joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029420
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [0x1010a000]
mov dword [ebp - 4], ecx
push edi
mov dword [ebp - 0x20], 0
mov ecx, dword [esi + 0x2c5c]
mov ebx, dword [esi + 0x2c60]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 8], 0
cmp ecx, ebx
jne 0x1002950c
lea edi, [ecx + 1]
test ebx, ebx
je 0x10029486
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, ebx
jmp 0x1002948b
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ebx
jle 0x1002950c
inc dword [esi + 0x36c]
lea eax, [edi*8]
sub eax, edi
shl eax, 2
push eax
call fcn.100bcd1d
mov ebx, eax
add esp, 4
mov eax, dword [esi + 0x2c64]
test eax, eax
je 0x100294fa
mov ecx, dword [esi + 0x2c5c]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 2
push edx
push eax
push ebx
call fcn.100adbd0
mov ecx, dword [esi + 0x2c64]
add esp, 0xc
test ecx, ecx
je 0x100294f1
mov eax, dword [0x1010a000]
test eax, eax
je 0x100294f1
dec dword [eax + 0x36c]
push ecx
call fcn.100bae00
add esp, 4
mov ecx, dword [esi + 0x2c5c]
mov dword [esi + 0x2c64], ebx
mov dword [esi + 0x2c60], edi
movups xmm0, xmmword [ebp - 0x20]
mov eax, dword [ebp - 8]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [esi + 0x2c64]
movups xmmword [ecx + edx*4], xmm0
movq xmm0, qword [ebp - 0x10]
movq qword [ecx + edx*4 + 0x10], xmm0
mov dword [ecx + edx*4 + 0x18], eax
inc dword [esi + 0x2c5c]
mov eax, dword [esi + 0x2c5c]
test eax, eax
jg 0x10029562
push 0x4ba
push str.C:UsersPCDesktopAurora_UEFunctionsimguiimgui.h
push str.Size___0
call fcn.100b97ae
mov eax, dword [esi + 0x2c5c]
add esp, 0xc
mov ebx, dword [ebp - 4]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x2c64]
mov esi, ebx
lea edi, [eax + ecx*4]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10029580
mov eax, dword [0x1010a000]
sub esi, ecx
test eax, eax
je 0x10029598
inc dword [eax + 0x36c]
inc esi
push esi
call fcn.100bcd1d
push esi
push ebx
push eax
call fcn.100adbd0
mov dword [edi - 0x1c], eax
lea esi, [ebx + 1]
mov al, byte [ebx]
add esp, 0x10
or edx, 0xffffffff
test al, al
je 0x100295e7
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x100295ce
cmp byte [esi], al
jne 0x100295ce
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100f3f10]
test al, al
jne 0x100295c0
not edx
lea eax, [edi - 0x1c]
mov dword [edi - 0x18], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x1010a000]
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [edi + 0x2c40], 0
test eax, eax
je 0x10029a56
push esi
lea esi, [edi + 0x2c44]
mov dword [edi + 0x2c40], 0
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x10029994
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.1002a7e0
xor ecx, ecx
mov dword [esi], 0
cmp dword [esi + 4], ecx
jne 0x100299ac
push 8
mov ecx, esi
call fcn.1002a7e0
mov ecx, dword [esi]
mov eax, dword [esi + 8]
push ebx
xor ebx, ebx
mov byte [ecx + eax], 0
inc dword [esi]
mov eax, dword [edi + 0x2c50]
mov ecx, dword [esi]
test eax, eax
jle 0x10029a10
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x100299e7
push 0x4b0
push str.C:UsersPCDesktopAurora_UEFunctionsimguiimgui.h
push str.i___Size
call fcn.100b97ae
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [edi + 0x2c58]
add eax, ecx
push esi
push eax
push edi
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 4]
inc ebx
mov eax, dword [edi + 0x2c50]
add ecx, 0x18
add esp, 0xc
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x100299e7
mov ecx, dword [esi]
lea eax, [ecx - 1]
mov edx, 0x100fb290
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [edi + 0x2c4c]
test eax, eax
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 8]
mov edi, 0x10109ffc
cmovne edi, eax
call fcn.10018a80
mov esi, eax
pop ebx
test esi, esi
je 0x10029a55
push esi
push dword [ebp - 4]
push 1
push edi
call fcn.100bad9d
push esi
call fcn.100b0e07
add esp, 0x14
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10045740
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x1038
call fcn.100ac440
mov eax, dword [0x1010607c]
xor eax, esp
mov dword [esp + 0x1034], eax
push esi
push edi
push 0
mov edi, ecx
mov dword [esp + 0x14], 0x7a833c15
mov dword [esp + 0x10], edi
lea eax, [esp + 0x24]
mov dword [esp + 0x10], edi
push 0
mov dword [esp + 0x28], 0x8a36c5c
mov dword [esp + 0x2c], 0xb0143e94
mov dword [esp + 0x30], 0xebc282a7
mov dword [esp + 0x34], 0x36647fa8
movaps xmm1, xmmword [esp + 0x28]
push 0
mov dword [esp + 0x20], 0xd9664af1
mov dword [esp + 0x24], 0x99a7f4c2
mov dword [esp + 0x28], 0x36647fa8
pxor xmm1, xmmword [esp + 0x1c]
push 0
push eax
movaps xmmword [esp + 0x34], xmm1
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push closesocket
push 0
push 0
mov esi, eax
push str.http:__myexternalip.com_raw
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea ecx, [esp + 0xc]
push ecx
push 0x1000
lea ecx, [esp + 0x40]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [esp + 0xc]
lea eax, [esp + 0x3c]
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov ecx, edi
mov dword [edi + 0x14], 0xf
push eax
mov byte [edi], 0
call fcn.10005d90
mov ecx, dword [esp + 0x103c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100ab558
mov esp, ebp
pop ebp
ret

Function at 0x100458e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x28b8
call fcn.100ac440
mov eax, dword [0x1010607c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100
mov dword [ebp - 0x28b8], ecx
mov dword [ebp - 0x28a8], 0x2880
call fcn.100abe70
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28a8]
push eax
lea eax, [ebp - 0x2884]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
movzx eax, byte [ebp - 0x26ee]
xor ecx, ecx
movaps xmm0, xmmword [0x100fe2b0]
movzx edx, byte [ebp - 0x26eb]
movzx edi, byte [ebp - 0x26ec]
movzx ebx, byte [ebp - 0x26ed]
mov dword [ebp - 0x28ac], eax
movzx eax, byte [ebp - 0x26ef]
mov dword [ebp - 0x28b0], eax
movzx eax, byte [ebp - 0x26f0]
mov dword [ebp - 0x28b4], eax
movups xmmword [ebp - 0x28a4], xmm0
mov dword [ebp - 0x2894], 0x39535144
mov dword [ebp - 0x2890], 0x5351445b
mov dword [ebp - 0x288c], 0x51445b39
mov word [ebp - 0x2888], 0x3953
mov byte [ebp - 0x2886], 0
nop word [eax + eax]
mov al, byte [ebp - 0x28a4]
xor byte [ebp + ecx - 0x28a3], al
inc ecx
cmp ecx, 0x1d
jb 0x100459b0
push edx
push edi
push ebx
push dword [ebp - 0x28ac]
lea eax, [ebp - 0x28a3]
mov byte [ebp - 0x2886], 0
push dword [ebp - 0x28b0]
push dword [ebp - 0x28b4]
push eax
push esi
call fcn.100060c0
mov eax, esi
add esp, 0x20
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100459f4
mov ecx, dword [ebp - 0x28b8]
sub eax, edi
push eax
push esi
call fcn.10005d90
push esi
call fcn.100abe79
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100ab558
mov esp, ebp
pop ebp
ret
Function at 0x1004c430
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d89f0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1010607c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100ab566
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1005f8f3
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10051780
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1010607c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor edx, edx
mov dword [ebp - 0x214], 0
push esi
push edi
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x218], edx
pushal
mov eax, dword fs:[0x30]
mov dword [ebp - 0x214], eax
popal
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax + 0xc]
xor eax, eax
mov dword [ebp - 0x21c], ecx
mov ebx, dword [ebp - 0x21c]
nop dword [eax]
sub eax, 0
je 0x1005181f
sub eax, 1
je 0x10051807
sub eax, 1
jne 0x10051834
lea ebx, [ecx + 0x1c]
mov ecx, 0x10
mov eax, ebx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x20c], eax
jmp 0x10051840
lea ebx, [ecx + 0x14]
mov ecx, 8
mov eax, ebx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x20c], eax
jmp 0x10051840
lea ebx, [ecx + 0xc]
xor ecx, ecx
mov eax, ebx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x20c], eax
jmp 0x10051840
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x208]
mov edi, dword [ebx]
cmp edi, eax
je 0x100518e4
nop word [eax + eax]
mov esi, edi
xor eax, eax
sub esi, ecx
mov ebx, edi
movzx ecx, word [esi + 0x24]
test ecx, 0xfffffffe
jbe 0x1005188e
cmp eax, 0x200
jge 0x10051888
mov ecx, dword [esi + 0x28]
mov cl, byte [ecx + eax*2]
mov byte [ebp + eax - 0x204], cl
inc eax
movzx ecx, word [esi + 0x24]
shr ecx, 1
cmp eax, ecx
jl 0x10051864
cmp eax, 0x200
jae 0x1005192d
mov byte [ebp + eax - 0x204], 0
lea eax, [ebp - 0x204]
push str.aurora.dll
push eax
call fcn.100ad6a0
add esp, 8
test eax, eax
je 0x100518ce
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x210]
test eax, eax
cmovne esi, eax
mov dword [ebp - 0x210], esi
mov eax, dword [edi]
mov edi, eax
mov ecx, dword [ebp - 0x208]
cmp eax, dword [ebp - 0x20c]
jne 0x10051850
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp eax, 3
jge 0x10051901
mov ecx, dword [ebp - 0x21c]
jmp 0x100517e0
mov edx, dword [ebp - 0x210]
test edx, edx
je 0x1005191c
mov ecx, dword [edx + 0x40]
mov eax, dword [edx + 0x3c]
mov dword [ecx], eax
mov ecx, dword [edx + 0x3c]
mov eax, dword [edx + 0x40]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ab558
mov esp, ebp
pop ebp
ret
call fcn.100abc0c
int3
Function at 0x10053330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov ecx, 0xa0fd04
call fcn.1005f250
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.100108c0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1005338e
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movd xmm0, esi
cvtdq2ps xmm0, xmm0
pop esi
cvtps2pd xmm0, xmm0
divsd xmm0, qword [0x100fda68]
cvtpd2ps xmm0, xmm0
mov esp, ebp
pop ebp
ret

Function at 0x100533b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov ecx, 0xa0fd08
call fcn.1005f250
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.100108c0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1005340e
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movd xmm0, esi
cvtdq2ps xmm0, xmm0
pop esi
cvtps2pd xmm0, xmm0
divsd xmm0, qword [0x100fda90]
cvtpd2ps xmm0, xmm0
mov esp, ebp
pop ebp
ret

Function at 0x10053580
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push str.vcmp_game.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [eax + 0x3684b0]
call fcn.1005f250
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.100108c0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x100535ea
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100587e0
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov eax, 0x4bc120
call eax
movzx eax, byte [eax + 0x60c]
mov dword [0x1010a138], eax
test eax, eax
je 0x100588f1
cmp eax, 1
je 0x100588f1
cmp eax, 2
jne 0x1005881e
movss xmm1, dword [0x10106b64]
movss xmm0, dword [0x10106b38]
jmp 0x10058901
cmp eax, 3
jne 0x10058838
movss xmm1, dword [0x10106b68]
movss xmm0, dword [0x10106b3c]
jmp 0x10058901
cmp eax, 4
jne 0x10058852
movss xmm1, dword [0x10106b6c]
movss xmm0, dword [0x10106b40]
jmp 0x10058901
cmp eax, 5
jne 0x1005886c
movss xmm1, dword [0x10106b70]
movss xmm0, dword [0x10106b44]
jmp 0x10058901
cmp eax, 6
jne 0x10058883
movss xmm1, dword [0x10106b74]
movss xmm0, dword [0x10106b48]
jmp 0x10058901
cmp eax, 7
jne 0x1005889a
movss xmm1, dword [0x10106b78]
movss xmm0, dword [0x10106b4c]
jmp 0x10058901
cmp eax, 8
jne 0x100588b1
movss xmm1, dword [0x10106b7c]
movss xmm0, dword [0x10106b50]
jmp 0x10058901
cmp eax, 9
jne 0x100588c8
movss xmm1, dword [0x10106b80]
movss xmm0, dword [0x10106b54]
jmp 0x10058901
cmp eax, 0xa
jne 0x100588df
movss xmm1, dword [0x10106b84]
movss xmm0, dword [0x10106b58]
jmp 0x10058901
movss xmm1, dword [0x1010a118]
movss xmm0, dword [0x1010a128]
jmp 0x10058911
movss xmm1, dword [0x10106b60]
movss xmm0, dword [0x10106b34]
movss dword [0x1010a128], xmm0
movss dword [0x1010a118], xmm1
xorps xmm2, xmm2
ucomiss xmm1, xmm2
lahf
test ah, 0x44
jnp 0x10058952
ucomiss xmm0, xmm2
lahf
test ah, 0x44
jnp 0x10058952
divss xmm1, dword [0x100fdb80]
mov ecx, 0x94dbd0
call fcn.1005ee50
movss xmm1, dword [0x1010a128]
mov ecx, 0xa0d964
divss xmm1, dword [0x100fdb80]
jmp fcn.1005ee50
ret
Function at 0x1005a620
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d973d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1010607c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.10053870
mov edx, dword [ebp + 0x1c]
lea eax, [ebp + 8]
mov edi, dword [ebp + 8]
lea ebx, [ebp + 8]
cmp edx, 0x10
lea esi, [ebp + 8]
cmovae eax, edi
cmovae ebx, edi
add eax, dword [ebp + 0x18]
cmp edx, 0x10
cmovae esi, edi
cmp esi, eax
je 0x1005a69d
sub ebx, esi
mov edi, eax
movsx eax, byte [esi]
push eax
call fcn.100b121d
mov byte [ebx + esi], al
add esp, 4
inc esi
cmp esi, edi
jne 0x1005a683
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
lea esi, [ebp + 8]
cmp edx, 0x10
mov ecx, 0x811c9dc5
cmovae esi, edi
xor edx, edx
test ebx, ebx
je 0x1005a6c5
movzx eax, byte [edx + esi]
inc edx
xor eax, ecx
imul ecx, eax, 0x1000193
cmp edx, ebx
jb 0x1005a6b4
push ecx
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1005e4c0
mov ecx, dword [ebp + 0x1c]
cmp dword [eax + 4], 0
setne bl
cmp ecx, 0x10
jb 0x1005a70a
inc ecx
mov eax, edi
cmp ecx, 0x1000
jb 0x1005a700
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005a720
push ecx
push edi
call fcn.100ab8b0
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
call fcn.100b08d2
int3
Function at 0x1005ae80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x1005af68
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x1005af57
jg 0x1005aec0
test edx, edx
je 0x1005af57
nop dword [eax]
call fcn.1004b4c0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1005af14
jg 0x1005aed7
test esi, esi
je 0x1005af14
cmp ebx, eax
jg 0x1005aee7
jl 0x1005aee1
cmp edi, esi
jae 0x1005aee7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.100adbd0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x1005af3b
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x1005af51
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x1005aec0
jl 0x1005af51
test edi, edi
jne 0x1005aec0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1005af8a
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x1005af8c
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x1005b00a
jg 0x1005af9f
test esi, esi
je 0x1005b00a
test eax, eax
jl 0x1005afee
jg 0x1005afa9
test ebx, ebx
je 0x1005afee
cmp edi, eax
jg 0x1005afb9
jl 0x1005afb3
cmp esi, ebx
jae 0x1005afb9
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.100adbd0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x1005b00a
jg 0x1005aff1
test esi, esi
je 0x1005b00a
jmp 0x1005aff1
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x1005b00a
push eax
push esi
push 1
push edx
call fcn.100bad9d
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1005b640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1010607c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1005b670
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab558
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1005b6ac
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1005b6ac
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab558
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x1005b796
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1005b6d4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1005b707
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.100bd33c
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab558
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x1005b769
sub eax, 1
je 0x1005b769
sub eax, 2
jne 0x1005b796
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.100bd33c
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab558
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1005b786
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100bad9d
add esp, 0x10
cmp edi, eax
jne 0x1005b796
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x1005b697
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ab558
mov esp, ebp
pop ebp
ret 4
Function at 0x1005bdd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1010607c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1005be8c
cmp byte [esi + 0x3d], 0
je 0x1005be8c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1005be7a
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x1005be42
sub eax, 1
je 0x1005be46
sub eax, 2
jne 0x1005be7a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab558
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1005be63
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100bad9d
add esp, 0x10
cmp edi, eax
jne 0x1005be7a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab558
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab558
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100ab558
mov esp, ebp
pop ebp
ret