joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10159cef
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101a5980
push 0x101a5978
push str.FlsGetValue
push 0x21
call fcn.10159a9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10159d26
push dword [ebp + 8]
mov ecx, esi
call dword [0x10179940]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10159d2e
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x101a5988
push 0x101a5980
push str.FlsSetValue
push 0x22
call fcn.10159a9c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10159d68
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10179940]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10160db6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10227db0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10160df6
cmp byte [ebx], 0xa
jne 0x10160df6
or byte [edi + eax + 0x28], 4
jmp 0x10160dfb
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10160efa
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10160edd
inc eax
cmp dl, 0xd
je 0x10160e27
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10160e4d
cmp eax, ecx
jae 0x10160e5b
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10160e0f
jmp 0x10160efa
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10160ed8
cmp dword [ebp - 0x10], 0
je 0x10160ed8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10227db0]
test byte [eax + edi + 0x28], 0x48
je 0x10160eb2
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10160e9d
mov byte [esi], dl
jmp 0x10160eae
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10227db0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10160efa
cmp byte [ebp - 1], 0xa
jne 0x10160ec1
cmp esi, ebx
jne 0x10160ec1
mov byte [esi], 0xa
jmp 0x10160ef9
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10161ad6
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10160efa
mov byte [esi], 0xd
jmp 0x10160ef9
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10227db0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10160ef7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10160efa
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10160f03
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10227db0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10160f49
cmp word [ebx], dx
jne 0x10160f49
or byte [eax + edi + 0x28], 4
jmp 0x10160f4e
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x101610b1
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10161091
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10160f8f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10160fc5
cmp eax, edx
jae 0x10160fd3
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10160f6a
jmp 0x101610b1
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1016108c
cmp dword [ebp - 0x18], 0
je 0x1016108c
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10227db0]
test byte [eax + edi + 0x28], 0x48
je 0x10161062
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10161026
mov word [esi], cx
jmp 0x1016105d
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10227db0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10227db0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10227db0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x101610b1
pop eax
cmp word [ebp - 4], ax
jne 0x10161072
cmp esi, ebx
jne 0x10161072
mov word [esi], ax
jmp 0x101610ae
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10161ad6
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x101610b1
push 0xd
pop eax
jmp 0x1016106d
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10227db0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x101610ab
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x101610b1
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x101630f1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1016318e
push ebx
push esi
call fcn.101630ba
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1015fc51
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1016313b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1016318d
push edi
push eax
call fcn.1015a1c8
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1016315b
call fcn.1015a0ab
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1016318c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1015fc51
add esp, 0x20
test eax, eax
jne 0x1016317a
push edi
call fcn.1015a0ab
jmp 0x10163182
push ebx
call fcn.1015a0ab
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10163191
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x101631a2
pop esi
ret
push ebx
push edi
push esi
call fcn.101630ba
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1015a1c8
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x101631ca
push ebx
push esi
push edi
call fcn.10146b50
add esp, 0xc
push 0
call fcn.1015a0ab
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1016359a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101631df

Function at 0x10167cd4
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1015950c
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10167d43
cmp esi, dword [ebp - 4]
je 0x10167d3e
cmp dword [ebp + 0xc], 0
je 0x10167d3e
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10167d1b
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10167826
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10167d45
xor eax, eax
inc eax
jmp 0x10167d45
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10167daa
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x101c6dd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1015950c
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1015950c
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10167e21
cmp word [ecx], dx
je 0x10167e21
mov eax, dword [0x101a7874]
push edi
dec eax
push eax
push 0x101a7760
call fcn.10167d49
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10167e94
cmp word [eax], dx
je 0x10167e94
mov eax, dword [edi]
test eax, eax
je 0x10167e45
cmp word [eax], dx
je 0x10167e45
lea eax, [ebp - 0x10]
push eax
call fcn.1016772c
jmp 0x10167e4e
lea eax, [ebp - 0x10]
push eax
call fcn.101677c7
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10167ebe
mov eax, dword [0x101a775c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x101a7450
call fcn.10167d49
add esp, 0xc
test al, al
je 0x10167ebe
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10167e89
cmp word [eax], di
je 0x10167e89
lea eax, [ebp - 0x10]
push eax
call fcn.1016772c
pop ecx
jmp 0x10167ec0
lea eax, [ebp - 0x10]
push eax
call fcn.101677c7
jmp 0x10167e86
mov eax, dword [edi]
test eax, eax
je 0x10167eab
cmp word [eax], dx
je 0x10167eab
lea eax, [ebp - 0x10]
push eax
call fcn.101676e1
pop ecx
jmp 0x10167ebe
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10167f89
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10167bce
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10167f89
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10167f89
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10167f89
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10167f16
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10159e6e
test ebx, ebx
je 0x10167f84
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10159e6e
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10167f89
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10167f89
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1014d408
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10167f8b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10143002
leave
ret
Function at 0x1016a620
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1016a64d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1016a64d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x90ccb8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0090ce08
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x90ccde
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90ccca
add dl, dl
jne 0x90cce9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90cd3c
xor eax, eax
add dl, dl
jne 0x90ccf6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90cddd
add dl, dl
jne 0x90cd05
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x90cd10
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x90cd1b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x90cd26
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x90cd32
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x90ccd5
mov eax, 1
add dl, dl
jne 0x90cd4a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x90cd55
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x90cd41
sub eax, ebx
mov ebx, 1
jne 0x90cd88
mov ecx, 1
add dl, dl
jne 0x90cd6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90cd79
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x90cd65
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x90ccd5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x90cd9f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90cdaa
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x90cd96
cmp eax, 0x7d00
jae 0x90cdcd
cmp eax, 0x500
jb 0x90cdc8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x90ccd5
cmp eax, 0x7f
ja 0x90cdd0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x90ccd5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x90cdfe
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x90ccd5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x5e256965
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x1a58000b
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1000457e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x100045cb
cmp byte [esi + 0x3d], bl
je 0x100045cb
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100045fa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x100045d2
sub eax, 1
je 0x100045d5
dec eax
sub eax, 1
jne 0x100045fa
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100045f2
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1005b6e7
add esp, 0x10
cmp edi, eax
jne 0x100045fa
cmp byte [esi + 0x3d], bl
sete al
jmp 0x100045cd
xor al, al
jmp 0x100045cd

Function at 0x10005fcd
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x10005fe7
xor eax, eax
jmp 0x100060b7
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x10006015
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x10006015
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x100060b6
cmp dword [esi + 0x4c], 0
je 0x100060b4
mov ecx, esi
call fcn.10004af5
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x10006041
push dword [esi + 0x4c]
push eax
call fcn.10001d23
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x100060b4
mov byte [esp + 0x10], al
lea eax, [esp + 0x3c]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x10006085
sub eax, 1
je 0x10006085
dec eax
sub eax, 1
jne 0x100060b4
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x10006033
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x18]
sub ebp, eax
je 0x100060a4
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.1005b6e7
add esp, 0x10
cmp ebp, eax
jne 0x100060b4
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x100060b6
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x10007638
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x14]
test esi, esi
jg 0x10007658
jl 0x1000764f
test edi, edi
jne 0x10007658
xor eax, eax
xor edx, edx
jmp 0x1000771f
cmp dword [ebp + 0x38], 0
je 0x1000766e
push esi
push edi
push dword [esp + 0x18]
call fcn.10007729
jmp 0x1000771f
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100076b2
mov eax, dword [ebp + 0x2c]
cmp dword [eax], 0
jbe 0x100076b2
cmp dword [eax], edi
mov esi, edi
mov ebx, dword [esp + 0x14]
cmovb esi, dword [eax]
push esi
push ecx
push ebx
call fcn.10056540
mov eax, dword [ebp + 0x2c]
add ebx, esi
mov dword [esp + 0x20], ebx
add esp, 0xc
mov ebx, edi
sub ebx, esi
sub dword [eax], esi
mov eax, dword [ebp + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x100076ba
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [ebp + 0x4c], 0
mov ecx, ebx
je 0x10007715
mov ecx, ebp
call fcn.10004af5
mov edx, dword [esp + 0x14]
mov ecx, ebx
jmp 0x100076f5
push dword [ebp + 0x4c]
push eax
push 1
push edx
call fcn.1005b060
mov edx, dword [esp + 0x24]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [esp + 0x14], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x10007725
mov eax, 0xfff
cmp ebx, eax
ja 0x100076d1
test ecx, ecx
je 0x10007715
push dword [ebp + 0x4c]
push ebx
push 1
push edx
call fcn.1005b060
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
sub edi, ebx
jmp 0x10007717

Function at 0x100077fd
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000781e
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.100078d3
jmp 0x100078cd
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10007841
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10007843
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x100078be
jg 0x10007856
test esi, esi
je 0x100078be
test eax, eax
jl 0x100078a0
jg 0x10007860
test ebp, ebp
je 0x100078a0
cmp edi, eax
jg 0x10007870
jl 0x1000786a
cmp esi, ebp
jae 0x10007870
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call fcn.10056540
mov eax, dword [ebx + 0x30]
add esp, 0xc
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
mov eax, dword [esp + 0x1c]
add eax, ebp
test edi, edi
jl 0x100078be
jg 0x100078a4
test esi, esi
je 0x100078be
jmp 0x100078a4
mov eax, dword [esp + 0x1c]
cmp dword [ebx + 0x4c], 0
je 0x100078be
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.1005b6e7
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc
Function at 0x10007f78
Capabilities:
Check for time delay via gettickcount

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0xc8
cmp dword [0x1011c8f0], eax
jae 0x10007f96
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1011c8f0], eax
ret
Function at 0x10010884
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1007950d
call fcn.10054538
sub esp, 0x38
push ebx
push esi
push edi
mov eax, 0x40e4e0
mov esi, ecx
call eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
movzx eax, ax
xor ebx, ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.1000ff7a
pop ecx
mov dword [ebp - 0x24], eax
mov eax, ebx
mov dword [ebp - 4], ebx
mov edi, 0xb7d0b8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
mov ebx, dword [edi]
test ebx, ebx
je 0x10010984
mov edi, dword [ebp - 0x10]
mov esi, dword [ebx]
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
cmp dword [eax + 0x20], 0x534030
je 0x10010930
mov eax, edi
mov dword [ebp - 0x1c], 0x78
cdq
sub eax, edx
sar eax, 1
cdq
idiv dword [ebp - 0x1c]
push eax
movzx eax, word [esi + 0x22]
push edx
push eax
push esi
lea eax, [ebp - 0x44]
push str.Entity_0x_08x__with_model__d__at_ARRAY_StreamSectors__d__d__is_invalid_n
push eax
call fcn.10010180
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x1001091f
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x44]
call fcn.10004be7
jmp 0x10010971
mov ecx, dword [0x1011c904]
movzx eax, word [esi + 0x22]
push eax
mov edx, dword [ecx]
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, word [ebp - 0x18]
jne 0x10010971
test dword [esi + 0x1c], 0x2400
jne 0x10010971
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [esi + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000ff91
mov eax, dword [ebx + 4]
mov ebx, eax
test eax, eax
jne 0x100108dc
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add edi, 4
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp edi, 0xb992b8
jl 0x100108cf
mov edi, 0xb992c0
mov dword [ebp - 0x14], edi
mov esi, dword [edi]
test esi, esi
je 0x100109fa
mov edi, dword [ebp - 0x18]
mov ebx, dword [esi]
mov ecx, dword [0x1011c904]
mov dword [ebp - 0x1c], ebx
movzx eax, word [ebx + 0x22]
mov edx, dword [ecx]
push eax
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, di
jne 0x100109f0
test dword [ebx + 0x1c], 0x2400
jne 0x100109f0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [ebx + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000ff91
mov esi, dword [esi + 4]
test esi, esi
jne 0x100109ab
mov edi, dword [ebp - 0x14]
add edi, 0xc
mov dword [ebp - 0x14], edi
cmp edi, 0xb99ec0
jl 0x100109a2
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, eax
je 0x10010a3f
movzx eax, word [esi + 0xe]
push eax
mov eax, 0x4089a0
call eax
movzx eax, word [esi + 0xe]
imul eax, eax, 0x14
pop ecx
lea ecx, [ebp - 0x18]
mov byte [eax + 0x8e4cd0], 0
call fcn.1000e5c9
mov esi, dword [ebp - 0x18]
cmp esi, dword [ebp - 0x24]
jne 0x10010a14
lea eax, [ebp - 0x24]
push eax
mov ecx, eax
call fcn.10010023
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret