joyce8/EMBER2024-capa huggingface dataset:
Function at 0x864b78
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0xa23c64]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0xa24148]
je 0x864bad
inc eax
cmp eax, 0x13
jb 0x864b9e
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0xa24148]
jne 0x864cd3
mov eax, dword [0xae7a5c]
cmp eax, 1
je 0x864cab
cmp eax, edx
jne 0x864bdd
cmp dword [0xa239dc], 1
je 0x864cab
cmp ecx, 0xfc
je 0x864cd3
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x864c13
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.0085e2f0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0085d760
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x864c47
mov eax, edi
push eax
call fcn.0085d760
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x997f0c
push edi
call fcn.00858900
add esp, 0x10
push edi
call fcn.0085d760
push dword [esi + 0xa2414c]
mov ebx, eax
call fcn.0085d760
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00858020
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0085e2f0
push edi
push ebx
call fcn.0085e300
push 0x997f04
push ebx
call fcn.0085e300
push dword [esi + 0xa2414c]
push ebx
call fcn.0085e300
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00863737
add esp, 0x2c
jmp 0x864cd3
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0xa2414c]
push dword [esi]
call fcn.0085d760
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0085e419
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x865365
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00858020
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x865400
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0xae7a10]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x865400
cmp eax, 1
je 0x865421
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x865400
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x8653cd
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x8653fc
xor eax, eax
inc eax
jmp 0x865440
cmp edi, eax
jae 0x865404
xor eax, eax
jmp 0x865440
cmp eax, esi
jae 0x86540b
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov eax, dword [0xae7a10]
jmp 0x865424
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x8654f2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x865520
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x865527
cmp ebx, dword [eax + 4]
jae 0x865527
xor eax, eax
jmp 0x865717
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x865538
xor eax, eax
inc eax
jmp 0x865716
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x86554e
cmp ecx, edx
jae 0x865693
cmp dword [eax + 4], 0
je 0x865557
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x86553f
cmp dword [ebp + 8], 0
je 0x865579
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x865693
cmp eax, esi
jae 0x865693
mov eax, dword [0xae7e10]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x86559e
cmp dword [esi*4 + 0xae7e18], edi
je 0x865697
inc esi
cmp esi, eax
jl 0x86558c
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
je 0x865713
cmp dword [ebp - 8], 0x1000000
jne 0x865713
test byte [ebp - 0xc], 0xcc
je 0x86561c
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x865713
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x865713
cmp word [eax + 0x18], 0x10b
jne 0x865713
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x865713
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x86561c
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x86561c
test byte [ecx + 0x27], 0x80
jne 0x865693
push 1
push 0xae7e58
call dword [sym.imp.kernel32.dll_InterlockedExchange]
test eax, eax
jne 0x865530
mov ecx, dword [0xae7e10]
test ecx, ecx
mov edx, ecx
jle 0x865650
lea eax, [ecx*4 + 0xae7e14]
cmp dword [eax], edi
je 0x865650
dec edx
sub eax, 4
test edx, edx
jg 0x865644
test edx, edx
jne 0x865681
push 0xf
pop ebx
cmp ecx, ebx
jg 0x86565d
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x865675
lea eax, [edx*4 + 0xae7e18]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x865663
cmp ecx, 0x10
jge 0x865681
inc ecx
mov dword [0xae7e10], ecx
push 0
push 0xae7e58
call dword [sym.imp.kernel32.dll_InterlockedExchange]
jmp 0x865530
xor eax, eax
jmp 0x865716
test esi, esi
jle 0x865530
mov ebx, dword [sym.imp.kernel32.dll_InterlockedExchange]
push 1
push 0xae7e58
call ebx
test eax, eax
jne 0x865530
cmp dword [esi*4 + 0xae7e18], edi
je 0x8656ed
mov eax, dword [0xae7e10]
lea esi, [eax - 1]
test esi, esi
jl 0x8656db
cmp dword [esi*4 + 0xae7e18], edi
je 0x8656d7
dec esi
jns 0x8656cb
test esi, esi
jge 0x8656eb
cmp eax, 0x10
jge 0x8656e6
inc eax
mov dword [0xae7e10], eax
lea esi, [eax - 1]
jmp 0x8656ed
je 0x865705
xor ecx, ecx
test esi, esi
jl 0x865705
lea eax, [ecx*4 + 0xae7e18]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x8656f3
push 0
push 0xae7e58
call ebx
jmp 0x865530
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x86a2a4
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00858020
mov eax, dword [0xa23c64]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0086485b
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x86a3d7
push 2
push esi
push dword [ebp + 8]
call fcn.0086485b
add esp, 0xc
cmp eax, ebx
je 0x86a3d7
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x86a377
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.0085f580
push 0x8000
push dword [ebp + 8]
call fcn.0086a9eb
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x86a32d
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.00862186
add esp, 0xc
cmp eax, 0xffffffff
je 0x86a34d
sub edi, eax
test edi, edi
jg 0x86a325
jmp 0x86a365
call fcn.00859ddf
cmp dword [eax], 5
jne 0x86a362
call fcn.00859dd6
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.0086a9eb
pop ecx
pop ecx
jmp 0x86a3bf
jge 0x86a3bf
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0086485b
push dword [ebp + 8]
call fcn.00863ad0
add esp, 0x10
push eax
call dword [sym.imp.kernel32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x86a3bf
call fcn.00859dd6
mov dword [eax], 0xd
call fcn.00859ddf
mov edi, eax
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.0086485b
add esp, 0xc
mov eax, esi
pop edi
jmp 0x86a3d9
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0085e419
leave
ret
Function at 0x86a77b
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x99a478
call fcn.0085e5ac
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0xae7ef4], edi
jne 0x86a7bf
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x86a7aa
mov dword [0xae7ef4], ebx
jmp 0x86a7bf
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x86a7bf
mov dword [0xae7ef4], 2
mov eax, dword [0xae7ef4]
cmp eax, ebx
jne 0x86a7df
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
jmp 0x86a8a2
cmp eax, 2
je 0x86a7e8
cmp eax, edi
jne 0x86a810
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x86a7fb
mov eax, dword [0xae7eac]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x86a817
xor eax, eax
jmp 0x86a8a2
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.00858020
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x86a84a
cmp esi, edi
jne 0x86a860
push dword [ebp - 0x20]
call fcn.00859c55
pop ecx
mov esi, eax
cmp esi, edi
je 0x86a810
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
je 0x86a893
cmp dword [ebp + 0x14], edi
jne 0x86a87d
push edi
push edi
jmp 0x86a883
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x86a89f
push esi
call fcn.00858882
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.0085e5e7
ret
Function at 0x86a8ab
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x99a488
call fcn.0085e5ac
xor esi, esi
cmp dword [0xae7ef8], esi
jne 0x86a8ef
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x86a8da
mov dword [0xae7ef8], edi
jmp 0x86a8ef
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x86a8ef
mov dword [0xae7ef8], 2
mov eax, dword [0xae7ef8]
cmp eax, 2
je 0x86a9d0
cmp eax, esi
je 0x86a9d0
cmp eax, 1
jne 0x86a934
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x86a91d
mov eax, dword [0xae7eac]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x86a93b
xor eax, eax
jmp 0x86a9e2
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.00858020
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x86a971
cmp edi, esi
jne 0x86a98c
lea eax, [ebx + ebx]
push eax
call fcn.00859c55
pop ecx
mov edi, eax
cmp edi, esi
je 0x86a934
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoW]
test eax, eax
je 0x86a9bf
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x86a9a9
push esi
push esi
jmp 0x86a9af
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x86a9cb
push edi
call fcn.00858882
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x86a9e2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.0085e5e7
ret
Function at 0x86aea5
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x86aebe
or eax, 0xffffffff
jmp 0x86af1f
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x86af1b
push 0x3d
push esi
call fcn.0086b0a5
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x86af1b
cmp esi, eax
je 0x86af1b
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0xae7a30]
sete cl
cmp eax, dword [0xae7a34]
mov dword [ebp - 8], ecx
jne 0x86af01
mov edi, eax
call fcn.0086ae44
mov dword [0xae7a30], eax
cmp eax, ebx
jne 0x86af5a
cmp dword [ebp + 0xc], ebx
je 0x86af23
cmp dword [0xae7a38], ebx
je 0x86af23
call fcn.0086a433
test eax, eax
je 0x86af5a
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x86af2c
xor eax, eax
jmp 0x86af1e
push 4
call fcn.00859c55
cmp eax, ebx
pop ecx
mov dword [0xae7a30], eax
je 0x86af1b
mov dword [eax], ebx
cmp dword [0xae7a38], ebx
jne 0x86af5a
push 4
call fcn.00859c55
cmp eax, ebx
pop ecx
mov dword [0xae7a38], eax
je 0x86af1b
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0xae7a30]
call fcn.0086adf7
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x86afbb
cmp dword [esi], ebx
je 0x86afbb
lea esi, [esi + edi*4]
push dword [esi]
call fcn.00858882
cmp dword [ebp - 8], ebx
pop ecx
jne 0x86af9e
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x86affc
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x86af95
mov eax, edi
shl eax, 2
push eax
push dword [0xae7a30]
call fcn.00860f6c
cmp eax, ebx
pop ecx
pop ecx
je 0x86affc
jmp 0x86aff7
cmp dword [ebp - 8], ebx
jne 0x86b067
cmp edi, ebx
jge 0x86afca
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0xae7a30]
call fcn.00860f6c
cmp eax, ebx
pop ecx
pop ecx
je 0x86af1b
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0xae7a30], eax
cmp dword [ebp + 0xc], ebx
je 0x86b051
push dword [ebp - 4]
call fcn.0085d760
inc eax
inc eax
push eax
call fcn.00859c55
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x86b051
push dword [ebp - 4]
push esi
call fcn.0085e2f0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x86b04a
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.00858882
pop ecx
cmp dword [ebp - 8], ebx
je 0x86b05f
push dword [ebp - 4]
call fcn.00858882
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x86af1e
push dword [ebp - 4]
call fcn.00858882
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x86af28
Function at 0x86b584
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], edi
xor eax, eax
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], edi
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0xc]
shr eax, 2
add eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
rdtsc
mov esi, dword [ebp - 0x1c]
mov ecx, eax
rdtsc
mov esi, dword [esi]
mov edi, eax
rdtsc
sub eax, edi
sub edi, ecx
mov edx, eax
lea esi, [edi*4]
shr edi, 2
add edi, esi
xor eax, eax
sub edi, edx
setge al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x86b4eb
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shr ecx, 7
pxor xmm0, xmm0
mov esi, esi
lea edi, [edi]
movdqa xmmword [edi], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x50], xmm0
movdqa xmmword [edi + 0x60], xmm0
movdqa xmmword [edi + 0x70], xmm0
lea edi, [edi + 0x80]
dec ecx
jne 0x86b4b4
emms
jmp 0x86b579
mov eax, dword [ebp + 0xc]
mov edx, eax
shr edx, 1
shr eax, 2
add edx, dword [ebp + 8]
add edx, eax
mov dword [ebp - 0x14], edx
rdtsc
mov esi, dword [ebp - 0x14]
mov ecx, eax
rdtsc
mov esi, dword [esi]
mov edi, eax
rdtsc
sub eax, edi
sub edi, ecx
mov edx, eax
lea esi, [edi*4]
shr edi, 2
add edi, esi
xor eax, eax
sub edi, edx
setge al
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x86b49e
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shr ecx, 7
pxor xmm0, xmm0
lea esi, [esi]
movntdq xmmword [edi], xmm0
movntdq xmmword [edi + 0x10], xmm0
movntdq xmmword [edi + 0x20], xmm0
movntdq xmmword [edi + 0x30], xmm0
movntdq xmmword [edi + 0x40], xmm0
movntdq xmmword [edi + 0x50], xmm0
movntdq xmmword [edi + 0x60], xmm0
movntdq xmmword [edi + 0x70], xmm0
lea edi, [edi + 0x80]
dec ecx
jne 0x86b544
sfence
emms
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
test dword [0xae7f00], 0x400
jne 0x86b430
test dword [0xae7f00], 0xfffffe00
jne 0x86b454
test dword [0xae7f00], 0xffffff80
jne 0x86b430
test dword [0xae7f00], 0xffffffff
jne 0x86b720
call fcn.0086b8a0
jmp fcn.0086b584
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], edi
xor eax, eax
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
rep stosb byte es:[edi], al
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x86fb98
Capabilities:
Get file size

Disassembly:
push ebx
sub esp, 0x40
mov ebx, ecx
mov ecx, ebx
call fcn.0086fb64
xor eax, eax
push eax
push 0x8000080
push 3
push eax
push 1
push closesocket
push dword [esp + 0x60]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebx + 0x2d4], eax
test eax, eax
je 0x86fc4f
push 0
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebx + 0x2d8], eax
lea edx, [ebx + 0x2d4]
mov eax, dword [0xa24e40]
mov dword [esp + 0x30], eax
mov eax, dword [0xa24e44]
mov dword [esp + 0x34], eax
mov eax, dword [0xa24e48]
mov dword [esp + 0x38], eax
mov eax, dword [0xa24e4c]
mov dword [esp + 0x3c], eax
xor eax, eax
mov dword [esp], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
mov dword [eax], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x38]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 0xc], edx
call fcn.008701e0
test eax, eax
jne 0x86fc48
mov byte [ebx + 0x2d0], 0
add esp, 0x40
pop ebx
ret 4
mov eax, 0xffffff80
add esp, 0x40
pop ebx
ret 4

Function at 0x8700c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 8
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x8701b6
lea eax, [ebx + 0x250]
push eax
call fcn.00873ec4
lea eax, [ebx + 0x1e0]
push eax
call fcn.00873fc4
lea eax, [ebx + 0x78]
push eax
call fcn.00876024
add esp, 0xc
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x870156
mov ecx, dword [ebx + 0x34]
test ecx, ecx
je 0x870156
mov edx, 0
jle 0x8701c8
lea ecx, [edx + edx]
add ecx, ecx
add ecx, ecx
add ecx, ecx
add ecx, ecx
lea esi, [edx + edx]
add esi, esi
add esi, esi
add esi, esi
mov dword [esp + 4], edi
mov edi, edx
mov dword [esp], ebp
mov ebp, ecx
jmp 0x870132
mov eax, dword [ebx + 0x48]
add eax, ebp
push eax
call fcn.00876cd8
mov eax, esi
add eax, dword [ebx + 0x4c]
push eax
call fcn.00876c4c
add esp, 8
add ebp, 0x20
add esi, 0x10
inc edi
cmp edi, dword [ebx + 0x34]
jl 0x87012f
jmp 0x8701be
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x870164
push eax
call fcn.00858882
pop ecx
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x870172
push eax
call fcn.00858882
pop ecx
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x870180
push eax
call fcn.00858882
pop ecx
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x87018e
push eax
call fcn.00858882
pop ecx
lea eax, [ebx + 0x18]
push eax
call fcn.008760d4
pop ecx
mov eax, dword [ebx]
test eax, eax
je 0x8701a6
push eax
call dword [ebx + 0x2c8]
pop ecx
push 0x2d0
push 0
push ebx
call fcn.0086b688
add esp, 0xc
xor eax, eax
add esp, 8
pop ebx
pop esi
ret
mov edi, dword [esp + 4]
mov ebp, dword [esp]
mov eax, dword [ebx + 0x48]
push eax
call fcn.00858882
push dword [ebx + 0x4c]
call fcn.00858882
add esp, 8
jmp 0x870156
Function at 0x87023c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x1c
mov esi, ecx
mov ebx, edx
mov ebp, eax
test ebp, ebp
je 0x87025f
xor edi, edi
push 1
push edi
push edi
push ebp
call dword [esp + 0x54]
mov edi, eax
add esp, 0x10
jmp 0x870264
mov edi, 0xffffffff
push 0x2d0
push 0
push ebx
call fcn.0086b688
mov dword [ebx], ebp
mov ebp, dword [esp + 0x4c]
mov dword [ebx + 0x2c0], ebp
mov ebp, dword [esp + 0x50]
mov dword [ebx + 0x2c4], ebp
mov ebp, dword [esp + 0x54]
mov dword [ebx + 0x2c8], ebp
mov ebp, dword [esp + 0x58]
mov dword [ebx + 0x2cc], ebp
lea ebp, [ebx + 0x18]
push ebp
call fcn.00876bc0
add esp, 0x10
test esi, esi
je 0x8702d2
mov eax, dword [esp + 0x3c]
push eax
push ebp
call fcn.008760f8
mov edx, eax
mov eax, dword [esp + 0x44]
push eax
push esi
push edx
call fcn.0086b6b8
mov ecx, dword [esp + 0x50]
push ecx
push ebp
call fcn.0087617c
add esp, 0x1c
cmp edi, 0xffffffff
je 0x8702de
mov dword [ebx + 4], 1
mov ecx, 1
mov dword [ebx + 0x34], ecx
push 0x20
push ecx
call fcn.008587c7
mov dword [ebx + 0x48], eax
push 0x10
push dword [ebx + 0x34]
call fcn.008587c7
mov dword [ebx + 0x4c], eax
lea esi, [ebx + 0x78]
push 0xffffffffffffffff
push esi
call fcn.00876be4
add esp, 0x18
lea edi, [ebx + 0x5c]
mov eax, ebx
mov edx, dword [ebx + 0x48]
mov dword [esp + 0xc], edi
mov ecx, dword [ebx + 0x4c]
mov dword [esp + 0x10], 0
call fcn.00871058
mov edi, eax
test edi, edi
jl 0x87033f
mov dword [ebx + 0x58], 1
mov eax, edi
add esp, 0x1c
pop ebx
pop ebp
pop esi
pop edi
ret
mov dword [ebx], 0
test ebx, ebx
je 0x870335
lea ecx, [ebx + 0x250]
push ecx
call fcn.00873ec4
lea ecx, [ebx + 0x1e0]
push ecx
call fcn.00873fc4
push esi
call fcn.00876024
add esp, 0xc
mov ecx, dword [ebx + 0x48]
test ecx, ecx
je 0x8703cc
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x8703cc
mov eax, 0
jle 0x870439
lea edx, [eax + eax]
add edx, edx
add edx, edx
add edx, edx
add edx, edx
lea esi, [eax + eax]
add esi, esi
add esi, esi
add esi, esi
mov dword [esp + 0x18], edi
mov edi, eax
mov dword [esp + 0x14], ebp
mov ebp, edx
jmp 0x8703a8
mov ecx, dword [ebx + 0x48]
add ecx, ebp
push ecx
call fcn.00876cd8
mov ecx, esi
add ecx, dword [ebx + 0x4c]
push ecx
call fcn.00876c4c
add esp, 8
add ebp, 0x20
add esi, 0x10
inc edi
cmp edi, dword [ebx + 0x34]
jl 0x8703a5
jmp 0x87042e
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x8703da
push ecx
call fcn.00858882
pop ecx
mov ecx, dword [ebx + 0x44]
test ecx, ecx
je 0x8703e8
push ecx
call fcn.00858882
pop ecx
mov ecx, dword [ebx + 0x40]
test ecx, ecx
je 0x8703f6
push ecx
call fcn.00858882
pop ecx
mov ecx, dword [ebx + 0x38]
test ecx, ecx
je 0x870404
push ecx
call fcn.00858882
pop ecx
push ebp
call fcn.008760d4
pop ecx
mov ecx, dword [ebx]
test ecx, ecx
je 0x870419
push ecx
call dword [ebx + 0x2c8]
pop ecx
push 0x2d0
push 0
push ebx
call fcn.0086b688
add esp, 0xc
jmp 0x870335
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov ecx, dword [ebx + 0x48]
push ecx
call fcn.00858882
push dword [ebx + 0x4c]
call fcn.00858882
add esp, 8
jmp 0x8703cc