joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec793
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ec37a

Function at 0x4ec79e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004ec504

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4162b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x4162ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4162d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4162c0
mov eax, 1
add ebx, ebx
jne 0x4162e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4162d8
jne 0x4162f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4162d8
xor ecx, ecx
sub eax, 3
jb 0x416308
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41637a
mov ebp, eax
add ebx, ebx
jne 0x416313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x416320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x416344
inc ecx
add ebx, ebx
jne 0x416330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x416325
jne 0x416341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416325
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x416364
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x416355
jmp 0x4162c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x416364
add edi, ecx
jmp 0x4162c6
pop esi
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x4163c3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1606c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416381
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16074]
or eax, eax
je 0x4163bd
mov dword [ebx], eax
add ebx, 4
jmp 0x41639e
call dword [esi + 0x16070]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4163f4
cmp al, 0xef
ja 0x4163e7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4163c9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4163d6
mov ebp, dword [esi + 0x16078]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x416428
sub esp, 0xffffff80
jmp 0x405dd2
Function at 0x10003610
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10003671
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10003654
cmp edi, 2
jb 0x10003654
cmp byte [esi], cl
jne 0x10003654
cmp byte [esi + 1], cl
jne 0x10003654
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1005b538]
jmp 0x10003625
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1005b538]
test edi, edi
jne 0x10003625
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100036a0
cmp cl, 0x23
jne 0x10003687
cmp byte [esi], cl
jne 0x10003687
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1005b538]
test cl, cl
jne 0x10003678
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x100038f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10003915
push 0x599
push str.C:UsersUser_source_reposLANRedTrainerLANRedTrainerimguiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10003922
mov dword [edi], 0
mov edx, 0x1005b228
mov ecx, esi
call fcn.100036b0
mov esi, eax
test esi, esi
je 0x10003a12
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10003a08
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10003a08
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x10003a08
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10003a08
mov eax, dword [0x1006ee70]
test eax, eax
je 0x1000399c
inc dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10003a08
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x100039ed
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1006ee70]
add esp, 4
test eax, eax
je 0x100039da
dec dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x100039ff
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005eb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
jg 0x10005ed8
push 0x506
push str.C:UsersUser_source_reposLANRedTrainerLANRedTrainerimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ecx, dword [esi + 0xbc]
mov edi, 4
mov eax, dword [esi + 0xc4]
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1005b538]
sub edi, 1
jne 0x10005ef2
mov ecx, dword [0x1006ee70]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a04], eax
jne 0x10005f24
mov dword [ecx + 0x1a08], eax
cmp dword [ecx + 0x1a38], eax
jne 0x10005f33
mov byte [ecx + 0x1a3c], 1
pop ebp
ret 4

Function at 0x10005f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10069040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
jg 0x10005f75
push 0x506
push str.C:UsersUser_source_reposLANRedTrainerLANRedTrainerimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edi, 0x10
movss xmm0, dword [ecx]
subss xmm0, dword [esi + 0xc]
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [ecx + 0xc]
subss xmm0, dword [esi + 0x10]
mov ecx, dword [esi + 0xbc]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xc4]
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1005b538]
sub edi, 1
jne 0x10005fd5
mov eax, dword [0x1006ee70]
not edx
pop edi
pop esi
cmp dword [eax + 0x1a04], edx
jne 0x10006006
mov dword [eax + 0x1a08], edx
cmp dword [eax + 0x1a38], edx
jne 0x10006015
mov byte [eax + 0x1a3c], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.1005465b
mov esp, ebp
pop ebp
ret 4
Function at 0x10008900
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x10008919
cmp byte [edi + 0x2d4c], 0
je 0x10008931
push 0xef8
push str.C:UsersUser_source_reposLANRedTrainerLANRedTrainerimguiimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x10059691
mov al, 0x57
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x1000895e
cmp byte [esi], al
jne 0x1000895e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x1005b538]
test al, al
jne 0x10008950
mov esi, dword [edi + 0x2d60]
not edx
mov ecx, dword [edi + 0x2d64]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x100159e0
mov dword [ebp - 0xc], 0x10015a40
mov dword [ebp - 8], 0x10015b10
cmp esi, ecx
jne 0x10008a34
inc esi
test ecx, ecx
je 0x100089b5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x100089ba
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x10008a34
mov eax, dword [0x1006ee70]
test eax, eax
je 0x100089d2
inc dword [eax + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2d68]
test eax, eax
je 0x10008a28
mov ecx, dword [edi + 0x2d60]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x2d68]
add esp, 0xc
test ecx, ecx
je 0x10008a1e
mov eax, dword [0x1006ee70]
test eax, eax
je 0x10008a1e
dec dword [eax + 0x374]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [edi + 0x2d68], ebx
mov dword [edi + 0x2d64], esi
mov eax, dword [edi + 0x2d60]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2d68]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2d60]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009e10
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x10009e4f
cmp bl, 0x23
jne 0x10009e31
cmp byte [esi], bl
jne 0x10009e31
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x1005b538]
test bl, bl
jne 0x10009e22
mov ecx, dword [0x1006ee70]
not eax
mov esi, dword [ecx + 0x19c0]
mov edi, dword [ecx + 0x19c8]
lea ebx, [edi + esi*8]
test esi, esi
je 0x10009e8e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10009e88
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10009e8a
mov esi, edx
test esi, esi
jne 0x10009e70
cmp edi, ebx
je 0x10009e9d
cmp dword [edi], eax
jne 0x10009e9d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x1000f970
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10069040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1006ee70]
push ebx
push esi
push edi
mov eax, dword [eax + 0x19d0]
cmp dword [eax + 0xbc], 0
lea edi, [eax + 0xbc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
jg 0x1000f9bb
push 0x506
push str.C:UsersUser_source_reposLANRedTrainerLANRedTrainerimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov eax, dword [edi]
lea edx, [ebp - 8]
mov ebx, dword [edi + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1005b538]
sub esi, 1
jne 0x1000f9d0
mov eax, dword [ebp - 0xc]
not ebx
mov esi, dword [edi]
mov ecx, dword [eax + 0xc0]
cmp esi, ecx
jne 0x1000fa20
inc esi
test ecx, ecx
je 0x1000fa0b
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1000fa10
mov eax, 8
cmp eax, esi
mov ecx, edi
cmovg esi, eax
push esi
call fcn.10016610
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
mov eax, dword [eax + 0xc4]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005465b
mov esp, ebp
pop ebp
ret
Function at 0x10015140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x1006ee70]
push edi
cmp byte [esi + 0x2d78], 0
je 0x100151df
cmp dword [esi + 0x2d80], 0
lea edi, [esi + 0x2d84]
je 0x100151d1
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10015189
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100169c0
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.10004150
mov edx, dword [edi]
mov ecx, 0x1006ee6c
push dword [esi + 0x2d80]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2d8c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.10004150
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100158c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [0x1006ee70]
mov eax, ecx
mov dword [ebp - 8], eax
push edi
mov dword [esi + 0x2d50], 0
test eax, eax
je 0x100159cf
lea edi, [esi + 0x2d54]
mov dword [esi + 0x2d50], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10015915
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100169c0
mov dword [edi], 0
cmp dword [edi + 4], 0
jne 0x1001592a
push 8
mov ecx, edi
call fcn.100169c0
mov eax, dword [edi]
xor ebx, ebx
mov ecx, dword [edi + 8]
mov byte [ecx + eax], 0
inc dword [edi]
mov eax, dword [esi + 0x2d60]
test eax, eax
jle 0x1001598c
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x10015965
push 0x4fc
push str.C:UsersUser_source_reposLANRedTrainerLANRedTrainerimguiimgui.h
push str.i___Size
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [esi + 0x2d68]
add eax, ecx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 4]
inc ebx
mov eax, dword [esi + 0x2d60]
add ecx, 0x18
add esp, 0xc
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x10015965
mov edi, dword [edi]
mov ebx, 0x1006ee6c
mov ecx, dword [ebp - 8]
mov edx, 0x1005b290
lea eax, [edi - 1]
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esi + 0x2d5c]
test eax, eax
cmovne ebx, eax
call fcn.100036b0
mov esi, eax
test esi, esi
je 0x100159cf
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039a90
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10069040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10039b8a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10039b83
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x10039b69
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10039b69
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10039b69
mov edx, dword [esi]
test edx, edx
jne 0x10039b32
push 0x200
push edx
push dword [0x1006ee78]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10039b83
jmp 0x10039b5d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10039b5d
shl eax, 3
push eax
push edx
push 0
push dword [0x1006ee78]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10039b83
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10039af1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x10039bcf
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10039bcf
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10039bc9
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.10039920
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10039b96
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005465b
mov esp, ebp
pop ebp
ret
Function at 0x10039be0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10069040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x1006f250]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10039c41
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005465b
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10039c62
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10039c83
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10039c83
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10039c7d
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10039c83
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.1005465b
mov esp, ebp
pop ebp
ret
Function at 0x10039ce0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x1006f258]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x10039dd1
mov eax, dword [0x1006f250]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x10039d25
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10039d08
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x10039dd1
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.10039a90
mov ecx, dword [0x1006f258]
add esp, 4
cmp esi, ecx
jae 0x10039d85
imul edi, esi, 0x2c
mov eax, dword [0x1006f250]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x10039d7a
mov edx, ebx
mov ecx, esi
call fcn.10039be0
mov dword [ebp - 4], eax
test eax, eax
jne 0x10039d82
mov ecx, dword [0x1006f258]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10039d51
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10039dd1
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x10039dc2
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10039db6
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10039d95
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1006ee78]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a1a0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov edi, edx
mov dword [ebp - 4], ebx
mov edx, 1
mov ecx, 0x1006ee74
xor eax, eax
lock cmpxchg dword [ecx], edx
test eax, eax
je 0x1003a1f5
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
cmp esi, 0x20
jae 0x1003a1d9
push 0
jmp 0x1003a1db
push 1
call ebx
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x1006ee74
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x1003a1d0
mov ebx, dword [ebp - 4]
cmp dword [0x1006ee78], 0
je 0x1003a2c8
test ebx, ebx
jne 0x1003a214
mov ecx, edi
call fcn.10039ce0
mov edi, eax
jmp 0x1003a2cd
mov ecx, dword [0x1006f258]
xor esi, esi
test ecx, ecx
je 0x1003a234
mov edx, dword [0x1006f250]
mov eax, edx
cmp ebx, dword [eax]
je 0x1003a23e
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x1003a228
mov edi, 4
jmp 0x1003a2cd
cmp esi, 0xffffffff
je 0x1003a234
imul eax, esi, 0x2c
movzx eax, byte [eax + edx + 0x14]
shr eax, 1
and eax, 1
cmp eax, edi
je 0x1003a2bf
push 1
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.10039a90
add esp, 4
mov edx, edi
mov ecx, esi
call fcn.10039be0
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], edi
test eax, eax
je 0x1003a2cd
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1003a2ae
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1003a2a2
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x1003a281
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1006ee78]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1003a2cd
neg edi
sbb edi, edi
add edi, 6
jmp 0x1003a2cd
mov edi, 2
xor eax, eax
mov ecx, 0x1006ee74
xchg dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d0d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1003d108
sub eax, 1
jne 0x1003d13d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [ebp + 8]
push 0x1003d070
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
cmp dword [0x1006f198], 0
je 0x1003d13d
xor edx, edx
xor ecx, ecx
call fcn.1003a1a0
push dword [0x1006f184]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [0x1006f184], 0
mov dword [0x1006f198], 0
mov eax, 1
pop ebp
ret 0xc