xff00
shl edx, 8
or ecx, edx
shl eax, 0x18
or eax, ecx
mov dword [esp + 0xc], eax
push esi
push 1
lea eax, [esp + 0xc]
push 4
push eax
call fcn.1000e456
mov ax, word [0x1002b4d8]
add esp, 0x10
cmp ax, 1
jne 0x10002331
cmp word [0x1002b4dc], 0
jne 0x10002365
mov eax, dword [esp + 4]
xor edx, edx
mov dh, byte [esp + 6]
mov ecx, eax
shr ecx, 0x18
or ecx, edx
mov edx, eax
and edx, 0xff00
shl edx, 8
or ecx, edx
shl eax, 0x18
or eax, ecx
jmp 0x10002369
test ax, ax
jne 0x10002365
cmp word [0x1002b4dc], 1
jne 0x10002365
mov eax, dword [esp + 4]
xor edx, edx
mov dh, byte [esp + 6]
mov ecx, eax
shr ecx, 0x18
or ecx, edx
mov edx, eax
and edx, 0xff00
shl edx, 8
or ecx, edx
shl eax, 0x18
or eax, ecx
jmp 0x10002369
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov dword [ebp + 0x84], eax
mov dword [ebp + 0x80], ecx
mov byte [ebp + 0x7c], 1
mov byte [ebp], 1
xor eax, eax
pop ebp
pop ecx
ret

Function at 0x10002830
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x10029300]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x10]
push ebx
push eax
xor ebx, ebx
push 4
lea eax, [esp + 0xc]
push 1
push eax
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], bl
mov byte [esp + 0x18], bl
call fcn.1000e456
add esp, 0x10
cmp eax, 4
je 0x10002888
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.1000c4f1
add esp, 0xc
ret
mov ecx, dword [esp + 4]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0xc]
mov byte [esi + 8], bl
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1000c4f1
add esp, 0xc
ret

Function at 0x100028b0
Capabilities:
Read file on windows

Disassembly:
push ecx
push eax
push 1
lea ecx, [esp + 8]
push 2
push ecx
mov dword [esp + 0x10], 0
call fcn.1000e456
mov ax, word [0x1002b4d8]
add esp, 0x10
cmp ax, 1
jne 0x100028f2
cmp word [0x1002b4dc], 0
jne 0x10002924
mov eax, dword [esp]
movzx dx, ah
mov dh, al
movzx eax, dx
mov word [esi], ax
pop ecx
ret
test ax, ax
jne 0x10002912
cmp word [0x1002b4dc], 1
jne 0x1000291b
mov eax, dword [esp]
movzx cx, ah
mov ch, al
movzx eax, cx
mov word [esi], ax
pop ecx
ret
mov dx, word [esp]
mov word [esi], dx
pop ecx
ret
mov ax, word [esp]
mov word [esi], ax
pop ecx
ret
mov cx, word [esp]
mov word [esi], cx
pop ecx
ret
Function at 0x10002930
Capabilities:
Read file on windows

Disassembly:
push ecx
push eax
push 1
push 4
push esi
call fcn.1000e456
mov ax, word [0x1002b4d8]
add esp, 0x10
cmp ax, 1
jne 0x10002955
cmp word [0x1002b4dc], 0
jmp 0x10002962
test ax, ax
jne 0x1000298a
cmp word [0x1002b4dc], 1
jne 0x1000298a
mov eax, dword [esi]
xor edx, edx
mov dword [esp], eax
mov dh, byte [esp + 2]
mov ecx, eax
shr ecx, 0x18
or ecx, edx
mov edx, eax
and edx, 0xff00
shl edx, 8
or ecx, edx
shl eax, 0x18
or eax, ecx
mov dword [esi], eax
xor ax, ax
pop ecx
ret

Function at 0x10002990
Capabilities:
Read file on windows

Disassembly:
push ecx
push eax
push 1
lea ecx, [esp + 8]
push 4
push ecx
mov dword [esp + 0x10], 0
call fcn.1000e456
mov ax, word [0x1002b4d8]
add esp, 0x10
cmp ax, 1
jne 0x100029e7
cmp word [0x1002b4dc], 0
jne 0x10002a04
mov eax, dword [esp]
xor edx, edx
mov dh, byte [esp + 2]
mov ecx, eax
shr ecx, 0x18
or ecx, edx
mov edx, eax
and edx, 0xff00
shl edx, 8
or ecx, edx
shl eax, 0x18
or eax, ecx
mov dword [esi], eax
pop ecx
ret
test ax, ax
jne 0x100029fd
cmp word [0x1002b4dc], 1
je 0x100029c1
mov ecx, dword [esp]
mov dword [esi], ecx
pop ecx
ret
mov eax, dword [esp]
mov dword [esi], eax
pop ecx
ret
mov edx, dword [esp]
mov dword [esi], edx
pop ecx
ret

Function at 0x10002a10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, eax
push edi
call fcn.1000dcb5
mov ebp, eax
xor ebx, ebx
add esp, 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.10001650
cmp ax, 0xffff
je 0x10002aec
push esi
push edi
push 1
lea eax, [esp + 0x18]
push 2
push eax
mov dword [esp + 0x20], ebx
call fcn.1000e456
mov ax, word [0x1002b4d8]
add esp, 0x10
cmp ax, 1
jne 0x10002a7b
cmp word [0x1002b4dc], bx
jne 0x10002a99
mov eax, dword [esp + 0x10]
movzx cx, ah
mov ch, al
movzx esi, cx
jmp 0x10002a9d
test ax, ax
jne 0x10002a99
cmp word [0x1002b4dc], 1
jne 0x10002a99
mov eax, dword [esp + 0x10]
movzx dx, ah
mov dh, al
movzx esi, dx
jmp 0x10002a9d
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x34]
push edi
call fcn.10002b50
add esp, 0x10
cmp eax, 0xffffffff
je 0x10002ae7
movzx eax, si
push 1
sub eax, 2
push eax
push edi
call fcn.1000ddaa
add esp, 0xc
lea eax, [esp + 0x14]
call fcn.10001650
cmp ax, 0xffff
jne 0x10002a41
mov ebx, dword [esp + 0x18]
pop esi
push 0
push ebp
push edi
call fcn.1000ddaa
mov eax, ebx
add esp, 0xc
and eax, 2
je 0x10002b10
test bl, 1
je 0x10002b10
pop edi
pop ebp
mov eax, 2
pop ebx
add esp, 0xc
ret
test bl, 4
je 0x10002b2b
mov ecx, dword [esp + 0x28]
mov dword [ecx], 1
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
test bl, 8
je 0x10002b1f
test bl, 1
jne 0x10002b1f
test eax, eax
jne 0x10002b1f
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
Function at 0x10004180
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, eax
push edi
call fcn.1000dcb5
movzx ebp, word [0x1002b4dc]
add esp, 4
xor ebx, ebx
mov esi, eax
mov eax, dword [esp + 0x20]
push ebx
push eax
push edi
mov word [0x1002b4dc], bx
mov dword [esp + 0x20], ebx
call fcn.1000ddaa
lea ecx, [esp + 0x20]
add esp, 0xc
push ecx
call fcn.10004280
add esp, 4
test eax, eax
je 0x100041e5
push ebx
push esi
push edi
mov word [0x1002b4dc], bp
call fcn.1000ddaa
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push edi
push 1
lea edx, [esp + 0x1b]
push 1
push edx
mov byte [esp + 0x23], bl
call fcn.1000e456
push edi
push 1
lea eax, [esp + 0x2a]
push 1
push eax
mov byte [esp + 0x32], bl
call fcn.1000e456
add esp, 0x20
cmp byte [esp + 0x12], 1
jne 0x100041c8
push edi
call fcn.1000dcb5
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
add esp, 4
add eax, 4
mov ebx, edi
call fcn.100043a0
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 0x10]
cmp eax, 0x73636e72
je 0x10004245
cmp eax, 0x6d6e7472
jne 0x1000425a
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push edx
push ecx
push eax
mov eax, edi
call fcn.100044b0
add esp, 0xc
push 0
push esi
push edi
call fcn.1000ddaa
add esp, 0xc
pop edi
pop esi
mov word [0x1002b4dc], bp
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret

Function at 0x10004280
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [0x10029300]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
xor ebx, ebx
mov eax, edi
lea esi, [esp + 0xc]
mov dword [esp + 0xc], ebx
call fcn.100028b0
cmp word [esp + 0xc], 0xffe2
jne 0x1000437d
mov eax, edi
lea esi, [esp + 0xc]
mov dword [esp + 0xc], ebx
call fcn.100028b0
mov eax, dword [esp + 0xc]
cmp ax, 0xe
jb 0x1000437d
push edi
push 0xc
mov word [ebp], ax
lea eax, [esp + 0x18]
push 1
push eax
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], bl
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
call fcn.1000e456
mov al, 0x49
add esp, 0x10
cmp byte [esp + 0x10], al
jne 0x1000437d
mov cl, 0x43
cmp byte [esp + 0x11], cl
jne 0x1000437d
cmp byte [esp + 0x12], cl
jne 0x1000437d
cmp byte [esp + 0x13], 0x5f
jne 0x1000437d
cmp byte [esp + 0x14], 0x50
jne 0x1000437d
cmp byte [esp + 0x15], 0x52
jne 0x1000437d
cmp byte [esp + 0x16], 0x4f
jne 0x1000437d
cmp byte [esp + 0x17], 0x46
jne 0x1000437d
cmp byte [esp + 0x18], al
jne 0x1000437d
cmp byte [esp + 0x19], 0x4c
jne 0x1000437d
cmp byte [esp + 0x1a], 0x45
jne 0x1000437d
cmp byte [esp + 0x1b], bl
jne 0x1000437d
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1000c4f1
add esp, 0x14
ret
mov ecx, dword [esp + 0x1c]
pop esi
pop ebp
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.1000c4f1
add esp, 0x14
ret
Function at 0x100043a0
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, eax
mov eax, ebx
mov esi, edi
call fcn.10002990
lea esi, [edi + 4]
mov eax, ebx
call fcn.10002990
lea esi, [edi + 8]
mov eax, ebx
call fcn.10002990
lea esi, [edi + 0xc]
mov eax, ebx
call fcn.10002990
lea esi, [edi + 0x10]
mov eax, ebx
call fcn.10002990
lea esi, [edi + 0x14]
mov eax, ebx
call fcn.10002990
lea esi, [edi + 0x18]
mov eax, ebx
call fcn.100028b0
lea esi, [edi + 0x1a]
mov eax, ebx
call fcn.100028b0
lea esi, [edi + 0x1c]
mov eax, ebx
call fcn.100028b0
lea esi, [edi + 0x1e]
mov eax, ebx
call fcn.100028b0
lea esi, [edi + 0x20]
mov eax, ebx
call fcn.100028b0
lea esi, [edi + 0x22]
mov eax, ebx
call fcn.100028b0
lea esi, [edi + 0x24]
mov eax, ebx
call fcn.10002990
lea esi, [edi + 0x28]
mov eax, ebx
call fcn.10002990
lea esi, [edi + 0x2c]
mov eax, ebx
call fcn.10002990
lea esi, [edi + 0x30]
mov eax, ebx
call fcn.10002990
lea esi, [edi + 0x34]
mov eax, ebx
call fcn.10002990
push ebx
push 8
lea eax, [edi + 0x38]
push 1
push eax
call fcn.1000e456
lea esi, [edi + 0x40]
mov eax, ebx
call fcn.10002990
lea esi, [edi + 0x44]
mov eax, ebx
call fcn.10002930
lea esi, [edi + 0x48]
mov eax, ebx
call fcn.10002930
lea esi, [edi + 0x4c]
mov eax, ebx
call fcn.10002930
lea esi, [edi + 0x50]
mov eax, ebx
call fcn.10002990
push ebx
push 0x2c
add edi, 0x54
push 1
push edi
call fcn.1000e456
add esp, 0x20
pop edi
xor eax, eax
pop esi
ret
Function at 0x10006940
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, eax
lea eax, [ebx + 0x300]
mov dword [esp + 0x14], eax
mov eax, dword [ebp]
lea edx, [eax + 0xd778]
lea ecx, [ebx + 0x400]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
push eax
lea ecx, [esp + 0x10]
push ecx
push edi
mov dword [esp + 0x28], edx
call fcn.10006df0
add esp, 0xc
test eax, eax
jne 0x100069af
push ebx
push edi
push esi
lea ecx, [esp + 0x18]
call fcn.10006aa0
add esp, 0xc
test eax, eax
jne 0x100069af
mov edx, dword [esp + 0xc]
pop esi
mov dword [ebp], edx
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
mov eax, dword [ebp]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
push edi
call fcn.10006f60
add esp, 8
test eax, eax
jne 0x100069df
push ebx
push edi
push esi
lea ecx, [esp + 0x18]
call fcn.10006aa0
add esp, 0xc
test eax, eax
je 0x1000699f
mov eax, dword [esi]
push eax
call fcn.1000dcb5
push 2
mov ebx, eax
mov eax, dword [esi]
push 0
push eax
call fcn.1000ddaa
mov ecx, dword [esi]
push ecx
call fcn.1000dcb5
mov edx, dword [esi]
push 0
push ebx
push edx
mov dword [esp + 0x30], eax
call fcn.1000ddaa
add esp, 0x20
xor ebp, ebp
lea ebx, [esp + 0x14]
mov eax, dword [ebx]
cmp dword [esp + 0x10], eax
jl 0x10006a7f
push 0
push eax
mov eax, dword [esi]
push eax
call fcn.1000ddaa
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x20]
push 2
push edx
mov dword [esp + 0x28], 0
call fcn.1000e456
mov eax, dword [esp + 0x28]
add esp, 0x1c
cmp edi, 0x4d4d
jne 0x10006a59
movzx cx, ah
mov ch, al
movzx eax, cx
cmp ax, 0xe00
jne 0x10006a74
mov edx, dword [esp + 0x2c]
push edx
push edi
push esi
mov ecx, ebx
call fcn.10006aa0
add esp, 0xc
test eax, eax
je 0x10006a8b
add ebp, 1
add ebx, 4
cmp ebp, 3
jl 0x10006a15
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + ebp*4 + 0x14]
mov ecx, dword [esp + 0x24]
pop esi
pop ebp
mov dword [ecx], eax
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x10006df0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esi]
sub esp, 0x10
push ebx
mov ebx, dword [eax]
push ebp
mov ebp, dword [esp + 0x24]
push edi
push 0
push ebx
push ecx
call fcn.1000ddaa
add esp, 0xc
xor edi, edi
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x17]
push 1
push eax
mov byte [esp + 0x1f], 0
call fcn.1000e456
add esp, 0x10
cmp byte [esp + 0xf], 0
je 0x10006e44
add edi, 1
cmp edi, 0x14
jb 0x10006e10
pop edi
pop ebp
mov eax, 2
pop ebx
add esp, 0x10
ret
cmp edi, 0x14
jae 0x10006e38
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x20]
push 2
push edx
mov dword [esp + 0x28], 0
call fcn.1000e456
mov edx, dword [esi]
push edx
lea eax, [ebx + edi + 3]
push 1
mov dword [esp + 0x28], eax
mov ecx, 0xfffffffd
lea eax, [esp + 0x2c]
sub ecx, edi
push 2
push eax
add ebp, ecx
mov dword [esp + 0x34], 0
call fcn.1000e456
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
add esp, 0x20
cmp ebx, 0x4d4d
jne 0x10006ea8
movzx cx, ah
mov ch, al
movzx eax, cx
add dword [esp + 0x10], 2
movsx eax, ax
lea edx, [eax + eax*2]
add edx, edx
sub ebp, 2
add edx, edx
cmp edx, ebp
ja 0x10006e38
mov ecx, dword [esp + 0x10]
add eax, 0xffffffff
mov dword [esp + 0x18], eax
lea eax, [eax + eax*2]
lea edi, [ecx + eax*4]
test ebp, ebp
jle 0x10006e38
mov edx, dword [esi]
push 0
push edi
push edx
call fcn.1000ddaa
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x28]
push 2
push ecx
sub ebp, 0xc
mov dword [esp + 0x30], 0
call fcn.1000e456
mov eax, dword [esp + 0x30]
add esp, 0x1c
cmp ebx, 0x4d4d
jne 0x10006f1a
movzx dx, ah
mov dh, al
movzx eax, dx
movsx eax, ax
cmp eax, 0xe00
je 0x10006f34
jb 0x10006e38
sub dword [esp + 0x18], 1
sub edi, 0xc
jmp 0x10006ed3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
lea eax, [eax + eax*2]
lea edx, [ecx + eax*4]
mov eax, dword [esp + 0x24]
pop edi
pop ebp
mov dword [eax], edx
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x10006f60
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov ecx, dword [esi]
push ebx
push edi
mov ebx, eax
mov eax, dword [esp + 0x18]
mov edi, dword [eax]
push 0
push edi
push ecx
call fcn.1000ddaa
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x1c]
push 2
push eax
mov dword [esp + 0x24], 0
call fcn.1000e456
mov eax, dword [esp + 0x24]
add esp, 0x1c
cmp dword [esp + 0x14], 0x4d4d
jne 0x10006fab
movzx cx, ah
mov ch, al
movzx eax, cx
movsx eax, ax
lea edx, [eax + eax*2]
add edx, edx
add edi, 2
sub ebx, 2
add edx, edx
cmp edx, ebx
mov dword [esp + 0xc], edi
jbe 0x10006fce
pop edi
mov eax, 2
pop ebx
add esp, 8
ret
push ebp
lea ebp, [eax - 1]
lea eax, [ebp + ebp*2]
lea edi, [edi + eax*4]
lea esp, [esp]
test ebx, ebx
jle 0x10007053
mov ecx, dword [esi]
push 0
push edi
push ecx
call fcn.1000ddaa
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x20]
push 2
push eax
sub ebx, 0xc
mov dword [esp + 0x28], 0
call fcn.1000e456
mov eax, dword [esp + 0x28]
add esp, 0x1c
cmp dword [esp + 0x18], 0x4d4d
jne 0x10007025
movzx cx, ah
mov ch, al
movzx eax, cx
movsx eax, ax
cmp eax, 0xe00
je 0x10007039
jb 0x10007053
sub ebp, 1
sub edi, 0xc
jmp 0x10006fe0
mov eax, dword [esp + 0x10]
lea edx, [ebp + ebp*2]
lea ecx, [eax + edx*4]
mov edx, dword [esp + 0x1c]
pop ebp
pop edi
mov dword [edx], ecx
xor eax, eax
pop ebx
add esp, 8
ret
pop ebp
pop edi
mov eax, 2
pop ebx
add esp, 8
ret

Function at 0x10007060
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [eax]
push ecx
push 1
lea edx, [esp + 0xb]
push 1
push edx
mov byte [esp + 0x13], 0
call fcn.1000e456
mov al, byte [esp + 0x13]
add esp, 0x14
ret

Function at 0x10007080
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [eax]
push ecx
push 1
lea edx, [esp + 8]
push 2
push edx
mov dword [esp + 0x10], 0
call fcn.1000e456
add esp, 0x10
cmp dword [esp + 8], 0x4d4d
jne 0x100070b8
mov eax, dword [esp]
movzx cx, ah
mov ch, al
movzx eax, cx
movsx eax, ax
pop ecx
ret
movsx eax, word [esp]
pop ecx
ret
Function at 0x10007950
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
mov eax, dword [0x10029300]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp]
push esi
push edi
xor ebx, ebx
push ebx
mov esi, ecx
push eax
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
push eax
call fcn.1000ddaa
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x27]
push 1
push edx
mov byte [esp + 0x2f], bl
call fcn.1000e456
mov ecx, dword [esi]
movzx eax, byte [esp + 0x2f]
push ecx
push 1
lea edx, [esp + 0x37]
push 1
push edx
mov byte [esp + 0x44], al
mov byte [esp + 0x3f], bl
call fcn.1000e456
mov ecx, dword [esi]
movzx eax, byte [esp + 0x3f]
push ecx
push 1
lea edx, [esp + 0x47]
push 1
push edx
mov byte [esp + 0x55], al
mov byte [esp + 0x4f], bl
call fcn.1000e456
mov ecx, dword [esi]
movzx eax, byte [esp + 0x4f]
push ecx
push 1
lea edx, [esp + 0x57]
push 1
push edx
mov byte [esp + 0x66], al
mov byte [esp + 0x5f], bl
call fcn.1000e456
mov ecx, dword [esi]
movzx eax, byte [esp + 0x5f]
add esp, 0x4c
push ecx
push 1
lea edx, [esp + 0x1b]
push 1
push edx
mov byte [esp + 0x2b], al
mov byte [esp + 0x23], bl
call fcn.1000e456
mov ecx, dword [esi]
movzx eax, byte [esp + 0x23]
push ecx
push 1
lea edx, [esp + 0x2b]
push 1
push edx
mov byte [esp + 0x3c], al
mov byte [esp + 0x33], bl
call fcn.1000e456
mov ecx, dword [esi]
movzx eax, byte [esp + 0x33]
push ecx
push 1
mov byte [esp + 0x45], al
mov byte [esp + 0x3b], bl
push 1
lea edx, [esp + 0x3f]
push edx
call fcn.1000e456
mov ecx, dword [esi]
movzx eax, byte [esp + 0x43]
push ecx
push 1
lea edx, [esp + 0x4b]
push 1
push edx
mov byte [esp + 0x5e], al
mov byte [esp + 0x53], bl
call fcn.1000e456
movzx eax, byte [esp + 0x53]
add esp, 0x40
mov edi, str.PrintIM
lea esi, [esp + 0x18]
mov ecx, 8
xor edx, edx
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], bl
repe cmpsb byte [esi], byte es:[edi]
jne 0x10007aa5
mov eax, dword [esp + 0x14]
pop edi
pop esi
mov dword [ebp], eax
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1000c4f1
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 2
call fcn.1000c4f1
add esp, 0x18
ret
Function at 0x1000c4f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029300]
jne 0x1000c4fb
repz ret
jmp fcn.1001004c
Function at 0x1000e759
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10029348]
je 0x1000e774
inc edi
cmp edi, 0x17
jb 0x1000e765
cmp edi, 0x17
jae 0x1000e8f4
push ebp
push 3
call fcn.1001685f
cmp eax, 1
pop ecx
je 0x1000e8c0
push 3
call fcn.1001685f
test eax, eax
pop ecx
jne 0x1000e7a8
cmp dword [0x1002aa10], 1
je 0x1000e8c0
cmp ebx, 0xfc
je 0x1000e8f3
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x1002aa20
push ebp
call fcn.1000caeb
add esp, 0xc
test eax, eax
je 0x1000e7de
push esi
push esi
push esi
push esi
push esi
call fcn.1000d2e2
add esp, 0x14
push 0x104
mov esi, 0x1002aa39
push esi
push 0
mov byte [0x1002ab3d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000e822
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000caeb
add esp, 0xc
test eax, eax
je 0x1000e822
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1000d2e2
add esp, 0x14
push esi
call fcn.1000e480
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1000e867
push esi
call fcn.1000e480
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1002ad34
push 0x10020be4
sub ecx, eax
push ecx
push eax
call fcn.1000c5f4
add esp, 0x14
test eax, eax
je 0x1000e867
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1000d2e2
add esp, 0x14
jmp 0x1000e869
xor esi, esi
push 0x10020be0
push ebx
push ebp
call fcn.1000cf1a
add esp, 0xc
test eax, eax
je 0x1000e889
push esi
push esi
push esi
push esi
push esi
call fcn.1000d2e2
add esp, 0x14
push dword [edi*8 + 0x1002934c]
push ebx
push ebp
call fcn.1000cf1a
add esp, 0xc
test eax, eax
je 0x1000e8ab
push esi
push esi
push esi
push esi
push esi
call fcn.1000d2e2
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.100166a2
add esp, 0xc
jmp 0x1000e8f3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1000e8f3
cmp ebp, 0xffffffff
je 0x1000e8f3
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1002934c]
push dword [esi]
call fcn.1000e480
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret