joyce8/EMBER2024-capa huggingface dataset:
Function at 0x218fb70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.021a3670
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.021a2ef0
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0x218fc55
mov ecx, esi
call fcn.021a2ef0
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.021a2ef0
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.021a2ef0
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.021a2ef0
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.0218d380
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.021a2ef0
lea ecx, [ebx + eax]
call fcn.0218d380
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.021a2ef0
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.0218d380
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.021a2d20
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.021a41c0

Function at 0x218fc70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ecx, esi
push edi
call fcn.021a3670
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], eax
call fcn.021a2ef0
add eax, ebx
push eax
call dword [0x100df290]
test eax, eax
jne 0x218fd55
mov ecx, esi
call fcn.021a2ef0
mov ecx, dword [esp + 0x2c]
mov esi, dword [eax + ebx + 8]
mov edi, dword [eax + ebx + 0xc]
call fcn.021a2ef0
mov ecx, dword [esp + 0x2c]
add eax, ebx
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebx
call fcn.021a2ef0
mov ebx, dword [esp + 0x2c]
sub esp, 0x10
mov edx, esp
mov ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, ebx
mov dword [edx], ebx
mov dword [edx + 0xc], eax
call fcn.021a2ef0
mov ebx, dword [esp + 0x20]
lea ecx, [ebx + eax]
call fcn.0218d420
mov ecx, dword [esp + 0x2c]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], esi
mov esi, ecx
mov dword [eax], ecx
mov dword [eax + 0xc], edi
call fcn.021a2ef0
lea ecx, [ebx + eax]
call fcn.0218d420
mov ebx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov ecx, esi
mov dword [eax], esi
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
call fcn.021a2ef0
add eax, dword [esp + 0x20]
mov ecx, eax
call fcn.0218d420
push dword [esp + 0x34]
mov ecx, esi
push dword [esp + 0x34]
call fcn.021a2d20
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
jmp fcn.021a41c0
Function at 0x218fd70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
mov ecx, ebx
push edi
call fcn.021a3670
mov ecx, ebx
call fcn.021a2ef0
mov edi, eax
add edi, dword [esp + 0x20]
push edi
call dword [0x100df290]
test eax, eax
jne 0x218fdff
mov ecx, ebx
call fcn.021a3670
cmp dword [edi + 0x28], 0xffffffff
jne 0x218fdab
cmp dword [edi + 0x2c], 0xffffffff
je 0x218fde9
push esi
mov esi, dword [edi + 0x28]
lea ecx, [esp + 0xc]
mov edi, dword [edi + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
call fcn.0218fb20
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
call fcn.0218fb20
pop esi
push dword [esp + 0x24]
mov ecx, ebx
push dword [esp + 0x24]
call fcn.021a2d20
mov ecx, ebx
call fcn.021a41c0
pop edi
mov ecx, ebx
pop ebx
add esp, 0x10
jmp fcn.021a41c0

Function at 0x218fe10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
mov ecx, esi
push edi
call fcn.021a3670
mov ecx, esi
call fcn.021a2ef0
mov edi, eax
add edi, dword [esp + 0x20]
push edi
call dword [0x100df290]
test eax, eax
jne 0x218fe92
mov ecx, esi
call fcn.021a3670
cmp dword [edi + 0x28], 0xffffffff
jne 0x218fe4b
cmp dword [edi + 0x2c], 0xffffffff
je 0x218fe7c
push dword [edi + 0x2c]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push dword [edi + 0x28]
mov dword [esp + 0x18], 0xffffffff
push esi
mov dword [esp + 0x20], 0xffffffff
call fcn.0218c0a0
lea ecx, [esp + 8]
call fcn.0218a780
push dword [esp + 0x24]
mov ecx, esi
push dword [esp + 0x24]
call fcn.021a2d20
mov ecx, esi
call fcn.021a41c0
pop edi
mov ecx, esi
pop esi
add esp, 0x10
jmp fcn.021a41c0

Function at 0x218fea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.021a3670
mov ecx, edi
call fcn.021a2ef0
mov esi, eax
add esi, dword [esp + 0x10]
lea ecx, [esi + 4]
push ecx
call dword [0x100df290]
test eax, eax
jne 0x218ff3d
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x3c]
cmp ecx, 0xffffffff
jne 0x218fed7
cmp eax, ecx
je 0x218fee0
push eax
push ecx
mov ecx, edi
call fcn.021a2d20
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
cmp ecx, 0xffffffff
jne 0x218feef
cmp eax, ecx
je 0x218fef8
push eax
push ecx
mov ecx, edi
call fcn.021a2d20
cmp dword [esi + 0x18], 0xffffffff
jne 0x218ff04
cmp dword [esi + 0x1c], 0xffffffff
je 0x218ff13
push dword [esi + 0x1c]
push dword [esi + 0x18]
push edi
call fcn.0218fb70
add esp, 0xc
cmp dword [esi + 0x20], 0xffffffff
jne 0x218ff1f
cmp dword [esi + 0x24], 0xffffffff
je 0x218ff2e
push dword [esi + 0x24]
push dword [esi + 0x20]
push edi
call fcn.0218fc70
add esp, 0xc
push dword [esp + 0x14]
mov ecx, edi
push dword [esp + 0x14]
call fcn.021a2d20
mov ecx, edi
pop edi
pop esi
jmp fcn.021a41c0
Function at 0x218ff50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
push edi
call fcn.021a3670
mov ecx, esi
call fcn.021a2ef0
mov edi, eax
add edi, dword [esp + 0x10]
lea ecx, [edi + 4]
push ecx
call dword [0x100df290]
test eax, eax
jne 0x218ffb4
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
cmp ecx, 0xffffffff
jne 0x218ff87
cmp eax, ecx
je 0x218ff90
push eax
push ecx
mov ecx, esi
call fcn.021a2d20
mov edx, dword [edi + 0x10]
mov eax, edx
mov ecx, dword [edi + 0x14]
or eax, ecx
je 0x218ffa5
push ecx
push edx
mov ecx, esi
call fcn.021a2d20
push dword [esp + 0x14]
mov ecx, esi
push dword [esp + 0x14]
call fcn.021a2d20
pop edi
mov ecx, esi
pop esi
jmp fcn.021a41c0
Function at 0x2237380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
xor ebp, ebp
push edi
test ebx, ebx
je 0x22373e6
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov dword [esp + 0x14], eax
mov edi, dword [eax + 0x78]
add edi, ebx
cmp dword [edi + 0x18], esi
jbe 0x22373e6
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 0x20]
lea eax, [eax + esi*4]
mov ecx, dword [eax + ebx]
add ecx, ebx
test ecx, 0xffff0000
je 0x22373d5
test edx, 0xffff0000
je 0x22373d5
push edx
push ecx
call dword [0x100df134]
mov edx, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
jmp 0x22373dc
xor eax, eax
cmp ecx, edx
sete al
test eax, eax
jne 0x22373ed
inc esi
cmp esi, dword [edi + 0x18]
jb 0x22373a7
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
mov eax, dword [edi + 0x24]
lea eax, [eax + esi*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov ebp, dword [eax + ebx]
add ebp, ebx
cmp ebp, edi
jb 0x22373e6
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x7c]
add eax, edi
cmp ebp, eax
ja 0x22373e6
xor ecx, ecx
mov eax, ebp
cmp byte [ebp], cl
je 0x2237429
lea esp, [esp]
lea eax, [eax + 1]
inc ecx
cmp byte [eax], 0
jne 0x2237420
lea esi, [ecx + 1]
xor edi, edi
test esi, esi
je 0x223743d
push esi
call fcn.02231830
add esp, 4
mov edi, eax
push esi
push ebp
push edi
call fcn.02231930
add esp, 0xc
mov esi, edi
cmp byte [edi], 0
je 0x223745b
nop
cmp byte [esi], 0x2e
je 0x223746d
inc esi
cmp byte [esi], 0
jne 0x2237450
push edi
xor esi, esi
call fcn.02231820
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
mov byte [esi], 0
call dword [0x100df1e0]
mov ecx, eax
lea eax, [esi + 1]
push eax
push ecx
call fcn.02237380
add esp, 8
mov esi, eax
push edi
call fcn.02231820
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10004138
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x10004185
cmp byte [esi + 0x3d], bl
je 0x10004185
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100041b4
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x1000418c
sub eax, 1
je 0x1000418f
dec eax
sub eax, 1
jne 0x100041b4
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100041ac
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10066e9c
add esp, 0x10
cmp edi, eax
jne 0x100041b4
cmp byte [esi + 0x3d], bl
sete al
jmp 0x10004187
xor al, al
jmp 0x10004187

Function at 0x10007172
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x1000718c
xor eax, eax
jmp 0x1000725c
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x100071ba
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x100071ba
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x1000725b
cmp dword [esi + 0x4c], 0
je 0x10007259
mov ecx, esi
call fcn.100046af
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x100071e6
push dword [esi + 0x4c]
push eax
call fcn.10001d87
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x10007259
mov byte [esp + 0x10], al
lea eax, [esp + 0x3c]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x1000722a
sub eax, 1
je 0x1000722a
dec eax
sub eax, 1
jne 0x10007259
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x100071d8
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x18]
sub ebp, eax
je 0x10007249
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.10066e9c
add esp, 0x10
cmp ebp, eax
jne 0x10007259
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x1000725b
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4
Function at 0x10008d01
Capabilities:
Read file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
push edi
mov edi, dword [esp + 0x14]
test esi, esi
jg 0x10008d21
jl 0x10008d18
test edi, edi
jne 0x10008d21
xor eax, eax
xor edx, edx
jmp 0x10008de8
cmp dword [ebp + 0x38], 0
je 0x10008d37
push esi
push edi
push dword [esp + 0x18]
call fcn.10008df2
jmp 0x10008de8
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10008d7b
mov eax, dword [ebp + 0x2c]
cmp dword [eax], 0
jbe 0x10008d7b
cmp dword [eax], edi
mov esi, edi
mov ebx, dword [esp + 0x14]
cmovb esi, dword [eax]
push esi
push ecx
push ebx
call fcn.10061ba0
mov eax, dword [ebp + 0x2c]
add ebx, esi
mov dword [esp + 0x20], ebx
add esp, 0xc
mov ebx, edi
sub ebx, esi
sub dword [eax], esi
mov eax, dword [ebp + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x1c]
jmp 0x10008d83
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [ebp + 0x4c], 0
mov ecx, ebx
je 0x10008dde
mov ecx, ebp
call fcn.100046af
mov edx, dword [esp + 0x14]
mov ecx, ebx
jmp 0x10008dbe
push dword [ebp + 0x4c]
push eax
push 1
push edx
call fcn.10066815
mov edx, dword [esp + 0x24]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [esp + 0x14], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x10008dee
mov eax, 0xfff
cmp ebx, eax
ja 0x10008d9a
test ecx, ecx
je 0x10008dde
push dword [ebp + 0x4c]
push ebx
push 1
push edx
call fcn.10066815
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
sbb esi, 0
mov eax, edi
mov edx, esi
pop ebx
pop edi
pop esi
pop ebp
ret 0xc
sub edi, ebx
jmp 0x10008de0

Function at 0x10008ec6
Capabilities:
Write file on windows

Disassembly:
push ecx
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10008ee7
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.10008f9c
jmp 0x10008f96
mov eax, dword [ebx + 0x20]
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x10008f0a
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10008f0c
xor eax, eax
cdq
mov ebp, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x10008f87
jg 0x10008f1f
test esi, esi
je 0x10008f87
test eax, eax
jl 0x10008f69
jg 0x10008f29
test ebp, ebp
je 0x10008f69
cmp edi, eax
jg 0x10008f39
jl 0x10008f33
cmp esi, ebp
jae 0x10008f39
mov ebp, esi
mov dword [esp + 0x20], edi
push ebp
push dword [esp + 0x20]
push ecx
call fcn.10061ba0
mov eax, dword [ebx + 0x30]
add esp, 0xc
sub esi, ebp
sbb edi, dword [esp + 0x20]
sub dword [eax], ebp
mov eax, dword [ebx + 0x20]
add dword [eax], ebp
mov eax, dword [esp + 0x1c]
add eax, ebp
test edi, edi
jl 0x10008f87
jg 0x10008f6d
test esi, esi
je 0x10008f87
jmp 0x10008f6d
mov eax, dword [esp + 0x1c]
cmp dword [ebx + 0x4c], 0
je 0x10008f87
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.10066e9c
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 0xc
Function at 0x10011982
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x10084b96
call fcn.1005f99c
sub esp, 0x38
push ebx
push esi
push edi
mov eax, 0x40e4e0
mov esi, ecx
call eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
movzx eax, ax
xor ebx, ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.10011078
pop ecx
mov dword [ebp - 0x24], eax
mov eax, ebx
mov dword [ebp - 4], ebx
mov edi, 0xb7d0b8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
mov ebx, dword [edi]
test ebx, ebx
je 0x10011a82
mov edi, dword [ebp - 0x10]
mov esi, dword [ebx]
mov dword [ebp - 0x1c], esi
mov eax, dword [esi]
cmp dword [eax + 0x20], 0x534030
je 0x10011a2e
mov eax, edi
mov dword [ebp - 0x1c], 0x78
cdq
sub eax, edx
sar eax, 1
cdq
idiv dword [ebp - 0x1c]
push eax
movzx eax, word [esi + 0x22]
push edx
push eax
push esi
lea eax, [ebp - 0x44]
push str.Entity_0x_08x__with_model__d__at_ARRAY_StreamSectors__d__d__is_invalid_n
push eax
call fcn.1001127e
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x10011a1d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x44]
call fcn.100047a1
jmp 0x10011a6f
mov ecx, dword [0x10129a08]
movzx eax, word [esi + 0x22]
push eax
mov edx, dword [ecx]
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, word [ebp - 0x18]
jne 0x10011a6f
test dword [esi + 0x1c], 0x2400
jne 0x10011a6f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [esi + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1001108f
mov eax, dword [ebx + 4]
mov ebx, eax
test eax, eax
jne 0x100119da
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
add edi, 4
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp edi, 0xb992b8
jl 0x100119cd
mov edi, 0xb992c0
mov dword [ebp - 0x14], edi
mov esi, dword [edi]
test esi, esi
je 0x10011af8
mov edi, dword [ebp - 0x18]
mov ebx, dword [esi]
mov ecx, dword [0x10129a08]
mov dword [ebp - 0x1c], ebx
movzx eax, word [ebx + 0x22]
mov edx, dword [ecx]
push eax
call dword [edx + 0xa4]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x58]
cmp ax, di
jne 0x10011aee
test dword [ebx + 0x1c], 0x2400
jne 0x10011aee
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
call dword [eax + 0x20]
lea eax, [ebx + 0x22]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1001108f
mov esi, dword [esi + 4]
test esi, esi
jne 0x10011aa9
mov edi, dword [ebp - 0x14]
add edi, 0xc
mov dword [ebp - 0x14], edi
cmp edi, 0xb99ec0
jl 0x10011aa0
mov eax, dword [ebp - 0x24]
mov esi, dword [eax]
mov dword [ebp - 0x18], esi
cmp esi, eax
je 0x10011b3d
movzx eax, word [esi + 0xe]
push eax
mov eax, 0x4089a0
call eax
movzx eax, word [esi + 0xe]
imul eax, eax, 0x14
pop ecx
lea ecx, [ebp - 0x18]
mov byte [eax + 0x8e4cd0], 0
call fcn.1000f6c7
mov esi, dword [ebp - 0x18]
cmp esi, dword [ebp - 0x24]
jne 0x10011b12
lea eax, [ebp - 0x24]
push eax
mov ecx, eax
call fcn.10011121
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x100199cd
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1008482e
call fcn.1005f99c
sub esp, 0x20
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x10019b03
push 0x1008c014
push dword [ebp + 8]
call fcn.1006f046
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10019b03
push 0xc
call fcn.1005f959
pop ecx
mov dword [ebp + 8], eax
and dword [ebp - 4], 0
test eax, eax
je 0x10019a1e
mov ecx, eax
call fcn.1000cb2a
mov esi, eax
jmp 0x10019a20
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x2c]
push 8
pop ecx
push ebx
xor eax, eax
push 1
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push 0x20
push eax
call fcn.10066815
add esp, 0x10
cmp byte [ebp - 0x2c], 0x43
jne 0x10019ae7
cmp byte [ebp - 0x2b], 0x4f
jne 0x10019ae7
cmp byte [ebp - 0x2a], 0x4c
jne 0x10019ae7
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
call fcn.1005f94b
mov ecx, dword [ebp - 0x28]
mov edi, eax
push ebx
push 1
add ecx, 0xffffffe8
push ecx
push edi
call fcn.10066815
mov al, byte [ebp - 0x29]
add esp, 0x14
cmp al, 0x4c
jne 0x10019a9a
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
push edi
call dword [0x100b7178]
add esp, 0xc
jmp 0x10019ad5
cmp al, 0x32
jne 0x10019ab7
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
push edi
call dword [0x100b717c]
jmp 0x10019ad2
cmp al, 0x33
jne 0x10019ad5
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
push eax
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe8
push eax
push edi
call dword [0x100b7180]
add esp, 0x10
push edi
call fcn.1005f997
push ebx
call fcn.10065e31
pop ecx
pop ecx
mov eax, esi
jmp 0x10019b05
test esi, esi
je 0x10019afc
mov ecx, esi
call fcn.1000cb5c
push 0xc
push esi
call fcn.1005f989
pop ecx
pop ecx
push ebx
call fcn.10065e31
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1002b36a
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0x2c]
sub esp, 0x24
mov ecx, dword [0x10403748]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10170600]
push ebp
push esi
push edi
cmp eax, dword [ecx + 4]
jg 0x1002b490
mov ebp, dword [esp + 0x38]
xor edi, edi
and dword [esp + 0x10], 0
inc edi
and dword [esp + 0x38], 0
mov ecx, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
test ecx, ecx
je 0x1002b486
mov esi, dword [0x101705fc]
xor edx, edx
mov eax, ebx
mov dword [esp + 0x3c], 1
div esi
sub esi, edx
cmp ecx, esi
cmovle esi, ecx
test ebx, ebx
je 0x1002b413
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1002b413
cmp dword [esp + 0x28], 0x1000
jne 0x1002b413
test byte [esp + 0x2c], 0xee
je 0x1002b413
mov ecx, dword [esp + 0x24]
cmp esi, ecx
ja 0x1002b413
mov eax, ebx
sub ecx, esi
sub eax, dword [esp + 0x18]
cmp eax, ecx
jbe 0x1002b43a
lea eax, [esp + 0x10]
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1002b432
xor edi, edi
push esi
push edi
push ebp
call fcn.10062120
jmp 0x1002b446
mov dword [esp + 0x38], 1
push esi
push ebx
push ebp
call fcn.10061ba0
mov edi, dword [esp + 0x48]
add esp, 0xc
cmp dword [esp + 0x38], 0
je 0x1002b472
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1002b472
push ebx
push str.__page_read___could_not_restore_original_permissions_for_ptr__p
call fcn.1005e12b
pop ecx
pop ecx
mov ecx, dword [esp + 0x40]
add ebp, esi
add ebx, esi
sub ecx, esi
mov dword [esp + 0x40], ecx
jne 0x1002b3b2
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov esi, 0x10170600
push esi
call fcn.1005fbb4
cmp dword [0x10170600], 0xffffffff
pop ecx
jne 0x1002b391
call fcn.1002b4bf
push esi
mov dword [0x101705fc], eax
call fcn.1005fb6a
pop ecx
jmp 0x1002b391

Function at 0x1002b4bf
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100e45b0]
sub esp, 0x24
cmp eax, 0xffffffff
jne 0x1002b4e1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
mov dword [0x100e45b0], eax
leave
ret
Function at 0x1002b4e3
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword fs:[0x2c]
sub esp, 0x24
mov ecx, dword [0x10403748]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101705f8]
push ebp
push esi
push edi
cmp eax, dword [ecx + 4]
jg 0x1002b5fa
mov ebx, dword [esp + 0x38]
xor edi, edi
and dword [esp + 0x10], 0
inc edi
and dword [esp + 0x38], 0
mov ebp, dword [esp + 0x40]
test ebp, ebp
je 0x1002b5f0
mov esi, dword [0x101705f4]
xor edx, edx
mov eax, ebx
mov dword [esp + 0x40], 1
div esi
sub esi, edx
cmp ebp, esi
cmovle esi, ebp
test ebx, ebx
je 0x1002b588
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1002b588
cmp dword [esp + 0x28], 0x1000
jne 0x1002b588
test byte [esp + 0x2c], 0xcc
je 0x1002b588
mov ecx, dword [esp + 0x24]
cmp esi, ecx
ja 0x1002b588
mov eax, ebx
sub ecx, esi
sub eax, dword [esp + 0x18]
cmp eax, ecx
jbe 0x1002b5a7
lea eax, [esp + 0x10]
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1002b59f
xor edi, edi
jmp 0x1002b5b9
mov dword [esp + 0x38], 1
push esi
push dword [esp + 0x40]
push ebx
call fcn.10061ba0
mov edi, dword [esp + 0x4c]
add esp, 0xc
cmp dword [esp + 0x38], 0
je 0x1002b5e2
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1002b5e2
push ebx
push str.__page_write___could_not_restore_original_permissions_for_ptr__p
call fcn.1005e12b
pop ecx
pop ecx
add dword [esp + 0x3c], esi
add ebx, esi
sub ebp, esi
jne 0x1002b527
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov esi, 0x101705f8
push esi
call fcn.1005fbb4
cmp dword [0x101705f8], 0xffffffff
pop ecx
jne 0x1002b50a
call fcn.1002b4bf
push esi
mov dword [0x101705f4], eax
call fcn.1005fb6a
pop ecx
jmp 0x1002b50a