joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002b2e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x20
pop ebp
jmp fcn.100016da

Function at 0x10006590
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [section..data]
cmp esi, 0xffffffff
jne 0x100065b3
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x100065f6
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push eax
call fcn.10037919
add esp, 4
mov ebx, dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push esi
call ebx
push 0x14
call fcn.10037919
add esp, 4
mov edi, eax
push eax
push esi
call ebx
movaps xmm0, xmmword [0x10040c10]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x100065de

Function at 0x100065fa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call fcn.10005b20
sub esp, 0x10
mov esi, dword [section..data]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call fcn.10037919
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TlsSetValue]
add esp, 8
pop esi
pop ebp
ret

Function at 0x100066a2
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [section..data]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100066b7
pop ebp
ret
pop ebp
jmp fcn.10006590

Function at 0x10008df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008e1f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10008e01
pop esi
pop edi
pop ebp
ret 8

Function at 0x10008f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008f61
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10008f41
pop esi
pop edi
pop ebp
ret 8
Function at 0x40c404
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40c413
pop dword [ebp - 0x1c]
mov eax, 0x9d6a4e44
sub eax, 0x9d298a31
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x3d93f
push 0
mov eax, 0xa72c6a3d
add eax, 0x5915e7db
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x474a
xor edi, edi
add edi, eax
mov ebx, 0x435400
add ebx, dword [ebp - 0x1c]
mov esi, 0xf5c6ff16
add esi, 0x9c2c830f
sub dword [ebp - 8], 0x58d45e54
mov edx, dword [ebx]
xor edx, esi
mov dword [ebp - 0xc], 0xc54c0e43
mov dword [edi], edx
sub dword [ebp - 0x14], 0x2f0a3eb1
add edi, 0x854b00b5
sub edi, 0x854b00b1
add ebx, 0xe567f4f8
add ebx, 0x1a980b0c
loop 0x40c468
add eax, 0x10ffb
xor ebx, ebx
add ebx, eax
add eax, 0x9cb83ebb
sub eax, 0x9cb83eb6
mov ecx, 0x1938e9e5
add ecx, 0xe707161b
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x413f10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
or ebp, 0xffffffff
jmp 0x413f32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413f39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413f28
mov eax, 1
add ebx, ebx
jne 0x413f4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413f40
jne 0x413f5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413f40
xor ecx, ecx
sub eax, 3
jb 0x413f70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x413fe2
mov ebp, eax
add ebx, ebx
jne 0x413f7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413f88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x413fac
inc ecx
add ebx, ebx
jne 0x413f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x413f8d
jne 0x413fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413f8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x413fcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x413fbd
jmp 0x413f2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x413fcc
add edi, ecx
jmp 0x413f2e
pop esi
mov edi, esi
mov ecx, 0xc7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x413fea
cmp byte [edi], 5
jne 0x413fea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x413fef
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x414067
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14894]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x148d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41401c
mov ecx, edi
jns 0x41404b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x148d4]
or eax, eax
je 0x414061
mov dword [ebx], eax
add ebx, 4
jmp 0x414039
call dword [esi + 0x148d8]
popal
jmp 0x402058
Function at 0x1000152d
Capabilities:
Parse pe header

Disassembly:
jmp 0x10045e90
mov edx, dword [esp + 4]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x10045ee9
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x10045ee9
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
test byte [eax + 0x24], 0x20
jne 0x10045ec9
nop word [eax + eax]
add eax, 0x28
test byte [eax + 0x24], 0x20
je 0x10045ec0
mov ecx, dword [esp + 8]
add edx, dword [eax + 0xc]
mov dword [ecx], edx
mov ecx, dword [eax + 8]
mov eax, dword [esp + 0xc]
and ecx, 0xfffff000
add ecx, 0x1000
add ecx, edx
mov dword [eax], ecx
xor eax, eax
ret
Function at 0x10001aff
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x10045d80
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10ea26ec]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10ea238c]
cmp eax, dword [ecx + 0xeb68]
jg 0x10045dc8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, 0x10ea1de8
nop
push edi
push dword [esi]
call ebx
test eax, eax
jne 0x10045dc4
add esi, 4
cmp esi, 0x10ea2298
jne 0x10045db0
pop edi
pop esi
pop ebx
ret
push 0x10ea238c
call fcn.100055e7
add esp, 4
cmp dword [0x10ea238c], 0xffffffff
jne 0x10045d9c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x100e3448
push 0x4b0
push 0x10ea1de8
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
push 0x10ea238c
mov dword [0x10ea2388], eax
call fcn.10005673
add esp, 4
jmp 0x10045d9c

Function at 0x10002707
Capabilities:
Parse pe header

Disassembly:
jmp 0x10045e30
mov edx, dword [esp + 4]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x10045e6f
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x10045e6f
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x10045e6f
mov edx, dword [esp + 8]
cmp dword [eax], edx
je 0x10045e71
add eax, 4
cmp eax, ecx
jb 0x10045e64
xor eax, eax
ret

Function at 0x1000294b
Capabilities:
Create thread

Disassembly:
jmp 0x100132f0
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x10012ca0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0
mov dword [esi + 0x1f4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x1f8], eax
mov al, 1
pop esi
ret

Function at 0x10003328
Capabilities:
Terminate process

Disassembly:
jmp 0x1005cafd
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1005cb0e
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.1000532b
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x10003427
Capabilities:
Query environment variable

Disassembly:
jmp 0x100a2c80
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100a2c91
pop esi
ret
push ebx
push edi
push esi
call fcn.100a2b67
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10003c1f
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100a2cb9
push ebx
push esi
push edi
call fcn.10005155
add esp, 0xc
push 0
call fcn.10005b64
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100038f0
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x100480e0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0xcccc
push dword [esp + 0x18]
call fcn.10004872
add esp, 0x18
test eax, eax
je 0x1004810b
inc eax
cmp byte [eax], 0xcc
je 0x10048105
ret
Function at 0x100039f4
Capabilities:
Write file on windows

Disassembly:
jmp 0x100111d0
sub esp, 0x214
mov eax, dword [0x100e1f80]
xor eax, esp
mov dword [esp + 0x210], eax
push 0x1f4
xorps xmm0, xmm0
mov dword [esp + 0x14], 0
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 0xf
push 0
movups xmmword [esp + 8], xmm0
push eax
mov byte [esp + 0xc], 0
mov dword [esp + 0x24], 0
call fcn.10002e4b
push 0x1f3
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x30]
push 0x1f4
push eax
call fcn.1000277f
mov ecx, dword [esp + 0x30]
add esp, 0x1c
cmp ecx, 0xf
jbe 0x10011267
mov edx, dword [esp]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001125d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100112ca
push ecx
push edx
call fcn.1000192e
add esp, 8
lea eax, [esp + 0x21c]
push eax
push 0
push dword [esp + 0x220]
lea eax, [esp + 0x28]
push 0x1f4
push eax
call fcn.10005254
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.100035e4
add esp, 0x1c
lea eax, [esp + 0x18]
push 0
push 0x100e3448
push 0x1f8
push eax
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.10002d8d
add esp, 0x214
ret
call fcn.10004363
int3

Function at 0x100040ac
Capabilities:
Write file on windows

Disassembly:
jmp 0x10011af0
push esi
mov esi, dword [esp + 0x2c]
test esi, esi
js 0x10011b01
cmp esi, 0xc330
jbe 0x10011b17
push dword [esp + 0x14]
push dword [esp + 0x14]
push esi
push str.Textractor:_something_went_very_wrong__invalid_length__d_at_hook_address__I64d_
call fcn.100039f4
add esp, 0x10
mov ecx, dword [esp + 0x28]
lea eax, [esi + 0x20]
movups xmm0, xmmword [esp + 8]
push 0
push 0x100e3448
movups xmmword [ecx], xmm0
push eax
movups xmm0, xmmword [esp + 0x24]
push ecx
movups xmmword [ecx + 0x10], xmm0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
ret
Function at 0x100043e0
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x100259a0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10ea26ec]
push esi
mov esi, dword [esp + 8]
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10ea15f8]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, dword [ecx + 0xeb68]
jg 0x10025aa2
push str.mono_assembly_get_image
push esi
call edi
push str.mono_image_get_name
push esi
mov dword [0x10ea0f28], eax
call edi
push str.mono_class_from_name
push esi
mov dword [0x10ea0f2c], eax
call edi
push str.mono_class_get_property_from_name
push esi
mov dword [0x10ea0f30], eax
call edi
push str.mono_property_get_set_method
push esi
mov dword [0x10ea0f34], eax
call edi
push str.mono_compile_method
push esi
mov dword [0x10ea0f38], eax
call edi
push str.mono_get_root_domain
push esi
mov dword [0x10ea0f3c], eax
call edi
push str.mono_thread_attach
push esi
mov dword [0x10ea0f40], eax
call edi
cmp dword [0x10ea15f4], 0
pop edi
mov dword [0x10ea0f44], eax
pop esi
je 0x10025a9f
cmp dword [0x10ea0f28], 0
je 0x10025a9f
cmp dword [0x10ea0f2c], 0
je 0x10025a9f
cmp dword [0x10ea0f30], 0
je 0x10025a9f
cmp dword [0x10ea0f34], 0
je 0x10025a9f
cmp dword [0x10ea0f38], 0
je 0x10025a9f
cmp dword [0x10ea0f3c], 0
je 0x10025a9f
cmp dword [0x10ea0f40], 0
je 0x10025a9f
test eax, eax
je 0x10025a9f
push str.Mono_X86:_If_the_following_hooks_dont_work__create_the_TextractorConfig.txt_file_via_the__Configure_game__button_to_activate_the_brute_force_mode
call fcn.100039f4
push 0
push 0x1000310c
call dword [0x10ea15f4]
add esp, 0xc
mov al, 1
ret
xor al, al
ret
push 0x10ea15f8
call fcn.100055e7
add esp, 4
cmp dword [0x10ea15f8], 0xffffffff
jne 0x100259cc
push str.mono_assembly_foreach
push esi
call edi
push 0x10ea15f8
mov dword [0x10ea15f4], eax
call fcn.10005673
add esp, 4
jmp 0x100259cc

Function at 0x10004a7a
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1001ad40
sub esp, 0x40
push ebx
push esi
lea eax, [esp + 0x24]
xor bl, bl
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor esi, esi
cmp dword [esp + 0x30], esi
jbe 0x1001ae08
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1c
lea eax, [esp + 0x10]
push eax
push esi
call edi
test eax, eax
jne 0x1001ad7c
add esi, dword [esp + 0x2c]
jmp 0x1001adfd
mov eax, dword [esp + 0x18]
cmp eax, 0x1f00000
jne 0x1001adfb
cmp dword [esp + 0x20], 4
jne 0x1001adfb
cmp dword [esp + 0x24], 0x40000
jne 0x1001adfb
push str.Textractor:_PPSSPP_memory_found:_searching_for_hooks_should_yield_working_hook_codes
mov bl, 1
call fcn.100039f4
lea eax, [esi - 0x8000000]
mov dword [0x100e1060], 6
mov dword [0x100e1074], eax
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [0x100e1040], 0x360ad83
mov word [0x100e1044], 0
mov dword [0x100e1064], 0
mov dword [0x100e1078], 0
mov dword [0x100e107c], 0xffffffff
mov dword [0x100e129c], 0x100167c0
add esi, eax
cmp esi, dword [esp + 0x34]
jb 0x1001ad65
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x40
ret
Function at 0x10004fd4
Capabilities:
Parse pe header

Disassembly:
jmp 0x10046390
sub esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0x5a4d
cmp cx, word [eax]
jne 0x10046414
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x10046414
mov ecx, dword [ecx + eax + 0x88]
test ecx, ecx
je 0x10046414
add eax, ecx
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 4]
mov dword [esp + 4], eax
push ecx
push eax
call fcn.10004953
add esp, 0xc
test eax, eax
je 0x10046414
mov edx, dword [esp + 0xc]
mov eax, edx
push esi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100463e3
sub eax, esi
sar eax, 1
add eax, eax
push eax
mov eax, dword [esp + 0xc]
push edx
add eax, 0xfffffffc
push eax
push dword [esp + 0x10]
call fcn.10003ba7
add esp, 0x10
test eax, eax
setne al
pop esi
add esp, 8
ret
xor al, al
add esp, 8
ret

Function at 0x100050d3
Capabilities:
Write file on windows

Disassembly:
jmp 0x10011540
mov eax, dword [esp + 0xc]
sub esp, 0x10
test eax, eax
je 0x1001155a
push eax
push dword [0x100e1b20]
call fcn.100039f4
add esp, 8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0
push 0x100e3448
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push 0x10
push eax
push dword [section..data]
mov dword [esp + 0x14], 3
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x10
ret
Function at 0x100058fd
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x10013130
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x184]
test al, 0x40
je 0x10013173
lea ecx, [esi + 0x1c]
test al, al
jns 0x1001324f
lea eax, [esi + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001323c
add dword [esi + 0x1e8], eax
adc dword [esi + 0x1ec], 0
push edi
push 0x100e3448
push 0x40
push 0xa
push dword [esi + 0x1e8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
lea edi, [esi + 0x1fd]
push edi
push dword [esi + 0x1e8]
call fcn.10002f09
test eax, eax
je 0x100131d8
cmp eax, 3
jne 0x1001327f
push 9
push dword [esi + 0x1ec]
push dword [esi + 0x1e8]
call fcn.10002572
add esp, 0xc
lea eax, [esp + 8]
push eax
push edi
push dword [esi + 0x1e8]
call fcn.10002f09
test eax, eax
jne 0x100131a4
mov eax, dword [0x100e102c]
mov ecx, dword [esp + 8]
mov dword [eax + 0x100e100c], esi
mov eax, dword [0x100e1030]
mov dword [eax + 0x100e100c], 0x10003f2b
mov eax, dword [0x100e1034]
mov dword [eax + 0x100e100c], ecx
movups xmm0, xmmword [0x100e100c]
push dword [esi + 0x1e8]
movups xmmword [edi], xmm0
movq xmm0, qword [0x100e101c]
movq qword [edi + 0x10], xmm0
mov eax, dword [0x100e1024]
mov dword [edi + 0x18], eax
mov al, byte [0x100e1028]
mov byte [edi + 0x1c], al
call fcn.10002f4f
test eax, eax
pop edi
sete al
pop esi
pop ecx
ret
push dword [0x100e1b48]
call fcn.100039f4
add esp, 4
xor al, al
pop esi
pop ecx
ret
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001326c
cdq
add dword [esi + 0x1e8], eax
adc dword [esi + 0x1ec], edx
jmp 0x10013173
push dword [0x100e1b4c]
call fcn.100039f4
add esp, 4
xor al, al
pop esi
pop ecx
ret
push eax
call fcn.10005ede
push eax
call fcn.100039f4
add esp, 4
xor al, al
pop edi
pop esi
pop ecx
ret
Function at 0x10006069
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x10047d80
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0xcccc
push dword [esp + 0x18]
call fcn.10004232
add esp, 0x18
test eax, eax
je 0x10047dab
inc eax
cmp byte [eax], 0xcc
je 0x10047da5
ret

Function at 0x100060af
Capabilities:
Write file on windows

Disassembly:
jmp 0x10011470
sub esp, 0x5dc
mov eax, dword [0x100e1f80]
xor eax, esp
mov dword [esp + 0x5d8], eax
push ebx
mov ebx, dword [esp + 0x7cc]
lea eax, [esp + 0x1f4]
push esi
push edi
push 0x3e8
mov dword [esp + 0x10], 2
lea esi, [esp + 0x5f0]
mov ecx, 0x7a
lea edi, [esp + 0x18]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.10002e4b
push 0x1f3
push ebx
lea eax, [esp + 0x210]
push 0x1f4
push eax
call fcn.100053e9
add esp, 0x1c
lea eax, [esp + 0xc]
push 0
push 0x100e3448
push 0x5d8
push eax
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x5e4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10002d8d
add esp, 0x5dc
ret
Function at 0x1001a050
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x254
mov eax, dword [0x100e1f80]
xor eax, esp
mov dword [esp + 0x250], eax
push esi
push 0
push 0x80
push 3
push 0
push 1
push 1
push str.RIO.INI
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001a103
mov ecx, dword [0x10ea1650]
mov edx, ecx
lea esi, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1001a0a0
sub edx, esi
sar edx, 1
cmp edx, 3
jbe 0x1001a161
lea esi, [esp + 0x4c]
sub esi, ecx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x1001a0c0
push 0
push 0x80
push 3
push 0
push 1
push 1
lea eax, [esp + 0x64]
mov dword [esp + edx*2 + 0x60], 0x69006e
mov ecx, 0x69
push eax
mov word [esp + edx*2 + 0x62], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001a161
push 0x40
lea eax, [esp + 0x10]
push 0
push eax
call fcn.10002e4b
add esp, 0xc
lea eax, [esp + 8]
push 0
push eax
push 0x40
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0xc]
mov byte [esp + 0x4b], 0
push 0x100c597c
push eax
call fcn.10003fd5
add esp, 8
test eax, eax
je 0x1001a161
lea ecx, [esp + 4]
add eax, 3
push ecx
push 0x100c59b4
push eax
call fcn.1000551f
add esp, 0xc
mov ecx, dword [esp + 0x254]
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
call fcn.10002d8d
add esp, 0x254
ret

Function at 0x1001a210
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1e8
push esi
push edi
push 0x170
lea eax, [esp + 0x20]
push 0
push eax
call fcn.10002e4b
push 0x5a
lea eax, [esp + 0x1a6]
mov dword [esp + 0x1a0], 0
push 0
push eax
call fcn.10002e4b
mov eax, dword [esp + 0x20c]
mov dword [esp + 0x20], eax
mov eax, 1
push str.vnreng:_INSERT_KiriKiriZ
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0xfffffff4
mov dword [esp + 0x34], 0xfffffff4
mov dword [esp + 0x30], 0x14
mov word [esp + 0x1b0], ax
mov dword [esp + 0x1a8], 0x3a
call fcn.100039f4
add esp, 0x1c
lea esi, [esp + 8]
mov ecx, 0x7a
push 0x8000
push str.KiriKiriZ
sub esp, 0x1e8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.10002a54
add esp, 0x1f0
pop edi
pop esi
add esp, 0x1e8
mov dword [esp + 4], str.vnreng:KiriKiriZ:_disable_GDI_hooks
jmp fcn.100039f4
Function at 0x1001da90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1e8
push esi
mov esi, dword [esp + 0x1f0]
push edi
test esi, esi
je 0x1001daba
lea edx, [esi + 0x100]
mov ecx, esi
cmp esi, edx
jae 0x1001daba
nop
cmp byte [ecx], 0xe8
je 0x1001dacf
inc ecx
cmp ecx, edx
jb 0x1001dab0
pop edi
pop esi
add esp, 0x1e8
mov dword [esp + 4], str.vnreng:AliceHook1:_failed
jmp fcn.100039f4
mov edi, dword [ecx + 1]
add ecx, 5
push esi
add edi, ecx
call fcn.100052ae
add esp, 4
cmp eax, 1
je 0x1001daf5
add esi, eax
push esi
call fcn.100052ae
add esp, 4
cmp eax, 1
jne 0x1001dae5
push 0x1e8
lea eax, [esp + 0xc]
push 0
push eax
call fcn.10002e4b
movzx ecx, byte [esi]
mov eax, 0xfffffff8
and ecx, 0xf
mov dword [esp + 0x14], edi
shl ecx, 2
sub eax, ecx
mov dword [esp + 0x18], 0
push str.vnreng:_INSERT_AliceHook1
mov dword [esp + 0x20], 0xfffffff8
mov dword [esp + 0x28], eax
mov dword [esp + 0x19c], 0x11
call fcn.100039f4
add esp, 0x10
lea esi, [esp + 8]
mov ecx, 0x7a
push 0x8000
push str.System40
sub esp, 0x1e8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.10002a54
add esp, 0x1f0
pop edi
pop esi
add esp, 0x1e8
ret

Function at 0x1001dca0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1e8
push esi
mov esi, dword [esp + 0x1f0]
push edi
test esi, esi
jne 0x1001dcc8
pop edi
pop esi
add esp, 0x1e8
mov dword [esp + 4], str.vnreng:AliceHook2:_failed
jmp fcn.100039f4
push 0x174
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.10002e4b
push 0x5a
lea eax, [esp + 0x1a6]
mov dword [esp + 0x1a0], 0
push 0
push eax
call fcn.10002e4b
mov eax, 1
mov dword [esp + 0x20], esi
push str.vnreng:_INSERT_AliceHook2
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x30], 8
mov word [esp + 0x1b0], ax
mov dword [esp + 0x1a8], 8
call fcn.100039f4
add esp, 0x1c
lea esi, [esp + 8]
mov ecx, 0x7a
push 0x8000
push str.System40
sub esp, 0x1e8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.10002a54
add esp, 0x1f0
pop edi
pop esi
add esp, 0x1e8
ret