joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415f7a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax - 0x3a]
test dword [edx + 0x51fffffc], esi
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0041569d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00415652
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
add al, 0
add byte [eax], al
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
invalid
test dword [ebp - 4], ecx
Function at 0x41656a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add al, 0
add byte [eax], al
cmp dword [ebp - 0x398], 0
je 0x41654b
cmp dword [ebp + 0xc], 1
je 0x41654b
cmp dword [ebp + 0xc], 8
jne 0x416513
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0041569d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00415652
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
stc
invalid
call dword [ebp - 0x3a]
test dword [ebx - 7], esp
invalid
dec dword [ebx - 0x69b7a3a]
invalid
invalid
in al, dx
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
push eax
push dword [ebp - 0x33c]
push 0xffffffffffffffff
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.0041568d
xor eax, 0xff5b9663
mov ch, 0x68
stc
invalid
add edi, edi
mov ch, 0x8c
stc
invalid
call fcn.0041568d
test byte [ebp + 0x37], bl
add dword [eax - 0x5435b], eax
inc dword [eax]
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.0041568d
push ecx
js 0x4164f1
stosd dword es:[edi], eax
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0041566b
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
invalid
invalid

Function at 0x430cc0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043049a
Function at 0x430ccb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004306d5

Function at 0x4319d0
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00431757

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000150f
Capabilities:
Parse pe header

Disassembly:
jmp 0x10042a40
mov edx, dword [esp + 4]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x10042a99
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x10042a99
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
test byte [eax + 0x24], 0x20
jne 0x10042a79
nop word [eax + eax]
add eax, 0x28
test byte [eax + 0x24], 0x20
je 0x10042a70
mov ecx, dword [esp + 8]
add edx, dword [eax + 0xc]
mov dword [ecx], edx
mov ecx, dword [eax + 8]
mov eax, dword [esp + 0xc]
and ecx, 0xfffff000
add ecx, 0x1000
add ecx, edx
mov dword [eax], ecx
xor eax, eax
ret

Function at 0x10001726
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x10016cb0
sub esp, 0x24
mov eax, dword [0x100dbeb4]
xor eax, esp
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0xc]
push ebx
push ebp
push esi
movsx eax, byte [ecx + 1]
movsx bp, byte [ecx]
mov word [esp + 0x1a], ax
movsx eax, byte [ecx + 2]
mov word [esp + 0x1c], ax
movsx eax, byte [ecx + 3]
mov word [esp + 0x1e], ax
movsx eax, byte [ecx + 4]
mov word [esp + 0x20], ax
movsx eax, byte [ecx + 5]
mov word [esp + 0x22], ax
movsx eax, byte [ecx + 6]
mov word [esp + 0x24], ax
movsx eax, byte [ecx + 7]
mov word [esp + 0x26], ax
movsx eax, byte [ecx + 8]
lea ecx, [edx + 2]
push edi
mov word [esp + 0x1c], bp
mov word [esp + 0x2c], ax
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10016d20
mov eax, dword [esp + 0x3c]
sub edx, ecx
sar edx, 1
mov dword [esp + 0x18], edx
cmp edx, eax
ja 0x10016e02
mov ecx, dword [esp + 0x38]
test edx, edx
jne 0x10016d5f
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
lea eax, [ecx + eax*2]
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10002d8d
add esp, 0x24
ret
sub eax, edx
inc eax
lea ebx, [ecx + eax*2]
mov eax, ecx
mov dword [esp + 0x10], ebx
nop dword [eax + eax]
mov ecx, ebx
mov esi, 0
sub ecx, eax
sar ecx, 1
je 0x10016d92
cmp word [eax], bp
je 0x10016d90
cmp ecx, 1
je 0x10016d92
add eax, 2
dec ecx
cmp word [eax], bp
jne 0x10016d82
mov esi, eax
mov eax, esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10016e02
mov edi, edx
movzx esi, bp
movzx edx, word [eax]
lea ecx, [esp + 0x1c]
cmp dx, si
jb 0x10016dd6
mov ebx, eax
mov eax, ecx
sub ebx, eax
mov eax, dword [esp + 0x14]
cmp dx, si
ja 0x10016dd2
cmp edi, 1
je 0x10016ddf
movzx edx, word [ebx + ecx + 2]
add ecx, 2
dec edi
movzx esi, word [ecx]
cmp dx, si
jae 0x10016dba
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
add eax, 2
jmp 0x10016d70
mov ecx, dword [esp + 0x38]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x10016e02
pop edi
pop esi
pop ebp
lea eax, [ecx + eax*2]
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10002d8d
add esp, 0x24
ret
mov ecx, dword [esp + 0x30]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10002d8d
add esp, 0x24
ret
Function at 0x10001aff
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x10042930
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10e9c834]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10e9c424]
cmp eax, dword [ecx + 0xeb68]
jg 0x10042978
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, 0x10e9be80
nop
push edi
push dword [esi]
call ebx
test eax, eax
jne 0x10042974
add esi, 4
cmp esi, 0x10e9c330
jne 0x10042960
pop edi
pop esi
pop ebx
ret
push 0x10e9c424
call fcn.100055a6
add esp, 4
cmp dword [0x10e9c424], 0xffffffff
jne 0x1004294c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x100dd4f8
push 0x4b0
push 0x10e9be80
push eax
call sub.KERNEL32.dll_K32EnumProcessModules
push 0x10e9c424
mov dword [0x10e9c420], eax
call fcn.10005632
add esp, 4
jmp 0x1004294c

Function at 0x10002149
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x10017040
sub esp, 0x38
mov eax, dword [0x100dbeb4]
xor eax, esp
mov dword [esp + 0x34], eax
mov edx, dword [esp + 0x44]
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
movq xmm0, qword [ecx + edx]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movups xmmword [esp + ecx*2 + 0xc], xmm0
add ecx, 8
cmp ecx, 0x10
jl 0x10017060
cmp ecx, 0x14
jge 0x10017090
movsx ax, byte [ecx + edx]
mov word [esp + ecx*2 + 0xc], ax
inc ecx
cmp ecx, 0x14
jl 0x10017080
push ebx
push ebp
push esi
lea ebx, [esp + 0x18]
push edi
lea ecx, [ebx + 2]
nop dword [eax + eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x100170a0
mov eax, dword [esp + 0x50]
sub ebx, ecx
sar ebx, 1
mov dword [esp + 0x14], ebx
cmp ebx, eax
ja 0x10017181
mov ecx, dword [esp + 0x4c]
test ebx, ebx
jne 0x100170df
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
lea eax, [ecx + eax*2]
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10002d8d
add esp, 0x38
ret
mov bp, word [esp + 0x1c]
sub eax, ebx
inc eax
lea edx, [ecx + eax*2]
mov eax, ecx
mov dword [esp + 0x18], edx
mov ecx, edx
mov edx, 0
sub ecx, eax
sar ecx, 1
je 0x10017112
cmp word [eax], bp
je 0x10017110
cmp ecx, 1
je 0x10017112
add eax, 2
dec ecx
cmp word [eax], bp
jne 0x10017102
mov edx, eax
mov eax, edx
test eax, eax
je 0x10017181
movzx edx, word [eax]
lea ecx, [esp + 0x1c]
movzx esi, bp
mov edi, ebx
cmp dx, si
jb 0x10017155
mov ebx, ecx
mov dword [esp + 0x10], eax
sub dword [esp + 0x10], ebx
cmp dx, si
mov ebx, dword [esp + 0x14]
ja 0x10017155
cmp edi, 1
je 0x1001715e
mov edx, dword [esp + 0x10]
add ecx, 2
dec edi
movzx edx, word [edx + ecx]
movzx esi, word [ecx]
cmp dx, si
jae 0x1001713a
mov edx, dword [esp + 0x18]
add eax, 2
jmp 0x100170f0
mov ecx, dword [esp + 0x4c]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x10017181
pop edi
pop esi
pop ebp
lea eax, [ecx + eax*2]
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10002d8d
add esp, 0x38
ret
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10002d8d
add esp, 0x38
ret
Function at 0x100026e4
Capabilities:
Parse pe header

Disassembly:
jmp 0x100429e0
mov edx, dword [esp + 4]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x10042a1f
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x10042a1f
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x10042a1f
mov edx, dword [esp + 8]
cmp dword [eax], edx
je 0x10042a21
add eax, 4
cmp eax, ecx
jb 0x10042a14
xor eax, eax
ret

Function at 0x1000292d
Capabilities:
Create thread

Disassembly:
jmp 0x10012e80
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x10012850
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0
mov dword [esi + 0x1f4], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x1f8], eax
mov al, 1
pop esi
ret

Function at 0x100031a2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x10016b20
sub esp, 0x18
mov eax, dword [0x100dbeb4]
xor eax, esp
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0xc]
push ebx
push ebp
push esi
movsx eax, byte [ecx + 1]
movsx bp, byte [ecx]
mov word [esp + 0x1a], ax
movsx eax, byte [ecx + 2]
lea ecx, [edx + 2]
push edi
mov word [esp + 0x1c], bp
mov word [esp + 0x20], ax
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10016b60
mov eax, dword [esp + 0x30]
sub edx, ecx
sar edx, 1
mov dword [esp + 0x18], edx
cmp edx, eax
ja 0x10016c42
mov ecx, dword [esp + 0x2c]
test edx, edx
jne 0x10016b9f
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
lea eax, [ecx + eax*2]
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10002d8d
add esp, 0x18
ret
sub eax, edx
inc eax
lea ebx, [ecx + eax*2]
mov eax, ecx
mov dword [esp + 0x10], ebx
nop dword [eax + eax]
mov ecx, ebx
mov esi, 0
sub ecx, eax
sar ecx, 1
je 0x10016bd2
cmp word [eax], bp
je 0x10016bd0
cmp ecx, 1
je 0x10016bd2
add eax, 2
dec ecx
cmp word [eax], bp
jne 0x10016bc2
mov esi, eax
mov eax, esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10016c42
mov edi, edx
movzx esi, bp
movzx edx, word [eax]
lea ecx, [esp + 0x1c]
cmp dx, si
jb 0x10016c16
mov ebx, eax
mov eax, ecx
sub ebx, eax
mov eax, dword [esp + 0x14]
cmp dx, si
ja 0x10016c12
cmp edi, 1
je 0x10016c1f
movzx edx, word [ebx + ecx + 2]
add ecx, 2
dec edi
movzx esi, word [ecx]
cmp dx, si
jae 0x10016bfa
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
add eax, 2
jmp 0x10016bb0
mov ecx, dword [esp + 0x2c]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x10016c42
pop edi
pop esi
pop ebp
lea eax, [ecx + eax*2]
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10002d8d
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10002d8d
add esp, 0x18
ret

Function at 0x10003323
Capabilities:
Terminate process

Disassembly:
jmp 0x10059a30
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x10059a41
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.100052ef
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x10003422
Capabilities:
Query environment variable

Disassembly:
jmp 0x1009f31e
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1009f32f
pop esi
ret
push ebx
push edi
push esi
call fcn.1009f205
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.10003c15
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1009f357
push ebx
push esi
push edi
call fcn.10005119
add esp, 0xc
push 0
call fcn.10005b28
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10003431
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x10016e70
sub esp, 0x24
mov eax, dword [0x100dbeb4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x1c]
movsx eax, byte [ecx + 1]
movsx bp, byte [ecx]
mov word [esp + 0x1e], ax
movsx eax, byte [ecx + 2]
mov word [esp + 0x20], ax
movsx eax, byte [ecx + 3]
mov word [esp + 0x22], ax
movsx eax, byte [ecx + 4]
mov word [esp + 0x24], ax
movsx eax, byte [ecx + 5]
mov word [esp + 0x26], ax
movsx eax, byte [ecx + 6]
mov word [esp + 0x28], ax
movsx eax, byte [ecx + 7]
mov word [esp + 0x2a], ax
movsx eax, byte [ecx + 8]
mov word [esp + 0x2c], ax
movsx eax, byte [ecx + 9]
lea ecx, [edx + 2]
mov word [esp + 0x1c], bp
mov word [esp + 0x2e], ax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10016ee7
mov eax, dword [esp + 0x3c]
sub edx, ecx
sar edx, 1
mov dword [esp + 0x18], edx
cmp edx, eax
ja 0x10016fc4
mov ecx, dword [esp + 0x38]
test edx, edx
jne 0x10016f26
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
lea eax, [ecx + eax*2]
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10002d8d
add esp, 0x24
ret
sub eax, edx
inc eax
lea ebx, [ecx + eax*2]
mov eax, ecx
mov dword [esp + 0x10], ebx
mov ecx, ebx
mov esi, 0
sub ecx, eax
sar ecx, 1
je 0x10016f54
cmp word [eax], bp
je 0x10016f52
cmp ecx, 1
je 0x10016f54
add eax, 2
dec ecx
cmp word [eax], bp
jne 0x10016f44
mov esi, eax
mov eax, esi
mov dword [esp + 0x14], eax
test eax, eax
je 0x10016fc4
mov edi, edx
movzx esi, bp
movzx edx, word [eax]
lea ecx, [esp + 0x1c]
cmp dx, si
jb 0x10016f98
mov ebx, eax
mov eax, ecx
sub ebx, eax
mov eax, dword [esp + 0x14]
cmp dx, si
ja 0x10016f94
cmp edi, 1
je 0x10016fa1
movzx edx, word [ebx + ecx + 2]
add ecx, 2
dec edi
movzx esi, word [ecx]
cmp dx, si
jae 0x10016f7c
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
add eax, 2
jmp 0x10016f32
mov ecx, dword [esp + 0x38]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x10016fc4
pop edi
pop esi
pop ebp
lea eax, [ecx + eax*2]
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10002d8d
add esp, 0x24
ret
mov ecx, dword [esp + 0x30]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10002d8d
add esp, 0x24
ret

Function at 0x100038eb
Capabilities:
Check for software breakpoints

Disassembly:
jmp 0x10044d60
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0xcccc
push dword [esp + 0x18]
call fcn.10004854
add esp, 0x18
test eax, eax
je 0x10044d8b
inc eax
cmp byte [eax], 0xcc
je 0x10044d85
ret
Function at 0x100039ef
Capabilities:
Write file on windows

Disassembly:
jmp 0x10010a70
sub esp, 0x214
mov eax, dword [0x100dbeb4]
xor eax, esp
mov dword [esp + 0x210], eax
push 0x1f8
lea eax, [esp + 0x1c]
mov dword [esp + 4], 0
push 0
push eax
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
call fcn.10002e4b
push 0x1f3
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x30]
push 0x1f4
push eax
call fcn.10002761
mov edx, dword [esp + 0x30]
add esp, 0x1c
cmp edx, 0x10
jb 0x10010afa
mov ecx, dword [esp]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10010af0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010b5d
push edx
push ecx
call fcn.1000192e
add esp, 8
lea eax, [esp + 0x21c]
push eax
push 0
push dword [esp + 0x220]
lea eax, [esp + 0x28]
push 0x1f4
push eax
call fcn.10005218
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.100035e4
add esp, 0x1c
lea eax, [esp + 0x18]
push 0
push 0x100dd4f8
push 0x1f8
push eax
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.10002d8d
add esp, 0x214
ret
call fcn.1000433b
int3

Function at 0x10004089
Capabilities:
Write file on windows

Disassembly:
jmp 0x10011380
push esi
mov esi, dword [esp + 0x2c]
test esi, esi
js 0x10011391
cmp esi, 0xc330
jbe 0x100113a7
push dword [esp + 0x14]
push dword [esp + 0x14]
push esi
push str.Textractor:_something_went_very_wrong__invalid_length__d_at_hook_address__I64d_
call fcn.100039ef
add esp, 0x10
mov ecx, dword [esp + 0x28]
lea eax, [esi + 0x20]
movups xmm0, xmmword [esp + 8]
push 0
push 0x100dd4f8
movups xmmword [ecx], xmm0
push eax
movups xmm0, xmmword [esp + 0x24]
push ecx
movups xmmword [ecx + 0x10], xmm0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
ret
Function at 0x100043b8
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x10027d80
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10e9c834]
push esi
mov esi, dword [esp + 8]
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10e9b69c]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, dword [ecx + 0xeb68]
jg 0x10027e82
push str.mono_assembly_get_image
push esi
call edi
push str.mono_image_get_name
push esi
mov dword [0x10e9afd8], eax
call edi
push str.mono_class_from_name
push esi
mov dword [0x10e9afdc], eax
call edi
push str.mono_class_get_property_from_name
push esi
mov dword [0x10e9afe0], eax
call edi
push str.mono_property_get_set_method
push esi
mov dword [0x10e9afe4], eax
call edi
push str.mono_compile_method
push esi
mov dword [0x10e9afe8], eax
call edi
push str.mono_get_root_domain
push esi
mov dword [0x10e9afec], eax
call edi
push str.mono_thread_attach
push esi
mov dword [0x10e9aff0], eax
call edi
cmp dword [0x10e9b698], 0
pop edi
mov dword [0x10e9aff4], eax
pop esi
je 0x10027e7f
cmp dword [0x10e9afd8], 0
je 0x10027e7f
cmp dword [0x10e9afdc], 0
je 0x10027e7f
cmp dword [0x10e9afe0], 0
je 0x10027e7f
cmp dword [0x10e9afe4], 0
je 0x10027e7f
cmp dword [0x10e9afe8], 0
je 0x10027e7f
cmp dword [0x10e9afec], 0
je 0x10027e7f
cmp dword [0x10e9aff0], 0
je 0x10027e7f
test eax, eax
je 0x10027e7f
push str.Mono_X86:_If_the_following_hooks_dont_work__create_the_TextractorConfig.txt_file_via_the__Configure_game__button_to_activate_the_brute_force_mode
call fcn.100039ef
push 0
push 0x100030fd
call dword [0x10e9b698]
add esp, 0xc
mov al, 1
ret
xor al, al
ret
push 0x10e9b69c
call fcn.100055a6
add esp, 4
cmp dword [0x10e9b69c], 0xffffffff
jne 0x10027dac
push str.mono_assembly_foreach
push esi
call edi
push 0x10e9b69c
mov dword [0x10e9b698], eax
call fcn.10005632
add esp, 4
jmp 0x10027dac

Function at 0x10004a52
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1001a440
sub esp, 0x40
push ebx
push esi
lea eax, [esp + 0x24]
xor bl, bl
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor esi, esi
cmp dword [esp + 0x30], esi
jbe 0x1001a508
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
push 0x1c
lea eax, [esp + 0x10]
push eax
push esi
call edi
test eax, eax
jne 0x1001a47c
add esi, dword [esp + 0x2c]
jmp 0x1001a4fd
mov eax, dword [esp + 0x18]
cmp eax, 0x1f00000
jne 0x1001a4fb
cmp dword [esp + 0x20], 4
jne 0x1001a4fb
cmp dword [esp + 0x24], 0x40000
jne 0x1001a4fb
push str.Textractor:_PPSSPP_memory_found:_searching_for_hooks_should_yield_working_hook_codes
mov bl, 1
call fcn.100039ef
lea eax, [esi - 0x8000000]
mov dword [0x100db060], 6
mov dword [0x100db074], eax
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [0x100db040], 0x360ad83
mov word [0x100db044], 0
mov dword [0x100db064], 0
mov dword [0x100db078], 0
mov dword [0x100db07c], 0xffffffff
mov dword [0x100db29c], 0x10016210
add esi, eax
cmp esi, dword [esp + 0x34]
jb 0x1001a465
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x40
ret
Function at 0x10004fa2
Capabilities:
Parse pe header

Disassembly:
jmp 0x10042f30
sub esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, 0x5a4d
cmp cx, word [eax]
jne 0x10042fb6
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x10042fb6
mov ecx, dword [ecx + eax + 0x88]
test ecx, ecx
je 0x10042fb6
add eax, ecx
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 4]
mov dword [esp + 4], eax
push ecx
push eax
call fcn.10004930
add esp, 0xc
test eax, eax
je 0x10042fb6
mov edx, dword [esp + 0xc]
mov ecx, edx
push esi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10042f83
sub ecx, esi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
mov eax, dword [esp + 0xc]
push edx
add eax, 0xfffffffc
push eax
push dword [esp + 0x10]
call fcn.10003ba2
add esp, 0x10
pop esi
test eax, eax
je 0x10042fb6
mov al, 1
add esp, 8
ret
xor al, al
add esp, 8
ret

Function at 0x1000509c
Capabilities:
Write file on windows

Disassembly:
jmp 0x10010dd0
mov eax, dword [esp + 0xc]
sub esp, 0x10
test eax, eax
je 0x10010dea
push eax
push dword [0x100dba78]
call fcn.100039ef
add esp, 8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0
push 0x100dd4f8
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push 0x10
push eax
push dword [section..data]
mov dword [esp + 0x14], 3
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x10
ret