joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408790
Capabilities:
Terminate process

Disassembly:
call fcn.00413380
call fcn.00410b70
cmp dword [0x44cc04], 0
mov dword [0x44cc08], eax
jne 0x4087b2
call fcn.0041f6e0
mov dword [0x44cc04], eax
cmp dword [0x44cc08], 0
push esi
je 0x4087f6
push 0x44cbd8
push 0x441fcc
call fcn.00419280
add esp, 8
mov dword [0x44cbe0], eax
cmp dword [0x44cc08], 0
je 0x408932
mov edx, dword [0x44deec]
push edx
call fcn.00418b90
add esp, 4
mov dword [0x44cbdc], eax
pop esi
ret
call fcn.00413380
mov eax, dword [0x44a8cc]
push eax
call fcn.00418b90
push eax
mov dword [0x44cbd8], eax
call fcn.00419440
mov esi, eax
add esp, 8
test esi, esi
je 0x40883e
mov eax, dword [0x44cbd8]
call fcn.00408710
test eax, eax
jne 0x40883e
mov ecx, dword [0x44cbd8]
push ecx
push str.__s__doesnt_look_like_a_tag_file__I_refuse_to_overwrite_it.
push 1
call fcn.004189d0
add esp, 0xc
cmp dword [0x44a8b0], 0
je 0x40888f
cmp dword [0x44a8a8], 0
je 0x408872
test esi, esi
je 0x408872
mov edx, dword [0x44cbd8]
push 0x441f88
push edx
call fcn.0042a7e7
add esp, 8
mov dword [0x44cbe0], eax
jmp 0x40890f
mov eax, dword [0x44cbd8]
push 0x441f84
push eax
call fcn.0042a7e7
add esp, 8
mov dword [0x44cbe0], eax
jmp 0x40890f
cmp dword [0x44a8a8], 0
je 0x4088ed
test esi, esi
je 0x4088ed
mov ecx, dword [0x44cbd8]
push 0x441f80
push ecx
call fcn.0042a7e7
add esp, 8
test eax, eax
mov dword [0x44cbe0], eax
je 0x40891c
push ebx
mov ebx, eax
call fcn.00408420
mov edx, dword [0x44cbe0]
push edx
mov dword [0x44cbe8], eax
call fcn.0042a628
mov eax, dword [0x44cbd8]
push 0x441f7c
push eax
call fcn.0042a7e7
add esp, 0xc
mov dword [0x44cbe0], eax
pop ebx
jmp 0x40890f
mov ecx, dword [0x44cbd8]
push 0x441fcc
push ecx
call fcn.0042a7e7
add esp, 8
test eax, eax
mov dword [0x44cbe0], eax
je 0x40891c
call fcn.00408220
cmp dword [0x44cbe0], 0
jne 0x4087d3
push str.cannot_open_tag_file
push 5
call fcn.004189d0
add esp, 8
push 1
call fcn.0042abe9
mov eax, dword [0x44cbd8]
push eax
call fcn.00419120
add esp, 4
mov dword [0x44cbdc], eax
pop esi
ret

Function at 0x4113c0
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00418c20
mov esi, dword [esp + 0xc]
mov eax, dword [esi]
push eax
call fcn.00419330
call fcn.00410850
add esi, 4
push esi
call fcn.004136c0
mov esi, eax
push esi
call fcn.00415010
call fcn.004134b0
call fcn.00415a80
call fcn.00415330
call fcn.00415310
push str.Reading_initial_options_from_command_line_n
call fcn.00413320
push esi
call fcn.00414e20
call fcn.004133e0
mov eax, esi
call fcn.00411220
push esi
call fcn.00413740
add esp, 0x18
call fcn.0040fa90
call fcn.00419310
call fcn.00417f40
call fcn.00408190
call fcn.00415490
call fcn.00415bc0
call fcn.00410800
push 0
call fcn.0042abe9
pop esi
int3

Function at 0x413ff0
Capabilities:
Terminate process

Disassembly:
push edi
call fcn.00413fa0
push 0xa
call fcn.0042c823
call fcn.004189c0
push eax
push str.Usage:__s__options___file_s___n
call fcn.0042c0ea
push 0xa
call fcn.0042c823
add esp, 0x10
mov edi, 0x44a900
call fcn.00413ef0
push 0
call fcn.0042abe9
pop edi
int3
Function at 0x4189d0
Capabilities:
Terminate process

Disassembly:
push ebx
mov bl, byte [esp + 8]
test bl, 2
mov eax, str.Warning:
jne 0x4189e4
mov eax, 0x441dd4
push eax
mov eax, dword [0x44d2e8]
push eax
push str._s:__s
call fcn.0042ac9f
add eax, 0x20
push eax
call fcn.0042a068
mov edx, dword [esp + 0x1c]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.0042ac9f
add eax, 0x20
push eax
call fcn.0042d00f
add esp, 0xc
test bl, 4
je 0x418a48
call fcn.0042a6df
mov eax, dword [eax]
push eax
call fcn.0042ce5a
add esp, 4
push eax
push str._:__s
call fcn.0042ac9f
add eax, 0x20
push eax
call fcn.0042a068
add esp, 0xc
call fcn.0042ac9f
add eax, 0x20
push eax
push 0x442130
call fcn.0042be65
add esp, 8
test bl, 1
pop ebx
je 0x418a6b
push 1
call fcn.0042abe9
ret
Function at 0x429fcc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b640]
jne 0x429fd6
repz ret
jmp fcn.00432307
Function at 0x434b57
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x44c240]
je 0x434b72
inc edi
cmp edi, 0x17
jb 0x434b63
cmp edi, 0x17
jae 0x434cf2
push ebp
push 3
call fcn.00439099
cmp eax, 1
pop ecx
je 0x434cbe
push 3
call fcn.00439099
test eax, eax
pop ecx
jne 0x434ba6
cmp dword [0x44bac4], 1
je 0x434cbe
cmp ebx, 0xfc
je 0x434cf1
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x44d948
push ebp
call fcn.00436bed
add esp, 0xc
test eax, eax
je 0x434bdc
push esi
push esi
push esi
push esi
push esi
call fcn.00430e49
add esp, 0x14
push 0x104
mov esi, 0x44d961
push esi
push 0
mov byte [0x44da65], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x434c20
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00436bed
add esp, 0xc
test eax, eax
je 0x434c20
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00430e49
add esp, 0x14
push esi
call fcn.00432b40
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x434c65
push esi
call fcn.00432b40
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x44dc5c
push 0x441668
sub ecx, eax
push ecx
push eax
call fcn.00437122
add esp, 0x14
test eax, eax
je 0x434c65
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00430e49
add esp, 0x14
jmp 0x434c67
xor esi, esi
push 0x447610
push ebx
push ebp
call fcn.004380c3
add esp, 0xc
test eax, eax
je 0x434c87
push esi
push esi
push esi
push esi
push esi
call fcn.00430e49
add esp, 0x14
push dword [edi*8 + 0x44c244]
push ebx
push ebp
call fcn.004380c3
add esp, 0xc
test eax, eax
je 0x434ca9
push esi
push esi
push esi
push esi
push esi
call fcn.00430e49
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043ad37
add esp, 0xc
jmp 0x434cf1
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x434cf1
cmp ebp, 0xffffffff
je 0x434cf1
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x44c244]
push dword [esi]
call fcn.00432b40
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x438134
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x438161
call fcn.0042a6f2
mov dword [eax], esi
call fcn.0042a6df
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00430f45
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x43813d
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x438190
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042a705
pop ecx
call fcn.0042a6df
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4381b7
test al, 1
je 0x4381b7
test byte [esp + 0xc], 2
je 0x4381b7
call fcn.0042a6f2
mov dword [eax], 5
call fcn.0042a6df
mov dword [eax], 0xd
jmp 0x438187
xor eax, eax
pop esi
ret
Function at 0x438b1d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043051a
xor ebx, ebx
cmp dword [0x44ddf4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x438bf3
push 0x4482e4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x438cd3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
cmp eax, ebx
je 0x438cd3
push eax
call fcn.004304ac
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44ddf4], eax
call esi
push eax
call fcn.004304ac
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44ddf8], eax
call esi
push eax
call fcn.004304ac
mov dword [0x44ddfc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042aa02
test eax, eax
pop ecx
pop ecx
je 0x438bc1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00430e49
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x438bf3
push str.GetUserObjectInformationW
push edi
call esi
push eax
call fcn.004304ac
cmp eax, ebx
pop ecx
mov dword [0x44de04], eax
je 0x438bf3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004304ac
pop ecx
mov dword [0x44de00], eax
mov eax, dword [0x44de00]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x438c78
cmp dword [0x44de04], ecx
je 0x438c78
push eax
call fcn.00430523
push dword [0x44de04]
mov esi, eax
call fcn.00430523
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x438c78
cmp edi, ebx
je 0x438c78
call esi
cmp eax, ebx
je 0x438c45
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x438c45
test byte [ebp - 0x18], 1
jne 0x438c78
lea eax, [ebp - 0x10]
push eax
call fcn.0042aa39
test eax, eax
pop ecx
je 0x438c60
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00430e49
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x438c6f
or dword [ebp + 0x10], 0x200000
jmp 0x438cb3
or dword [ebp + 0x10], 0x40000
jmp 0x438cb3
mov eax, dword [0x44ddf8]
cmp eax, dword [ebp - 8]
je 0x438cb3
push eax
call fcn.00430523
cmp eax, ebx
pop ecx
je 0x438cb3
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x438cb3
mov eax, dword [0x44ddfc]
cmp eax, dword [ebp - 8]
je 0x438cb3
push eax
call fcn.00430523
cmp eax, ebx
pop ecx
je 0x438cb3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44ddf4]
call fcn.00430523
cmp eax, ebx
pop ecx
je 0x438cd3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x438cd5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43ad37
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043051a
xor ebx, ebx
cmp dword [0x44de14], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x43ae0d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43aeed
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43aeed
push eax
call fcn.004304ac
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44de14], eax
call esi
push eax
call fcn.004304ac
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44de18], eax
call esi
push eax
call fcn.004304ac
mov dword [0x44de1c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042aa02
test eax, eax
pop ecx
pop ecx
je 0x43addb
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00430e49
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x43ae0d
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004304ac
cmp eax, ebx
pop ecx
mov dword [0x44de24], eax
je 0x43ae0d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004304ac
pop ecx
mov dword [0x44de20], eax
mov eax, dword [0x44de20]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43ae92
cmp dword [0x44de24], ecx
je 0x43ae92
push eax
call fcn.00430523
push dword [0x44de24]
mov esi, eax
call fcn.00430523
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43ae92
cmp edi, ebx
je 0x43ae92
call esi
cmp eax, ebx
je 0x43ae5f
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43ae5f
test byte [ebp - 0x18], 1
jne 0x43ae92
lea eax, [ebp - 0x10]
push eax
call fcn.0042aa39
test eax, eax
pop ecx
je 0x43ae7a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00430e49
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43ae89
or dword [ebp + 0x10], 0x200000
jmp 0x43aecd
or dword [ebp + 0x10], 0x40000
jmp 0x43aecd
mov eax, dword [0x44de18]
cmp eax, dword [ebp - 8]
je 0x43aecd
push eax
call fcn.00430523
cmp eax, ebx
pop ecx
je 0x43aecd
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43aecd
mov eax, dword [0x44de1c]
cmp eax, dword [ebp - 8]
je 0x43aecd
push eax
call fcn.00430523
cmp eax, ebx
pop ecx
je 0x43aecd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44de14]
call fcn.00430523
cmp eax, ebx
pop ecx
je 0x43aeed
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43aeef
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x21a025b7
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3d367cc2
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10004452
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x1000449f
cmp byte [esi + 0x3d], bl
je 0x1000449f
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100044ce
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x100044a6
sub eax, 1
je 0x100044a9
dec eax
sub eax, 1
jne 0x100044ce
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100044c6
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100665cc
add esp, 0x10
cmp edi, eax
jne 0x100044ce
cmp byte [esi + 0x3d], bl
sete al
jmp 0x100044a1
xor al, al
jmp 0x100044a1

Function at 0x1000748c
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x100074a6
xor eax, eax
jmp 0x10007576
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x100074d4
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x100074d4
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x10007575
cmp dword [esi + 0x4c], 0
je 0x10007573
mov ecx, esi
call fcn.100049c9
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x10007500
push dword [esi + 0x4c]
push eax
call fcn.10001d58
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x10007573
mov byte [esp + 0x10], al
lea eax, [esp + 0x3c]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x10007544
sub eax, 1
je 0x10007544
dec eax
sub eax, 1
jne 0x10007573
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x100074f2
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x18]
sub ebp, eax
je 0x10007563
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.100665cc
add esp, 0x10
cmp ebp, eax
jne 0x10007573
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x10007575
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x10009015
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x14]
test esi, esi
jg 0x10009035
jl 0x1000902c
test edi, edi
jne 0x10009035
xor eax, eax
xor edx, edx
jmp 0x100090fc
cmp dword [ebp + 0x38], 0
je 0x1000904b
push esi
push edi
push dword [esp + 0x18]
call fcn.10009106
jmp 0x100090fc
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1000908f
mov eax, dword [ebp + 0x2c]
cmp dword [eax], 0
jbe 0x1000908f
cmp dword [eax], edi
mov esi, edi
mov ebx, dword [esp + 0x14]
cmovb esi, dword [eax]
push esi
push ecx
push ebx
call fcn.100612d0
mov eax, dword [ebp + 0x2c]
add ebx, esi
mov dword [esp + 0x20], ebx
add esp, 0xc
mov ebx, edi
sub ebx, esi
sub dword [eax], esi
mov eax, dword [ebp + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x10009097
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [ebp + 0x4c], 0
mov ecx, ebx
je 0x100090f2
mov ecx, ebp
call fcn.100049c9
mov edx, dword [esp + 0x14]
mov ecx, ebx
jmp 0x100090d2
push dword [ebp + 0x4c]
push eax
push 1
push edx
call fcn.10065f45
mov edx, dword [esp + 0x24]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [esp + 0x14], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x10009102
mov eax, 0xfff
cmp ebx, eax
ja 0x100090ae
test ecx, ecx
je 0x100090f2
push dword [ebp + 0x4c]
push ebx
push 1
push edx
call fcn.10065f45
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
sub edi, ebx
jmp 0x100090f4

Function at 0x100091da
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100091fb
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.100092b0
jmp 0x100092aa
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x1000921e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10009220
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x1000929b
jg 0x10009233
test esi, esi
je 0x1000929b
test eax, eax
jl 0x1000927d
jg 0x1000923d
test ebp, ebp
je 0x1000927d
cmp edi, eax
jg 0x1000924d
jl 0x10009247
cmp esi, ebp
jae 0x1000924d
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call fcn.100612d0
mov eax, dword [ebx + 0x30]
add esp, 0xc
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
mov eax, dword [esp + 0x1c]
add eax, ebp
test edi, edi
jl 0x1000929b
jg 0x10009281
test esi, esi
je 0x1000929b
jmp 0x10009281
mov eax, dword [esp + 0x1c]
cmp dword [ebx + 0x4c], 0
je 0x1000929b
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.100665cc
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc
Function at 0x10011c96
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x10085bfa
call fcn.1005f0c0
sub esp, 0x38
push ebx
push esi
push edi
mov eax, 0x40e4e0
mov esi, ecx
call eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
movzx eax, ax
xor ebx, ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.1001138c
pop ecx
mov dword [ebp - 0x24], eax
mov eax, ebx
mov dword [ebp - 4], ebx
mov edi, 0xb7d0b8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
mov ebx, dword [edi]
test ebx, ebx
je 0x10011d96
mov edi, dword [ebp - 0x10]
mov esi, dword [ebx]
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
cmp dword [eax + 0x20], 0x534030
je 0x10011d42
mov eax, edi
mov dword [ebp - 0x1c], 0x78
cdq
sub eax, edx
sar eax, 1
cdq
idiv dword [ebp - 0x1c]
push eax
movzx eax, word [esi + 0x22]
push edx
push eax
push esi
lea eax, [ebp - 0x44]
push str.Entity_0x_08x__with_model__d__at_ARRAY_StreamSectors__d__d__is_invalid_n
push eax
call fcn.10011592
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x10011d31
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x44]
call fcn.10004abb
jmp 0x10011d83
mov ecx, dword [0x1012aa08]
movzx eax, word [esi + 0x22]
push eax
mov edx, dword [ecx]
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, word [ebp - 0x18]
jne 0x10011d83
test dword [esi + 0x1c], 0x2400
jne 0x10011d83
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [esi + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100113a3
mov eax, dword [ebx + 4]
mov ebx, eax
test eax, eax
jne 0x10011cee
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add edi, 4
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp edi, 0xb992b8
jl 0x10011ce1
mov edi, 0xb992c0
mov dword [ebp - 0x14], edi
mov esi, dword [edi]
test esi, esi
je 0x10011e0c
mov edi, dword [ebp - 0x18]
mov ebx, dword [esi]
mov ecx, dword [0x1012aa08]
mov dword [ebp - 0x1c], ebx
movzx eax, word [ebx + 0x22]
mov edx, dword [ecx]
push eax
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, di
jne 0x10011e02
test dword [ebx + 0x1c], 0x2400
jne 0x10011e02
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [ebx + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100113a3
mov esi, dword [esi + 4]
test esi, esi
jne 0x10011dbd
mov edi, dword [ebp - 0x14]
add edi, 0xc
mov dword [ebp - 0x14], edi
cmp edi, 0xb99ec0
jl 0x10011db4
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, eax
je 0x10011e51
movzx eax, word [esi + 0xe]
push eax
mov eax, 0x4089a0
call eax
movzx eax, word [esi + 0xe]
imul eax, eax, 0x14
pop ecx
lea ecx, [ebp - 0x18]
mov byte [eax + 0x8e4cd0], 0
call fcn.1000f9db
mov esi, dword [ebp - 0x18]
cmp esi, dword [ebp - 0x24]
jne 0x10011e26
lea eax, [ebp - 0x24]
push eax
mov ecx, eax
call fcn.10011435
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x10019ce1
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10085892
call fcn.1005f0c0
sub esp, 0x20
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x10019e17
push 0x1008d084
push dword [ebp + 8]
call fcn.1006ee06
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10019e17
push 0xc
call fcn.1005f07a
pop ecx
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
test eax, eax
je 0x10019d32
mov ecx, eax
call fcn.1000ce3e
mov esi, eax
jmp 0x10019d34
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x2c]
push 8
pop ecx
push ebx
xor eax, eax
push 1
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push 0x20
push eax
call fcn.10065f45
add esp, 0x10
cmp byte [ebp - 0x2c], 0x43
jne 0x10019dfb
cmp byte [ebp - 0x2b], 0x4f
jne 0x10019dfb
cmp byte [ebp - 0x2a], 0x4c
jne 0x10019dfb
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
call fcn.1005f06c
mov ecx, dword [ebp - 0x28]
mov edi, eax
push ebx
push 1
add ecx, 0xffffffe8
push ecx
push edi
call fcn.10065f45
mov al, byte [ebp - 0x29]
add esp, 0x14
cmp al, 0x4c
jne 0x10019dae
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
push edi
call dword [0x100b8178]
add esp, 0xc
jmp 0x10019de9
cmp al, 0x32
jne 0x10019dcb
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
push edi
call dword [0x100b817c]
jmp 0x10019de6
cmp al, 0x33
jne 0x10019de9
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
push edi
call dword [0x100b8180]
add esp, 0x10
push edi
call fcn.1005f0b8
push ebx
call fcn.10065561
pop ecx
pop ecx
mov eax, esi
jmp 0x10019e19
test esi, esi
je 0x10019e10
mov ecx, esi
call fcn.1000ce70
push 0xc
push esi
call fcn.1005f0aa
pop ecx
pop ecx
push ebx
call fcn.10065561
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4