joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d7798f3
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
inc ecx
push ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x24], 0x1c
push eax
push esi
call sym.net.dll__NET_SockaddrToInetAddress_12
test eax, eax
jne 0x6d779979
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x6d779957
push str.connect
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call sym.net.dll__NET_SockaddrToInetAddress_12
jmp 0x6d779979
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 0x28]
push eax
push 0x9800000c
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_WSAIoctl]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.6d77b1da
leave
ret 0x14

Function at 0x6d779988
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24], 0
push 0x1c
lea eax, [ebp - 0x20]
push 0
push eax
call sub.msvcr100.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_connect]
push 0
push 0
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push 0x9800000c
push dword [ebp + 0x10]
call dword [sym.imp.ws2_32.dll_WSAIoctl]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.6d77b1da
leave
ret 0xc

Function at 0x6d7799eb
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6d779a33
push str.JVM_GetSockName
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call sym.net.dll__NET_SockaddrToInetAddress_12
or eax, 0xffffffff
jmp 0x6d779a41
movzx eax, word [ebp - 0x1e]
push eax
call dword [sym.imp.ws2_32.dll_ntohs]
movzx eax, ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.6d77b1da
leave
ret 0xc
Function at 0x6d779a50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x1c
call dword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x6d779a97
push str.Error_getting_socket_name
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call sym.net.dll__NET_SockaddrToInetAddress_12
xor eax, eax
jmp 0x6d779aa5
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call sym.net.dll__NET_SockaddrToInetAddress_12
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.6d77b1da
leave
ret 0xc
Function at 0x6d779db9
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x7ac]
sub esp, 0x82c
mov eax, dword [0x6d781098]
xor eax, ebp
mov dword [ebp + 0x7a8], eax
cmp byte [ebp + 0x7d4], 0
mov eax, dword [ebp + 0x7c0]
push esi
mov esi, dword [ebp + 0x7b4]
lea ecx, [ebp - 0x74]
push edi
mov edi, dword [ebp + 0x7c8]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x7cc]
mov dword [ebp - 0x78], 0x1c
mov dword [ebp - 0x7c], ecx
je 0x6d779e11
and dword [ebp - 0x7c], 0
and dword [ebp - 0x78], 0
jmp 0x6d779e30
push 1
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push dword [ebp + 0x7d0]
push eax
push esi
call sym.net.dll__NET_SockaddrToInetAddress_12
test eax, eax
jne 0x6d779eb4
push ebx
cmp edi, 0x800
jle 0x6d779e5f
mov eax, 0x10000
cmp edi, eax
jle 0x6d779e44
mov edi, eax
push edi
call dword [sym.imp.msvcr100.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x6d779e62
push str.heap_allocation_failed
push esi
call sub.java.dll__JNU_ThrowOutOfMemoryError_8
jmp 0x6d779eb3
lea ebx, [ebp - 0x58]
mov eax, dword [esi]
push ebx
push edi
push dword [ebp + 0x7c4]
push dword [ebp - 0x80]
push esi
call dword [eax + 0x320]
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push 0
push edi
push ebx
push dword [ebp + 0x7bc]
call dword [sym.imp.ws2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x6d779ea3
push str.Datagram_send_failed
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
push eax
push esi
call sym.net.dll__NET_SockaddrToInetAddress_12
cmp edi, 0x800
jle 0x6d779eb3
push ebx
call dword [sym.imp.msvcr100.dll_free]
pop ecx
pop ebx
mov ecx, dword [ebp + 0x7a8]
pop edi
xor ecx, ebp
pop esi
call fcn.6d77b1da
add ebp, 0x7ac
leave
ret 0x24
Function at 0x54f158
Capabilities:
Packed with generic packer

Disassembly:
pushal
call fcn.0054f167
salc
out dx, eax
adc al, 0
jmp 0x54f36d
popal
jmp fcn.0049cf88
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b004]
jne 0x40100a
repz ret
jmp fcn.004016ac

Function at 0x409144
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403d07
and dword [ebp - 4], 0
cmp dword [0x4314e0], 0
mov ebx, eax
jne 0x4091f5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4092a6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4092a6
push eax
call fcn.00403c95
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4314e0], eax
call esi
push eax
call fcn.00403c95
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4314e4], eax
call esi
push eax
call fcn.00403c95
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4314e8], eax
call esi
push eax
call fcn.00403c95
pop ecx
mov dword [0x4314f0], eax
test eax, eax
je 0x4091f5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403c95
pop ecx
mov dword [0x4314ec], eax
mov eax, dword [0x4314ec]
cmp eax, ebx
je 0x40924d
cmp dword [0x4314f0], ebx
je 0x40924d
push eax
call fcn.00403d10
push dword [0x4314f0]
mov esi, eax
call fcn.00403d10
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40924d
test edi, edi
je 0x40924d
call esi
test eax, eax
je 0x409244
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409244
test byte [ebp - 0xc], 1
jne 0x40924d
or dword [ebp + 0x10], 0x200000
jmp 0x409286
mov eax, dword [0x4314e4]
cmp eax, ebx
je 0x409286
push eax
call fcn.00403d10
pop ecx
test eax, eax
je 0x409286
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409286
mov eax, dword [0x4314e8]
cmp eax, ebx
je 0x409286
push eax
call fcn.00403d10
pop ecx
test eax, eax
je 0x409286
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4314e0]
call fcn.00403d10
pop ecx
test eax, eax
je 0x4092a6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4092a8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100082c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017fde0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101ae0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.1017e390
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.1017e390
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.1017e390
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.1017e390
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.10169030
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.1017e390
mov ecx, dword [ebp - 0x10]
add ecx, 0x5c
call fcn.10004030
mov dword [ebp - 4], 0
push fcn.10006160
push 0x80
push 0x30
mov eax, dword [ebp - 0x10]
add eax, 0xf0
push eax
call fcn.100083b0
nop
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10010b40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x10010b60
jl 0x10010b57
cmp dword [ebp + 0xc], 0
ja 0x10010b60
xor eax, eax
xor edx, edx
jmp 0x10010ca2
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x10010b82
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.100117a0
jmp 0x10010ca2
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 8]
call fcn.10013390
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x10010bf2
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.100054d0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.100134f0
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10004780
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.10013470
nop
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x10010c93
mov ecx, dword [ebp - 8]
call fcn.10012e70
mov dword [ebp - 0x20], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x10010c62
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.100ca3d4
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x10010c60
xor eax, eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
sbb edx, eax
mov eax, ecx
jmp 0x10010ca2
jmp 0x10010c0e
cmp dword [ebp - 4], 0
jbe 0x10010c93
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.100ca3d4
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10097210
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x1009722f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
jmp 0x1009725f
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax]
xor edx, dword [ebp + 0xc]
imul eax, edx, 0x1000193
push eax
mov ecx, 1
shl ecx, 0
add ecx, dword [ebp + 8]
push ecx
call fcn.10097210
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100a2ed0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10183e5d
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x101ae0c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], 0x224
mov eax, dword [ebp + 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x250], eax
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x100a3058
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x100a3058
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x28]
call fcn.10003f00
mov dword [ebp - 4], 0
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x28]
call fcn.1003aed0
mov ecx, dword [eax]
mov dword [ebp - 0x254], ecx
mov edx, dword [ebp - 0x254]
mov dword [ebp - 0x260], edx
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x28]
call fcn.1003ae80
mov ecx, dword [eax]
mov dword [ebp - 0x258], ecx
mov edx, dword [ebp - 0x258]
mov dword [ebp - 0x264], edx
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x28]
call fcn.1003aed0
mov ecx, dword [eax]
mov dword [ebp - 0x25c], ecx
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 0x268], edx
push fcn.100cc236
mov eax, dword [ebp - 0x260]
push eax
mov ecx, dword [ebp - 0x264]
push ecx
mov edx, dword [ebp - 0x268]
push edx
lea eax, [ebp - 0x27c]
push eax
call fcn.1003b020
add esp, 0x14
push 0x811c9dc5
lea ecx, [ebp - 0x28]
call fcn.10011bd0
push eax
call fcn.10097210
add esp, 8
cmp eax, dword [ebp + 8]
jne 0x100a3043
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x26c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10003e70
mov eax, dword [ebp - 0x26c]
jmp 0x100a3067
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10003e70
nop
jmp 0x100a2f33
mov eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100bdc32
mov esp, ebp
pop ebp
ret
Function at 0x100a3080
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0x100a3094
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x100a3099
mov eax, dword [ebp + 8]
jmp 0x100a3100
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 0x14]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + edx + 0x18]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
jmp 0x100a30bc
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 6]
cmp dword [ebp - 8], ecx
jae 0x100a30f1
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0xc]
jb 0x100a30e6
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 8]
cmp dword [ebp + 8], edx
jae 0x100a30e6
jmp 0x100a30f1
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
jmp 0x100a30b3
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
sub eax, dword [edx + 0xc]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x100a3110
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x100a3131
xor eax, eax
jmp 0x100a3269
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x3c]
add ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0x4550
je 0x100a314f
xor eax, eax
jmp 0x100a3269
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax + 0x78]
push edx
call fcn.100a3080
add esp, 0xc
add eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x20]
push eax
call fcn.100a3080
add esp, 0xc
add eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 8], 0
jmp 0x100a31ad
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x14]
jae 0x100a31f9
movzx ecx, byte [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax*4]
push edx
call fcn.100a3080
add esp, 0xc
add eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push 0x811c9dc5
mov eax, dword [ebp - 0x1c]
push eax
call fcn.10097210
add esp, 8
cmp eax, dword [ebp + 0xc]
jne 0x100a31f7
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
jmp 0x100a31f9
jmp 0x100a31a4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx + 0x14]
jbe 0x100a3208
xor eax, eax
jmp 0x100a3269
movzx ecx, byte [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
push ecx
call fcn.100a3080
add esp, 0xc
add eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
movzx edx, byte [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
push edx
call fcn.100a3080
add esp, 0xc
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + ecx*4]
push eax
call fcn.100a3080
add esp, 0xc
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x100a4840
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018401d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x101ae0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.10003ac0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x101a0094
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], str.Default
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], str.cs_baggage_skybox_
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], str.cs_tibet
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], str.embassy
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], str.italy
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], str.jungle
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], str.nukeblank
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], str.office
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], str.sky_csgo_cloudy01
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x28], str.sky_csgo_night02
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], str.sky_csgo_night02b
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], str.sky_dust
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], str.sky_venice
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], str.vertigo
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x3c], str.vietnam
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x40], str.sky_descent
mov edx, dword [ebp - 0x10]
add edx, 0x44
mov dword [ebp - 0x14], edx
push ecx
movss xmm0, dword [0x101a0288]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x101a0288]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x101a0288]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x101a0288]
movss dword [esp], xmm0
mov ecx, dword [ebp - 0x14]
call fcn.100237a0
mov eax, dword [ebp - 0x10]
add eax, 0x54
mov dword [ebp - 0x18], eax
push ecx
movss xmm0, dword [0x101a0288]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x101a0288]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x101a0288]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x101a0288]
movss dword [esp], xmm0
mov ecx, dword [ebp - 0x18]
call fcn.100237a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
mov dword [ebp - 0x1c], ecx
push ecx
movss xmm0, dword [0x101a0288]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x101a0288]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x101a0288]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [0x101a0288]
movss dword [esp], xmm0
mov ecx, dword [ebp - 0x1c]
call fcn.100237a0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x74], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100aed30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10184433
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x101ae0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.100af0b0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
add edx, 0xc
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
call fcn.100af030
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
add edx, 0x18
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.100aefb0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
add eax, 0x30
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
add ecx, 0x30
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.100aee70
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1870]
mov dword [edx + 0x1870], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1874]
mov dword [edx + 0x1874], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x1878]
mov byte [edx + 0x1878], cl
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x1879]
mov byte [edx + 0x1879], cl
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x187a]
mov byte [edx + 0x187a], cl
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x187b]
mov byte [edx + 0x187b], cl
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x187c]
mov byte [edx + 0x187c], cl
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x187d]
mov byte [edx + 0x187d], cl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4