joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x58af2a8a
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x30f07529
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x409cca
Capabilities:
Terminate process

Disassembly:
push 0x2c
mov eax, 0x45d343
call fcn.0043eda2
push str.PageOrder
mov ecx, 0x480160
call fcn.00402997
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x10], eax
jne 0x409d07
push 0xbd3
lea eax, [ebp - 0x24]
push eax
call fcn.0040475e
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x24]
jmp 0x40f780
lea ecx, [ebp - 0x38]
call fcn.00435a41
mov dword [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x46665c
lea edi, [ebp - 0x38]
call fcn.00401513
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
call fcn.00401513
mov byte [ebp - 4], 3
mov byte [ebp - 4], 1
call fcn.004183cc
cmp dword [ebp - 0x30], ebx
pop ecx
pop ecx
jle 0x409e01
mov edi, 0x480134
push 0x466660
mov ecx, edi
call fcn.00424370
test eax, eax
je 0x409de6
push str.LI_SKIP_EULA
mov ecx, edi
call fcn.00424370
test eax, eax
je 0x409de6
cmp dword [ebp - 0x30], 1
jle 0x409de6
cmp dword [ebp - 0x30], ebx
jg 0x409d88
jmp fcn.0042fcc0
mov ecx, dword [ebp - 0x34]
push 0x466690
call fcn.00404409
test eax, eax
jne 0x409de6
cmp dword [ebp - 0x30], 1
jle 0x409d83
mov eax, dword [ebp - 0x34]
add eax, 4
push eax
lea ecx, [esi + 0x98]
call fcn.0040adbd
push ebx
mov byte [esi + 0xac], 1
mov eax, dword [0x480074]
push ebx
push 0x401
push dword [eax + 0x30]
mov dword [eax + 0x58], ebx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov eax, dword [0x480130]
cmp eax, ebx
je 0x409de6
push ebx
push ebx
push 0x466608
push eax
call fcn.004168a3
cmp byte [esi + 0xac], bl
jne 0x409e01
cmp dword [ebp - 0x30], ebx
jle 0x409d83
push dword [ebp - 0x34]
lea ecx, [esi + 0x98]
call fcn.0040adbd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00435bf2
call fcn.0043ee7a
ret
Function at 0x409e13
Capabilities:
Terminate process

Disassembly:
push 0x2c
mov eax, 0x45d343
call fcn.0043eda2
push str.PageOrder
mov ecx, 0x480160
call fcn.00402997
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x409e4f
push 0xbd3
lea eax, [ebp - 0x24]
push eax
call fcn.0040475e
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
jmp 0x40f780
lea ecx, [ebp - 0x38]
call fcn.00435a41
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x46665c
lea edi, [ebp - 0x38]
call fcn.00401513
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
call fcn.00401513
mov byte [ebp - 4], 3
mov byte [ebp - 4], bl
call fcn.004183cc
cmp byte [esi + 0xac], 0
pop ecx
pop ecx
mov edi, ebx
je 0x409e9e
push 2
pop edi
mov ebx, dword [ebp - 0x30]
jmp 0x409ee9
test edi, edi
jl 0x409eff
cmp edi, dword [ebp - 0x30]
jge 0x409eff
mov eax, dword [ebp - 0x34]
lea eax, [eax + edi*4]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x409ee8
push str.CProgressPage
push eax
call fcn.0040aa44
test al, al
pop ecx
pop ecx
je 0x409ed1
push esi
call fcn.0040a048
cmp edi, dword [ebp - 0x30]
jge 0x409eff
mov eax, dword [ebp - 0x34]
lea eax, [eax + edi*4]
push eax
lea ecx, [esi + 0x98]
call fcn.0040adbd
inc edi
cmp edi, ebx
jb 0x409ea3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00435bf2
call fcn.0043ee7a
ret
jmp fcn.0042fcc0
test ecx, ecx
je 0x40f78d
mov eax, dword [ecx]
push 0
push 0
call dword [eax + 0x14]
push 1
call fcn.0043d3b3
int3
Function at 0x431de4
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x431ded
xor eax, eax
jmp 0x431e56
cmp dword [esp + 8], 0
jne 0x431df9
call fcn.0042fcc0
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.0043e50b
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x431e34
push dword [esi + 0x10]
call fcn.0043e675
test eax, eax
pop ecx
jne 0x431e34
mov esi, dword [esi + 0xc]
call fcn.0043f239
push esi
push dword [eax]
push 1
call fcn.004332ef
push dword [esi + 0x10]
call fcn.0043e6a4
test eax, eax
pop ecx
je 0x431e53
push dword [esi + 0x10]
call fcn.00440f88
push eax
call fcn.004015fb
pop ecx
pop ecx
jmp 0x431e22
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x431e5f
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x431e69
call fcn.0042fcc0
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.0043ccf7
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x431e96
mov esi, dword [esi + 0xc]
call fcn.0043f239
push esi
push dword [eax]
push 1
call fcn.004332ef
pop esi
ret 8

Function at 0x436695
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x1f4]
sub esp, 0x274
mov eax, dword [0x47a030]
xor eax, ebp
mov dword [ebp + 0x1f0], eax
cmp dword [ebp + 0x200], 0x800
mov eax, dword [ebp + 0x1fc]
push esi
mov dword [ebp - 0x40], eax
mov esi, ecx
lea eax, [ebp + 0x1e8]
jne 0x436733
push 0x4617bc
push 4
push eax
call fcn.0043db9a
push eax
call fcn.004015fb
add esp, 0x10
push ebx
push edi
call fcn.0043f226
mov edi, dword [eax]
call fcn.0043f226
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp + 0x1e8]
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0043f1cc
add esp, 0x18
mov dword [ebp - 0x40], eax
call fcn.0043f226
cmp dword [eax], ebx
je 0x43674a
call fcn.0043f226
push dword [eax]
call fcn.004252f0
pop ecx
jmp 0x436751
push 4
push eax
push 3
push dword [ebp + 0x200]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4366e4
jmp 0x4367c3
call fcn.0043f226
mov dword [eax], edi
cmp dword [ebp - 0x40], 0xffffffff
je 0x4367bf
cmp dword [ebp - 0x40], esi
jae 0x4367bf
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x40
call fcn.0043eeb0
add esp, 0xc
push 0x460df8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x4367b1
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4367b1
lea ecx, [ebp - 0x80]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x4367b1
push ebx
push ebx
push esi
jmp 0x4367b7
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x4367c1
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0x1f0]
xor ecx, ebp
pop esi
call fcn.0043aa68
add ebp, 0x1f4
leave
ret
Function at 0x45769a
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x47a030]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004575d9
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0043eeb0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4576e9
cmp dword [ebp - 0x1c], 5
jb 0x457701
jmp 0x4576fd
cmp dword [ebp - 0x10], 1
jne 0x457701
cmp dword [ebp - 0x1c], 4
ja 0x4576fd
jne 0x457701
cmp dword [ebp - 0x18], 0
jbe 0x457701
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x464948
call fcn.00428350
test eax, eax
jge 0x457722
mov byte [0x4801b0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043aa68
add ebp, 0x78
leave
ret

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
stc
sub ah, dh
xlatb
insb byte es:[edi], dx
fstp dword [ecx]
dec ebx
daa
xor bh, bl
sbb ecx, dword [esi - 0x4c]
pop eax
push ds
scasd eax, dword es:[edi]
mov ebp, 0xd5ed0cc9
jae 0x4153d9
inc esi
invalid
Function at 0x10003d78
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x10003dc5
cmp byte [esi + 0x3d], bl
je 0x10003dc5
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10003df4
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x10003dcc
sub eax, 1
je 0x10003dcf
dec eax
sub eax, 1
jne 0x10003df4
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10003dec
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1005120e
add esp, 0x10
cmp edi, eax
jne 0x10003df4
cmp byte [esi + 0x3d], bl
sete al
jmp 0x10003dc7
xor al, al
jmp 0x10003dc7

Function at 0x10005bd9
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x10005bf3
xor eax, eax
jmp 0x10005cc3
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x10005c21
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x10005c21
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x10005cc2
cmp dword [esi + 0x4c], 0
je 0x10005cc0
mov ecx, esi
call fcn.100042ef
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x10005c4d
push dword [esi + 0x4c]
push eax
call fcn.10001ef3
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x10005cc0
mov byte [esp + 0x10], al
lea eax, [esp + 0x3c]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x10005c91
sub eax, 1
je 0x10005c91
dec eax
sub eax, 1
jne 0x10005cc0
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x10005c3f
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x18]
sub ebp, eax
je 0x10005cb0
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.1005120e
add esp, 0x10
cmp ebp, eax
jne 0x10005cc0
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x10005cc2
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x100068d1
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x14]
test esi, esi
jg 0x100068f1
jl 0x100068e8
test edi, edi
jne 0x100068f1
xor eax, eax
xor edx, edx
jmp 0x100069b8
cmp dword [ebp + 0x38], 0
je 0x10006907
push esi
push edi
push dword [esp + 0x18]
call fcn.100069c2
jmp 0x100069b8
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1000694b
mov eax, dword [ebp + 0x2c]
cmp dword [eax], 0
jbe 0x1000694b
cmp dword [eax], edi
mov esi, edi
mov ebx, dword [esp + 0x14]
cmovb esi, dword [eax]
push esi
push ecx
push ebx
call fcn.1004c1a0
mov eax, dword [ebp + 0x2c]
add ebx, esi
mov dword [esp + 0x20], ebx
add esp, 0xc
mov ebx, edi
sub ebx, esi
sub dword [eax], esi
mov eax, dword [ebp + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x10006953
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [ebp + 0x4c], 0
mov ecx, ebx
je 0x100069ae
mov ecx, ebp
call fcn.100042ef
mov edx, dword [esp + 0x14]
mov ecx, ebx
jmp 0x1000698e
push dword [ebp + 0x4c]
push eax
push 1
push edx
call fcn.10050b87
mov edx, dword [esp + 0x24]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [esp + 0x14], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x100069be
mov eax, 0xfff
cmp ebx, eax
ja 0x1000696a
test ecx, ecx
je 0x100069ae
push dword [ebp + 0x4c]
push ebx
push 1
push edx
call fcn.10050b87
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
sub edi, ebx
jmp 0x100069b0

Function at 0x10006a96
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10006ab7
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.10006b6c
jmp 0x10006b66
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10006ada
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10006adc
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x10006b57
jg 0x10006aef
test esi, esi
je 0x10006b57
test eax, eax
jl 0x10006b39
jg 0x10006af9
test ebp, ebp
je 0x10006b39
cmp edi, eax
jg 0x10006b09
jl 0x10006b03
cmp esi, ebp
jae 0x10006b09
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call fcn.1004c1a0
mov eax, dword [ebx + 0x30]
add esp, 0xc
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
mov eax, dword [esp + 0x1c]
add eax, ebp
test edi, edi
jl 0x10006b57
jg 0x10006b3d
test esi, esi
je 0x10006b57
jmp 0x10006b3d
mov eax, dword [esp + 0x1c]
cmp dword [ebx + 0x4c], 0
je 0x10006b57
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.1005120e
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc
Function at 0x1000fbdc
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1006f02f
call fcn.1004a31c
sub esp, 0x38
push ebx
push esi
push edi
mov eax, 0x40e4e0
mov esi, ecx
call eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
movzx eax, ax
xor ebx, ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.1000f2d2
pop ecx
mov dword [ebp - 0x24], eax
mov eax, ebx
mov dword [ebp - 4], ebx
mov edi, 0xb7d0b8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
mov ebx, dword [edi]
test ebx, ebx
je 0x1000fcdc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebx]
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
cmp dword [eax + 0x20], 0x534030
je 0x1000fc88
mov eax, edi
mov dword [ebp - 0x1c], 0x78
cdq
sub eax, edx
sar eax, 1
cdq
idiv dword [ebp - 0x1c]
push eax
movzx eax, word [esi + 0x22]
push edx
push eax
push esi
lea eax, [ebp - 0x44]
push str.Entity_0x_08x__with_model__d__at_ARRAY_StreamSectors__d__d__is_invalid_n
push eax
call fcn.1000f4d8
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x1000fc77
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x44]
call fcn.100043e1
jmp 0x1000fcc9
mov ecx, dword [0x1011a05c]
movzx eax, word [esi + 0x22]
push eax
mov edx, dword [ecx]
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, word [ebp - 0x18]
jne 0x1000fcc9
test dword [esi + 0x1c], 0x2400
jne 0x1000fcc9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [esi + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000f2e9
mov eax, dword [ebx + 4]
mov ebx, eax
test eax, eax
jne 0x1000fc34
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add edi, 4
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp edi, 0xb992b8
jl 0x1000fc27
mov edi, 0xb992c0
mov dword [ebp - 0x14], edi
mov esi, dword [edi]
test esi, esi
je 0x1000fd52
mov edi, dword [ebp - 0x18]
mov ebx, dword [esi]
mov ecx, dword [0x1011a05c]
mov dword [ebp - 0x1c], ebx
movzx eax, word [ebx + 0x22]
mov edx, dword [ecx]
push eax
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, di
jne 0x1000fd48
test dword [ebx + 0x1c], 0x2400
jne 0x1000fd48
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [ebx + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000f2e9
mov esi, dword [esi + 4]
test esi, esi
jne 0x1000fd03
mov edi, dword [ebp - 0x14]
add edi, 0xc
mov dword [ebp - 0x14], edi
cmp edi, 0xb99ec0
jl 0x1000fcfa
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, eax
je 0x1000fd97
movzx eax, word [esi + 0xe]
push eax
mov eax, 0x4089a0
call eax
movzx eax, word [esi + 0xe]
imul eax, eax, 0x14
pop ecx
lea ecx, [ebp - 0x18]
mov byte [eax + 0x8e4cd0], 0
call fcn.1000d921
mov esi, dword [ebp - 0x18]
cmp esi, dword [ebp - 0x24]
jne 0x1000fd6c
lea eax, [ebp - 0x24]
push eax
mov ecx, eax
call fcn.1000f37b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x10017b79
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1006ecc7
call fcn.1004a31c
sub esp, 0x20
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x10017caf
push 0x10074ee4
push dword [ebp + 8]
call fcn.1005902a
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10017caf
push 0xc
call fcn.1004a0ce
pop ecx
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
test eax, eax
je 0x10017bca
mov ecx, eax
call fcn.1000ad84
mov esi, eax
jmp 0x10017bcc
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x2c]
push 8
pop ecx
push ebx
xor eax, eax
push 1
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push 0x20
push eax
call fcn.10050b87
add esp, 0x10
cmp byte [ebp - 0x2c], 0x43
jne 0x10017c93
cmp byte [ebp - 0x2b], 0x4f
jne 0x10017c93
cmp byte [ebp - 0x2a], 0x4c
jne 0x10017c93
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
call fcn.1004a0c0
mov ecx, dword [ebp - 0x28]
mov edi, eax
push ebx
push 1
add ecx, 0xffffffe8
push ecx
push edi
call fcn.10050b87
mov al, byte [ebp - 0x29]
add esp, 0x14
cmp al, 0x4c
jne 0x10017c46
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
push edi
call dword [0x1009d218]
add esp, 0xc
jmp 0x10017c81
cmp al, 0x32
jne 0x10017c63
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
push edi
call dword [0x1009d21c]
jmp 0x10017c7e
cmp al, 0x33
jne 0x10017c81
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
push edi
call dword [0x1009d220]
add esp, 0x10
push edi
call fcn.1004a10c
push ebx
call fcn.100502f8
pop ecx
pop ecx
mov eax, esi
jmp 0x10017cb1
test esi, esi
je 0x10017ca8
mov ecx, esi
call fcn.1000adb6
push 0xc
push esi
call fcn.1004a0fe
pop ecx
pop ecx
push ebx
call fcn.100502f8
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10029218
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0x2c]
sub esp, 0x24
mov ecx, dword [0x10189b80]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10154120]
push ebp
push esi
push edi
cmp eax, dword [ecx + 4]
jg 0x1002933e
mov ebp, dword [esp + 0x38]
xor edi, edi
and dword [esp + 0x10], 0
inc edi
and dword [esp + 0x38], 0
mov ecx, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
test ecx, ecx
je 0x10029334
mov esi, dword [0x1015411c]
xor edx, edx
mov eax, ebx
mov dword [esp + 0x3c], 1
div esi
sub esi, edx
cmp ecx, esi
cmovle esi, ecx
test ebx, ebx
je 0x100292c1
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100292c1
cmp dword [esp + 0x28], 0x1000
jne 0x100292c1
test byte [esp + 0x2c], 0xee
je 0x100292c1
mov ecx, dword [esp + 0x24]
cmp esi, ecx
ja 0x100292c1
mov eax, ebx
sub ecx, esi
sub eax, dword [esp + 0x18]
cmp eax, ecx
jbe 0x100292e8
lea eax, [esp + 0x10]
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100292e0
xor edi, edi
push esi
push edi
push ebp
call fcn.1004c720
jmp 0x100292f4
mov dword [esp + 0x38], 1
push esi
push ebx
push ebp
call fcn.1004c1a0
mov edi, dword [esp + 0x48]
add esp, 0xc
cmp dword [esp + 0x38], 0
je 0x10029320
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10029320
push ebx
push str.__page_read___could_not_restore_original_permissions_for_ptr__p
call fcn.1004840a
pop ecx
pop ecx
mov ecx, dword [esp + 0x40]
add ebp, esi
add ebx, esi
sub ecx, esi
mov dword [esp + 0x40], ecx
jne 0x10029260
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov esi, 0x10154120
push esi
call fcn.1004a244
cmp dword [0x10154120], 0xffffffff
pop ecx
jne 0x1002923f
call fcn.1002936d
push esi
mov dword [0x1015411c], eax
call fcn.1004a1fa
pop ecx
jmp 0x1002923f

Function at 0x1002936d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100d5110]
sub esp, 0x24
cmp eax, 0xffffffff
jne 0x1002938f
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [0x100d5110], eax
leave
ret