joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e9b80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
push 0xe
mov ecx, 0x104e1ca8
call fcn.100b63d0
movzx eax, al
test eax, eax
jne 0x100e9bac
xor al, al
jmp 0x100e9d4f
mov dword [ebp - 0x34], 0x20
mov dword [ebp - 0x30], 0x21
mov dword [ebp - 0x2c], 0x22
mov dword [ebp - 0x28], 0x23
mov dword [ebp - 0x24], 0x24
mov dword [ebp - 0x20], 0x25
mov dword [ebp - 0x1c], 0x26
mov dword [ebp - 4], 0
jmp 0x100e9bef
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 7
jge 0x100e9cb5
mov edx, dword [ebp - 4]
movzx eax, word [ebp + edx*4 - 0x34]
push eax
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx ecx, al
test ecx, ecx
je 0x100e9cb0
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x34]
shl eax, 6
movzx ecx, byte [eax + 0x104e1d65]
test ecx, ecx
je 0x100e9cb0
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x34]
shl eax, 6
mov ecx, dword [ebp - 8]
sub ecx, dword [eax + 0x104e1d60]
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0x201
jne 0x100e9c67
mov edx, dword [ebp - 4]
mov eax, dword [ebp + edx*4 - 0x34]
shl eax, 6
mov byte [eax + 0x104e1d64], 1
mov al, 1
jmp 0x100e9d4f
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*4 - 0x34]
shl edx, 6
mov byte [edx + 0x104e1d64], 0
cmp dword [ebp - 0x10], 0x1f4
jae 0x100e9c88
xor al, al
jmp 0x100e9d4f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0x34]
shl ecx, 6
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0x104e1d60], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100e9d60
jmp 0x100e9be6
push 0x27
mov ecx, 0x104e1ca8
call fcn.100b6460
movzx ecx, al
test ecx, ecx
je 0x100e9d4d
mov edx, 0x40
imul eax, edx, 0x27
movzx ecx, byte [eax + 0x104e1d65]
test ecx, ecx
jne 0x100e9ce3
xor al, al
jmp 0x100e9d4f
mov edx, 0x40
imul eax, edx, 0x27
mov ecx, dword [ebp - 8]
sub ecx, dword [eax + 0x104e1d60]
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 8], 0x201
jne 0x100e9d13
mov edx, 0x40
imul eax, edx, 0x27
mov byte [eax + 0x104e1d64], 1
mov al, 1
jmp 0x100e9d4f
mov ecx, 0x40
imul edx, ecx, 0x27
mov byte [edx + 0x104e1d64], 0
cmp dword [ebp - 0x18], 0x1f4
jae 0x100e9d2f
xor al, al
jmp 0x100e9d4f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x27
mov dword [edx + 0x104e1d60], eax
push 7
mov ecx, dword [ebp - 0xc]
call fcn.100e9d60
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x100ea1d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], ecx
push 0
push 0x80
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x100ea20f
xor al, al
jmp 0x100ea350
push 0
lea ecx, [ebp - 0x18]
push ecx
push 6
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx ecx, word [ebp - 0x20]
movzx edx, word [ebp + 0xc]
cmp ecx, edx
jne 0x100ea237
cmp dword [ebp - 0x1e], 0x36
je 0x100ea248
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100ea350
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
jne 0x100ea25b
mov edx, dword [ebp - 0x34]
add edx, 4
mov dword [ebp - 0x38], edx
jmp 0x100ea264
mov eax, dword [ebp - 0x34]
add eax, 0x34
mov dword [ebp - 0x38], eax
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0x10
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x28], 0
jmp 0x100ea28c
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 4
jge 0x100ea2ae
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
mov edx, dword [eax + edx*4 + 0x64]
xor edx, dword [ebp + ecx*4 - 0x14]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + eax*4], edx
jmp 0x100ea283
push 0
lea edx, [ebp - 0x18]
push edx
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x2c], 0
jmp 0x100ea2d6
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 4
jge 0x100ea2f9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ecx + eax*4 + 0x64]
xor eax, dword [ebp + edx*4 - 0x14]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x38]
mov dword [edx + ecx*4 + 0x10], eax
jmp 0x100ea2cd
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x30], 0
jmp 0x100ea321
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x100ea344
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov ecx, dword [edx + ecx*4 + 0x64]
xor ecx, dword [ebp + eax*4 - 0x14]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov dword [eax + edx*4 + 0x20], ecx
jmp 0x100ea318
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100f29f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push 7
mov ecx, 0x104e1ca8
call fcn.100b63d0
movzx eax, al
test eax, eax
jne 0x100f2a85
push 8
mov ecx, 0x104e1ca8
call fcn.100b63d0
movzx ecx, al
test ecx, ecx
jne 0x100f2a85
push 0xc
mov ecx, 0x104e1ca8
call fcn.100b63d0
movzx edx, al
test edx, edx
jne 0x100f2a85
push 0xe
mov ecx, 0x104e1ca8
call fcn.100b63d0
movzx eax, al
test eax, eax
jne 0x100f2a85
push 0xf
mov ecx, 0x104e1ca8
call fcn.100b63d0
movzx ecx, al
test ecx, ecx
jne 0x100f2a85
push 0x41
mov ecx, 0x104e1ca8
call fcn.100b63d0
movzx edx, al
test edx, edx
jne 0x100f2a85
push 0x4e
mov ecx, 0x104e1ca8
call fcn.100b63d0
movzx eax, al
test eax, eax
je 0x100f2a8a
jmp 0x100f2b21
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
je 0x100f2b21
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x104fa43c]
add edx, 0xfa
cmp eax, edx
jb 0x100f2b21
cmp dword [0x10294ee0], 1
je 0x100f2b21
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
movsx edx, word [ecx]
test edx, edx
jge 0x100f2ad2
jmp 0x100f2b21
mov byte [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
push 8
push 1
push 0x79
lea ecx, [ebp - 0xc]
call fcn.100285f0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + 0x43]
mov byte [ebp - 6], dl
mov byte [ebp - 5], 0
movzx eax, byte [ebp - 0xb]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.10119730
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x104fa43c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret

Function at 0x100f7930
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x8d
sub eax, dword [edx + 0x104e1d60]
cmp eax, 0x3e8
jae 0x100f795a
jmp 0x100f79dd
cmp dword [0xe61e18], 0x3e
jne 0x100f7981
push str.Camera3D_not_available_for_this_map
push 1
push 0x104e1ca8
call fcn.100b7280
add esp, 0xc
mov ecx, 0x104fa478
call fcn.100f69a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x8d
mov dword [edx + 0x104e1d60], eax
mov ecx, 0x104fa478
call fcn.100f6970
mov ecx, 0x104fa478
call fcn.100f6940
movzx eax, al
test eax, eax
je 0x100f79c9
push str.Camera3D__On_
push 1
push 0x104e1ca8
call fcn.100b7280
add esp, 0xc
jmp 0x100f79dd
push str.Camera3D__Off_
push 1
push 0x104e1ca8
call fcn.100b7280
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100f79f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x8c
sub eax, dword [edx + 0x104e1d60]
cmp eax, 0x3e8
jae 0x100f7a17
jmp 0x100f7a49
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40
imul edx, ecx, 0x8c
mov dword [edx + 0x104e1d60], eax
mov ecx, 0x104fa478
call fcn.100f6940
movzx eax, al
test eax, eax
je 0x100f7a49
mov ecx, 0x104fa478
call fcn.100f69a0
mov esp, ebp
pop ebp
ret
Function at 0x10105530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
call fcn.101a343a
cdq
mov ecx, 0x3e8
idiv ecx
push edx
push str.DataItemTemp_t_d
mov edx, dword [ebp - 0xc]
add edx, 0xc
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x10102
push 2
push 0
push 7
push 0x40000000
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x10105592
xor al, al
jmp 0x101055e0
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
sub eax, 8
push eax
mov ecx, 1
shl ecx, 3
mov edx, dword [ebp - 0xc]
add ecx, dword [edx + 4]
push ecx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x101055d4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x101055e0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret

Function at 0x101055f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], 0x101f0ed7
mov eax, dword [ebp - 8]
add eax, 0xc
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0x10]
cmp dl, byte [eax]
jne 0x10105646
cmp byte [ebp - 1], 0
je 0x1010563d
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 1]
mov byte [ebp - 2], dl
mov eax, dword [ebp - 0x10]
cmp dl, byte [eax + 1]
jne 0x10105646
add dword [ebp - 0xc], 2
add dword [ebp - 0x10], 2
cmp byte [ebp - 2], 0
jne 0x10105609
mov dword [ebp - 0x14], 0
jmp 0x1010564e
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
je 0x10105663
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
jne 0x10105665
jmp 0x101056b7
mov ecx, dword [ebp - 8]
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10105678
jmp 0x101056b7
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.1014c91d
add esp, 4
mov edx, dword [ebp - 8]
mov dword [edx + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
push 0x100
push 0
mov ecx, dword [ebp - 8]
add ecx, 0xc
push ecx
call fcn.1019aa40
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10108190
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
call fcn.10108140
add esp, 4
call fcn.101d4670
mov word [ebp - 2], ax
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
call fcn.100a6020
add esp, 4
call fcn.101d4670
mov word [ebp - 4], ax
movzx eax, word [ebp - 2]
push eax
movzx ecx, word [ebp - 4]
push ecx
cvttss2si edx, dword [ebp + 0x10]
movzx eax, dx
push eax
cvttss2si ecx, dword [ebp + 0xc]
movzx edx, cx
push edx
call fcn.100a60b0
add esp, 0x10
movzx eax, al
test eax, eax
je 0x10108347
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
je 0x101082a7
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x18]
divss xmm0, dword [ebp + 0x20]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x14]
divss xmm0, dword [ebp + 0x1c]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x18]
divss xmm0, dword [ebp + 0x20]
cvtss2sd xmm0, xmm0
mulsd xmm0, qword [0x101f98d8]
cvtsd2ss xmm0, xmm0
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov edx, dword [ebp + 8]
push edx
mov eax, 0x637c60
call eax
add esp, 0x30
jmp 0x10108327
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x18]
divss xmm0, dword [ebp + 0x20]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x14]
divss xmm0, dword [ebp + 0x1c]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x18]
divss xmm0, dword [ebp + 0x20]
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov ecx, dword [ebp + 8]
push ecx
mov edx, 0x637c60
call edx
add esp, 0x30
push 1
mov eax, 0x791050
call eax
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x10108341
mov al, 2
jmp 0x101083c2
mov al, 1
jmp 0x101083c2
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x18]
divss xmm0, dword [ebp + 0x20]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x14]
divss xmm0, dword [ebp + 0x1c]
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov edx, dword [ebp + 8]
push edx
mov eax, 0x637c60
call eax
add esp, 0x30
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10109530
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
cvttss2si eax, dword [ebp + 0x18]
push eax
cvttss2si ecx, dword [ebp + 0x14]
push ecx
cvttss2si edx, dword [ebp + 0x10]
push edx
cvttss2si eax, dword [ebp + 0xc]
push eax
call fcn.100a60b0
add esp, 0x10
movzx ecx, al
test ecx, ecx
je 0x101096c9
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x10109610
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x1c]
divss xmm0, dword [ebp + 0x24]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
cvtss2sd xmm0, xmm0
mulsd xmm0, qword [0x101f98d8]
cvtsd2ss xmm0, xmm0
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x637c60
call ecx
add esp, 0x30
jmp 0x10109690
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x1c]
divss xmm0, dword [ebp + 0x24]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov edx, dword [ebp + 8]
push edx
mov eax, 0x637c60
call eax
add esp, 0x30
push 1
mov ecx, 0x791050
call ecx
add esp, 4
movzx edx, al
test edx, edx
je 0x101096c5
push 0
push 0
push 0x19
mov eax, 0x6d6c20
call eax
add esp, 0xc
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
push edx
call dword [ebp - 8]
add esp, 4
jmp 0x10109742
jmp 0x10109742
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push 1
push 0
movss xmm0, dword [ebp + 0x20]
divss xmm0, dword [ebp + 0x28]
push ecx
movss dword [esp], xmm0
movss xmm0, dword [ebp + 0x1c]
divss xmm0, dword [ebp + 0x24]
push ecx
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x18]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x14]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0x10]
movss dword [esp], xmm0
push ecx
movss xmm0, dword [ebp + 0xc]
movss dword [esp], xmm0
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x637c60
call ecx
add esp, 0x30
mov esp, ebp
pop ebp
ret 0x28
Function at 0x10115db0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d9ffb
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x424], ecx
lea ecx, [ebp - 0x414]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
mov eax, dword [ebp - 0x424]
add eax, 0xcb328
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x414]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x10115e3e
mov byte [ebp - 0x419], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x419]
jmp 0x1011600b
push 0
push 0x20
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0xffffffff
jne 0x10115e8a
mov byte [ebp - 0x41a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41a]
jmp 0x1011600b
push 0
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3af48
je 0x10115ed1
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41b]
jmp 0x1011600b
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0x3af48
mov ecx, dword [ebp - 0x424]
add ecx, 0x903dc
push ecx
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10115f32
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41c]
jmp 0x1011600b
mov dword [ebp - 0x418], 0
jmp 0x10115f4d
mov ecx, dword [ebp - 0x418]
add ecx, 1
mov dword [ebp - 0x418], ecx
cmp dword [ebp - 0x418], 0x3af48
jae 0x10115fdf
mov edx, dword [ebp - 0x418]
shr edx, 8
and edx, 0xff
movzx eax, dl
xor eax, 0x6e
movzx ecx, al
mov edx, dword [ebp - 0x424]
add edx, dword [ebp - 0x418]
movzx eax, byte [edx + 0x903dc]
add eax, ecx
mov ecx, dword [ebp - 0x424]
add ecx, dword [ebp - 0x418]
mov byte [ecx + 0x903dc], al
mov edx, dword [ebp - 0x418]
and edx, 0xff
movzx eax, dl
xor eax, 0xe6
movzx ecx, al
mov edx, dword [ebp - 0x424]
add edx, dword [ebp - 0x418]
movzx eax, byte [edx + 0x903dc]
xor eax, ecx
mov ecx, dword [ebp - 0x424]
add ecx, dword [ebp - 0x418]
mov byte [ecx + 0x903dc], al
jmp 0x10115f3e
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret 4
Function at 0x10116030
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d9ffb
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x1020a06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x424], ecx
lea ecx, [ebp - 0x414]
call fcn.10007100
mov dword [ebp - 4], 0
push 0x400
mov eax, dword [ebp - 0x424]
add eax, 0xcb324
push eax
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x414]
call fcn.100072b0
movzx edx, al
test edx, edx
jne 0x101160be
mov byte [ebp - 0x419], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x419]
jmp 0x1011627a
push 0
push 0x20
push 3
push 0
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0xffffffff
jne 0x1011610a
mov byte [ebp - 0x41a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41a]
jmp 0x1011627a
push 0
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x903d8
je 0x10116151
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41b]
jmp 0x1011627a
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0x903d8
mov ecx, dword [ebp - 0x424]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x101161af
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41c]
jmp 0x1011627a
mov dword [ebp - 0x418], 0
jmp 0x101161ca
mov ecx, dword [ebp - 0x418]
add ecx, 1
mov dword [ebp - 0x418], ecx
cmp dword [ebp - 0x418], 0x903d8
jae 0x1011624e
mov edx, dword [ebp - 0x418]
shr edx, 8
and edx, 0xff
movzx eax, dl
xor eax, 0x95
movzx ecx, al
mov edx, dword [ebp - 0x424]
add edx, dword [ebp - 0x418]
movzx eax, byte [edx + 4]
add eax, ecx
mov ecx, dword [ebp - 0x424]
add ecx, dword [ebp - 0x418]
mov byte [ecx + 4], al
mov edx, dword [ebp - 0x418]
and edx, 0xff
movzx eax, dl
xor eax, 0xda
movzx ecx, al
mov edx, dword [ebp - 0x424]
add edx, dword [ebp - 0x418]
movzx eax, byte [edx + 4]
xor eax, ecx
mov ecx, dword [ebp - 0x424]
add ecx, dword [ebp - 0x418]
mov byte [ecx + 4], al
jmp 0x101161bb
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x41d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.10007120
mov al, byte [ebp - 0x41d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c2d1
mov esp, ebp
pop ebp
ret 4