joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003bff0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10043248
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1006b894]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x1006bd68]
test eax, eax
jne 0x1003bdb2
xor esi, esi
jmp 0x1003bdbb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x1003bdfd
cmp dword [esi + 0x14], 0
jne 0x1003be3f
cmp dword [esi + 0x10], 0
jne 0x1003be45
push 0x1003b950
push 0x1006bd64
call fcn.100077d0
mov eax, dword [0x1006bd68]
add esp, 8
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x1003be2b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003be2b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x1003be85
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1003be73
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x1003be45
cmp dword [esi + 0x14], 0
je 0x1003bdd7
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x1003beaa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x1003bedb
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x1003bedb
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x1003bedb
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x1003be8f
jmp 0x1003bdd1
jmp 0x1003bd80

Function at 0x1003c1ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1006b894]
jne 0x1003c1f4
repz ret
jmp fcn.1003c9ee
Function at 0x418f10
Capabilities:
Accept command line arguments

Disassembly:
and esp, 0xffffffe0
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
mov word [ebp - 0xc], 0
fninit
fnstcw word [ebp - 0xc]
mov ax, word [ebp - 0xc]
and ax, 0xfcff
or ax, 0x200
mov word [ebp - 0xc], ax
fldcw word [ebp - 0xc]
call fcn.00419348
call fcn.00419070
call sub.KERNEL32.dll_GetCommandLineA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 0x22
je 0x418f90
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
test eax, eax
je 0x418f8b
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 0x20
je 0x418f8b
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 9
je 0x418f8b
inc dword [ebp - 4]
jmp 0x418f5f
jmp 0x418fc2
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
test eax, eax
je 0x418fb2
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 0x22
je 0x418fb2
inc dword [ebp - 4]
jmp 0x418f93
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 0x22
jne 0x418fc2
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
test eax, eax
je 0x418fee
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 0x20
je 0x418fe6
mov eax, dword [ebp - 4]
movsx eax, byte [eax]
cmp eax, 9
jne 0x418fee
inc dword [ebp - 4]
jmp 0x418fc2
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x50]
push eax
call sub.KERNEL32.dll_GetStartupInfoA
test byte [ebp - 0x24], 1
je 0x419014
mov eax, dword [ebp - 0x20]
and eax, 0xffff
mov dword [ebp - 0x54], eax
jmp 0x41901b
mov dword [ebp - 0x54], 0xa
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push eax
call fcn.00445458
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00442358
add esp, 4
pop edi
pop esi
pop ebx
leave
ret 0
Function at 0x42f788
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x29c
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebp
lea ebp, [esp + 0x60]
mov dword [esp + 4], ebp
mov ecx, 0x105
mov dword [esp], ecx
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
and eax, eax
jne 0x42f7d3
mov edx, 0x2e
mov byte [esp + 0x60], dl
mov ebx, 0
mov byte [esp + 0x61], bl
mov dword [esp], ebp
lea ecx, [0x4608f0]
mov dword [esp + 4], ecx
lea esi, [esp + 0x180]
mov dword [esp + 0xc], esi
mov edx, 0
mov dword [esp + 8], edx
call sub.KERNEL32.dll_GetTempFileNameA
sub esp, 0x10
and eax, eax
jne 0x42f811
call sub.KERNEL32.dll_GetLastError
jmp 0x42f81f
mov dword [esp], esi
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
mov ebp, 0
mov dword [esp + 0x40], ebp
movsx ebx, byte [esp + ebp + 0x180]
and ebx, ebx
je 0x42f864
mov edi, dword [esp + 0x2a0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
movsx eax, byte [esp + ebp + 0x180]
mov byte [edi + ebp], al
inc ebp
movsx ecx, byte [esp + ebp + 0x180]
and ecx, ecx
jne 0x42f848
mov dword [esp + 0x40], ebp
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
add esp, 0x29c
ret
Function at 0x42f888
Capabilities:
Get file size

Disassembly:
sub esp, 0xbc
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebp
mov edi, 0
mov dword [esp + 0x80], edi
mov ebp, dword [esp + 0xc0]
mov dword [ebp + 0x18], edi
mov ebx, 3
mov dword [esp + 0x84], ebx
mov esi, dword [esp + 0xc8]
cmp esi, 1
jne 0x42f8e1
mov eax, 0x80000000
mov dword [esp + 0x88], eax
jmp 0x42f913
cmp esi, 2
jne 0x42f907
mov ecx, dword [ebp + 0x14]
and ecx, 0x40
jne 0x42f907
mov edx, 0x40000000
mov dword [esp + 0x88], edx
jmp 0x42f913
mov eax, 0xc0000000
mov dword [esp + 0x88], eax
mov ecx, dword [esp + 0xc4]
cmp ecx, 0x20000
jne 0x42f932
mov edx, 2
mov dword [esp + 0x84], edx
mov ecx, dword [ebp + 0x2c]
mov dword [esp], ecx
mov edx, dword [esp + 0x88]
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edi
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov edx, eax
mov dword [esp + 0x8c], edx
cmp edx, 0xffffffff
jne 0x42f988
call sub.KERNEL32.dll_GetLastError
mov dword [ebp + 0x18], eax
jmp 0x42fa4e
mov edi, dword [esp + 0x8c]
mov dword [ebp + 0x28], edi
mov ecx, 0
mov dword [ebp + 0x18], ecx
call fcn.004302b8
mov dword [ebp + 0x1c], eax
mov dword [esp], edi
call sub.KERNEL32.dll_GetFileType
sub esp, 4
mov edx, eax
cmp edx, 1
jne 0x42f9fc
mov eax, dword [ebp + 0x28]
mov dword [esp], eax
lea ecx, [esp + 0x80]
mov dword [esp + 4], ecx
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov edx, dword [esp + 0x80]
and edx, edx
je 0x42f9f3
mov eax, 5
mov dword [ebp + 0x18], eax
jmp 0x42fa4e
mov ecx, dword [ebp + 0x64]
or ecx, 4
mov dword [ebp + 0x64], ecx
mov edx, dword [esp + 0xcc]
and edx, edx
mov edi, 0
je 0x42fa4b
mov ecx, dword [ebp + 0x28]
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 8], edi
mov edx, 2
mov dword [esp + 0xc], edx
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
mov dword [ebp + 0x38], eax
cmp eax, 0xffffffff
jne 0x42fa4e
call sub.KERNEL32.dll_GetLastError
mov dword [ebp + 0x18], eax
jmp 0x42fa4e
mov dword [ebp + 0x38], edi
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
add esp, 0xbc
ret
Function at 0x42fa68
Capabilities:
Delete file

Disassembly:
sub esp, 0x7c
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x80]
mov eax, dword [ebp + 0x28]
cmp eax, 0xffffffff
jne 0x42faa0
mov ecx, dword [0x45e344]
mov dword [esp], ebp
lea edx, [esp + 0x84]
mov dword [esp + 4], edx
call ecx
mov dword [ebp + 0x18], eax
jmp 0x42fb35
mov ecx, dword [ebp + 0x28]
mov dword [esp], ecx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
and eax, eax
sete dl
and edx, 1
and edx, edx
je 0x42facf
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x40], eax
jmp 0x42fad8
mov eax, 0
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x40]
mov dword [ebp + 0x18], ecx
and ecx, ecx
jne 0x42fb35
mov edx, dword [esp + 0x84]
and edx, edx
je 0x42fb35
mov ecx, dword [ebp + 0x2c]
mov dword [esp], ecx
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
and eax, eax
sete dl
and edx, 1
and edx, edx
je 0x42fb25
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x44], eax
jmp 0x42fb2e
mov eax, 0
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x44]
mov dword [ebp + 0x18], ecx
mov ebp, dword [esp + 0x1c]
add esp, 0x7c
ret

Function at 0x42fb48
Capabilities:
Get file size

Disassembly:
sub esp, 0xbc
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebp
mov ebx, 0x80000000
mov esi, 3
mov edi, 0
mov ebp, dword [esp + 0xc0]
mov eax, dword [ebp + 0x28]
and eax, eax
jne 0x42fc36
mov ecx, dword [ebp + 0x2c]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov edx, eax
mov dword [esp + 0x80], edx
cmp edx, 0xffffffff
jne 0x42fbc4
mov eax, 0xffffffff
jmp 0x42fc7d
mov ecx, dword [esp + 0x80]
mov dword [esp], ecx
call sub.KERNEL32.dll_GetFileType
sub esp, 4
mov edx, eax
cmp edx, 1
jne 0x42fc10
mov ecx, dword [esp + 0x80]
mov dword [esp], ecx
lea edx, [esp + 0x84]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov dword [esp + 0x88], eax
jmp 0x42fc1c
mov eax, 0
mov dword [esp + 0x88], eax
mov ecx, dword [esp + 0x80]
mov dword [esp], ecx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x42fc76
mov edx, dword [ebp + 0x64]
and edx, 4
je 0x42fc6a
mov ecx, dword [ebp + 0x28]
mov dword [esp], ecx
lea edx, [esp + 0x84]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov dword [esp + 0x88], eax
jmp 0x42fc76
mov eax, 0
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x88]
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
add esp, 0xbc
ret
Function at 0x42fe28
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xbc
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebp
mov ebp, dword [esp + 0xc0]
mov edi, dword [ebp + 0x28]
cmp edi, 0xfffffff6
je 0x42fe52
cmp edi, 0xffffffff
jne 0x42fe83
mov ecx, dword [0x45e330]
mov edx, dword [ebp + 0x10]
mov dword [esp], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp + 8], ebp
call ecx
mov dword [esp + 0x80], eax
mov ecx, 1
mov dword [esp + 0x84], ecx
jmp 0x42febd
mov edx, dword [ebp + 0x28]
mov dword [esp], edx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 4], ecx
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], edx
lea ecx, [esp + 0x80]
mov dword [esp + 0xc], ecx
mov edx, 0
mov dword [esp + 0x10], edx
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x84]
and eax, eax
jne 0x42fed9
call sub.KERNEL32.dll_GetLastError
mov dword [ebp + 0x18], eax
jmp 0x42feee
mov ecx, dword [esp + 0x80]
mov dword [ebp + 4], ecx
mov edx, 0
mov dword [ebp + 8], edx
mov dword [ebp + 0x18], edx
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
add esp, 0xbc
ret

Function at 0x42ff08
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xbc
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebp
mov ebp, dword [esp + 0xc0]
mov edi, dword [ebp + 0x28]
cmp edi, 0xfffffff5
je 0x42ff3f
cmp edi, 0xfffffff4
je 0x42ff3f
cmp edi, 0xffffffff
jne 0x42ff8f
mov ecx, dword [0x45e334]
mov edx, dword [ebp + 0x10]
mov dword [esp], edx
mov dword [esp + 8], edi
mov edx, ebp
add edx, 4
mov dword [esp + 4], edx
mov dword [esp + 0xc], ebp
call ecx
test eax, eax
mov dword [esp + 0x80], eax
je 0x42ff7e
mov eax, 1
mov dword [esp + 0x84], eax
jmp 0x42ffd0
mov ecx, 0
mov dword [esp + 0x84], ecx
jmp 0x42ffd0
mov edx, dword [esp + 0xc0]
mov ecx, dword [edx + 0x28]
mov dword [esp], ecx
mov ebx, dword [edx + 0x10]
mov dword [esp + 4], ebx
mov ecx, dword [edx + 4]
mov dword [esp + 8], ecx
lea edx, [esp + 0x80]
mov dword [esp + 0xc], edx
mov ecx, 0
mov dword [esp + 0x10], ecx
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov dword [esp + 0x84], eax
mov edx, dword [esp + 0x84]
and edx, edx
mov ebp, dword [esp + 0xc0]
jne 0x42fff3
call sub.KERNEL32.dll_GetLastError
mov dword [ebp + 0x18], eax
jmp 0x43002f
mov eax, dword [ebp + 0x14]
and eax, 0x8000
mov edi, 0
je 0x430026
mov dword [esp], ebp
call fcn.00430048
cmp eax, 0xffffffff
je 0x43002f
mov dword [ebp + 8], edi
mov dword [ebp + 4], edi
mov dword [ebp + 0x18], edi
jmp 0x43002f
mov dword [ebp + 8], edi
mov dword [ebp + 4], edi
mov dword [ebp + 0x18], edi
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
add esp, 0xbc
ret
Function at 0x430048
Capabilities:
Clear file content

Disassembly:
sub esp, 0x7c
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x80]
mov eax, dword [ebp + 0x14]
and eax, 0xffff7fff
mov dword [ebp + 0x14], eax
and eax, 0x4240
je 0x43007c
mov eax, 0
jmp 0x4300e2
mov dword [esp], ebp
call fcn.0042fb48
mov ecx, eax
mov edx, dword [ebp + 0x24]
imul edx, dword [ebp + 0xc]
add edx, dword [ebp + 4]
mov edi, edx
add edi, dword [ebp + 0x38]
cmp ecx, edi
jle 0x4300dd
mov dword [esp], ebp
mov dword [esp + 4], edi
mov ecx, 0
mov dword [esp + 8], ecx
call fcn.0042fc98
mov edx, dword [ebp + 0x28]
mov dword [esp], edx
call sub.KERNEL32.dll_SetEndOfFile
sub esp, 4
and eax, eax
jne 0x4300dd
call sub.KERNEL32.dll_GetLastError
mov dword [ebp + 0x18], eax
mov eax, 0xffffffff
jmp 0x4300e2
mov eax, 0
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
add esp, 0x7c
ret

Function at 0x4302b8
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebp
mov eax, dword [0x460910]
cmp eax, 0xffffffff
jne 0x43033b
lea ecx, str.TABSIZE
mov dword [esp], ecx
lea ebp, [esp + 0x40]
mov dword [esp + 4], ebp
mov edx, 0x14
mov dword [esp + 8], edx
call sub.KERNEL32.dll_GetEnvironmentVariableA
sub esp, 0xc
mov edi, eax
test edi, edi
je 0x430330
cmp edi, 0x14
jg 0x430330
mov dword [esp], ebp
call fcn.00426298
test eax, eax
mov dword [0x460910], eax
jge 0x43033b
mov eax, 8
mov dword [0x460910], eax
jmp 0x43033b
mov ecx, 8
mov dword [0x460910], ecx
mov eax, dword [0x460910]
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
add esp, 0x5c
ret
Function at 0x4311d8
Capabilities:
Get file size

Disassembly:
sub esp, 0x7c
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x80]
mov eax, dword [ebp + 0x64]
and eax, 4
je 0x431214
mov ecx, dword [ebp + 0x28]
mov dword [esp], ecx
lea edx, [esp + 0x40]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov dword [esp + 0x44], eax
jmp 0x43121d
mov eax, 0
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x44]
mov ebp, dword [esp + 0x1c]
add esp, 0x7c
ret
Function at 0x444da0
Capabilities:
Delete file

Disassembly:
sub esp, 0x7c
mov dword [esp + 0x10], ebx
mov ecx, 0xffffffff
mov dword [esp + 0x40], ecx
mov dl, byte [esp + 0x80]
mov byte [esp], dl
mov bl, byte [esp + 0x81]
mov byte [esp + 1], bl
mov cl, byte [esp + 0x82]
mov byte [esp + 2], cl
mov dl, byte [esp + 0x83]
mov byte [esp + 3], dl
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
and eax, eax
je 0x444dfc
mov eax, 0
mov dword [esp + 0x40], eax
jmp 0x444e07
mov ecx, 6
mov dword [0x461af0], ecx
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x10]
add esp, 0x7c
ret
Function at 0x10002c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 0x54]
push edi
call fcn.100021e0
add esp, 4
test eax, eax
je 0x10002c77
jmp 0x10002c60
push dword [esi]
push dword [esi + 4]
call fcn.100c0920
push edi
call fcn.100021e0
add esp, 0xc
test eax, eax
jne 0x10002c60
cmp dword [esi + 0x78], 0
jne 0x10002e3e
lea eax, [esi + 0x58]
push eax
call fcn.100021e0
add esp, 4
test eax, eax
jne 0x10002e3e
mov eax, dword [0x101665c8]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [0x101665cc]
mov dword [esi + 0x10], eax
mov eax, dword [0x101665d0]
mov dword [esi + 0x14], eax
mov eax, dword [0x101665d4]
mov dword [esi + 0x18], eax
mov eax, dword [0x101665d8]
mov dword [esi + 0x1c], eax
mov eax, dword [0x101665dc]
mov dword [esi + 0x20], eax
test ecx, ecx
jne 0x10002ccf
lea ecx, [esi + 0x40]
mov eax, dword [ecx]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push ebx
push eax
push dword [esi + 0x5c]
call fcn.10002ed0
movzx edx, word [esi + 0x40]
add esp, 8
mov ebx, dword [ebp - 0xc]
mov eax, edx
cmp dl, bl
jae 0x10002d00
movzx eax, bx
mov edx, dword [ebp - 4]
cmp dword [esi + 0x48], edx
mov ecx, dword [ebp - 8]
cmovg edx, dword [esi + 0x48]
cmp dword [esi + 0x44], ecx
push edx
cmovg ecx, dword [esi + 0x44]
mov word [esi + 0x30], ax
mov dword [esi + 0x38], edx
mov dword [esi + 0x34], ecx
call fcn.10002820
movzx edx, word [esi + 0x30]
xor ecx, ecx
cmp edx, 8
mov dword [esi + 0x4c], eax
mov edi, 0x80
mov dword [esi + 0x78], 1
cmove ecx, edi
shr edx, 3
and edx, 0x1f
mov dword [esi + 0x50], ecx
mov ecx, dword [esi + 0x34]
imul edx, ecx
imul ecx, eax
push esi
imul edx, eax
shl ecx, 2
cmp edx, ecx
mov dword [esi + 0x3c], edx
cmovle edx, ecx
mov dword [esi + 0x70], edx
call dword [0x101665bc]
add esp, 8
pop ebx
test eax, eax
js 0x10002e2c
push esi
call fcn.100053d0
add esp, 4
push dword [esi + 0x70]
call fcn.100513a0
push eax
call fcn.100b8870
add esp, 8
mov dword [esi + 0x64], eax
test eax, eax
je 0x10002e2c
mov eax, 0x8120
cmp word [esi + 0x30], ax
je 0x10002dbd
push dword [esi + 0x70]
call fcn.100513a0
push eax
call fcn.100b8870
add esp, 8
mov dword [esi + 0x68], eax
test eax, eax
je 0x10002e2c
cmp dword [0x101665f0], 0
jne 0x10002e3e
push dword [esi + 0x28]
cmp dword [esi + 0x5c], 0
mov ecx, 0x43
mov eax, 0x50
cmovne eax, ecx
push eax
push str.SDLAudio_c_d
lea eax, [ebp - 0x4c]
push 0x40
push eax
call fcn.100ba560
cmp dword [esi + 0x5c], 0
lea eax, [ebp - 0x4c]
push esi
push 0
push eax
mov ecx, 0x10002220
mov eax, 0x10002e50
cmovne eax, ecx
push eax
call fcn.100c0260
add esp, 0x24
mov dword [esi + 0x74], eax
test eax, eax
jne 0x10002e3e
push esi
call fcn.10002270
push str.Couldnt_create_audio_thread
call fcn.100638c0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.10002270
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100513c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x100514d6
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dl, byte [esi + eax]
xor dl, bl
mov al, dl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr dl, 1
and eax, 0xa001
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
mov al, dl
xor al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr dl, 1
xor ax, cx
movzx ecx, ax
xor dl, cl
and dl, 1
movzx eax, dl
neg eax
sbb eax, eax
shr cx, 1
and eax, 0xa001
shr bx, 8
xor ax, cx
inc esi
movzx ecx, ax
xor bx, cx
movzx ebx, bx
cmp esi, edi
jb 0x100513d6
mov ax, bx
pop ebx
pop edi
pop esi
pop ebp
ret
mov ax, word [ebp + 8]
pop edi
pop esi
pop ebp
ret

Function at 0x100514e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
je 0x100515cd
push ebx
mov ebx, dword [ebp + 0xc]
lea esp, [esp]
movzx edx, byte [edi + ebx]
movzx ecx, al
xor edx, ecx
mov dword [ebp + 8], 0
test dl, 1
mov ecx, 0xedb88320
cmovne ecx, dword [ebp + 8]
shr edx, 1
xor ecx, edx
mov dword [ebp + 8], 0
test cl, 1
mov edx, 0xedb88320
cmovne edx, dword [ebp + 8]
shr ecx, 1
xor edx, ecx
mov dword [ebp + 8], 0
test dl, 1
mov ecx, 0xedb88320
cmovne ecx, dword [ebp + 8]
shr edx, 1
xor ecx, edx
mov dword [ebp + 8], 0
test cl, 1
mov edx, 0xedb88320
cmovne edx, dword [ebp + 8]
shr ecx, 1
xor edx, ecx
mov dword [ebp + 8], 0
test dl, 1
mov ecx, 0xedb88320
cmovne ecx, dword [ebp + 8]
shr edx, 1
xor ecx, edx
mov dword [ebp + 8], 0
test cl, 1
mov edx, 0xedb88320
cmovne edx, dword [ebp + 8]
shr ecx, 1
xor edx, ecx
mov dword [ebp + 8], 0
test dl, 1
mov ecx, 0xedb88320
cmovne ecx, dword [ebp + 8]
shr edx, 1
xor ecx, edx
shr eax, 7
xor eax, ecx
mov edx, 0xff000000
shr eax, 1
test cl, 1
mov ecx, 0x12b88320
cmovne ecx, edx
inc edi
xor eax, ecx
cmp edi, esi
jb 0x10051500
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x1006be00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x1006be62
cmp byte [esi], 0
je 0x1006be62
push dword [0x1016bb8c]
push dword [0x1016bb88]
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test edi, edi
je 0x1006be62
cmp edi, dword [0x1016bb8c]
jbe 0x1006be59
push edi
push dword [0x1016bb88]
call fcn.100913d0
add esp, 8
test eax, eax
je 0x1006be62
push edi
push eax
push esi
mov dword [0x1016bb88], eax
mov dword [0x1016bb8c], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, dword [0x1016bb88]
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret