joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100059e0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001aaee
mov eax, dword fs:[0]
push eax
sub esp, 0x1bc
push ebx
push esi
push edi
lea edi, [ebp - 0x1c8]
mov ecx, 0x6f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1001f140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10
call sub.MSVCR100D.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x1b4], 0
je 0x10005a53
mov ecx, dword [ebp - 0x1b4]
call fcn.100037a0
mov dword [ebp - 0x1c8], eax
jmp 0x10005a5d
mov dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c0]
mov dword [0x1001f7d4], ecx
mov ecx, dword [0x1001f7d4]
call fcn.10003920
call fcn.100041e0
mov esi, esp
push 0x105
lea eax, [ebp - 0xdc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, esp
call fcn.10014010
push str.Conquer.exe
lea eax, [ebp - 0xdc]
push eax
call fcn.10005bd0
add esp, 8
neg eax
sbb eax, eax
add eax, 1
je 0x10005af6
mov esi, esp
push 0
push 0x1001b6f4
push str.Invalid_Conquer.exe
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.10014010
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
jmp 0x10005b72
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.10014010
mov dword [0x1001f780], eax
mov esi, esp
push 0
push 0
push 0x1001f068
push 0x100054b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.10014010
mov dword [ebp - 0xe8], eax
call fcn.10005800
push 0x1001f528
push 0x100050b0
mov esi, esp
push str._snprintf
mov edi, esp
push str.MSVCRT.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, esp
call fcn.10014010
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10002450
add esp, 0xc
push edx
mov ecx, ebp
push eax
lea edx, [0x10005bac]
call fcn.10014040
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10014000
add esp, 0x1c8
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret
Function at 0x10005c20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10014010
cmp dword [ebp + 0x10], 1
jle 0x10005c6b
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x10005c73
mov eax, dword [ebp + 8]
mov cl, byte [ebp + 0xc]
mov byte [eax], cl
mov esi, esp
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10014010
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x10005cbc]
call fcn.10014040
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret

Function at 0x10005fe0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], vtable.ThreadBase.0
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x10006062
mov esi, esp
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.10014010
cmp eax, 0x102
jne 0x1000604c
mov esi, esp
push 5
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp esi, esp
call fcn.10014010
mov esi, esp
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10014010
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
je 0x10006081
mov esi, esp
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10014010
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret
Function at 0x10006150
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xe4]
mov ecx, 0x39
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.10006260
movzx eax, al
test eax, eax
jne 0x10006216
mov esi, esp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp esi, esp
call fcn.10014010
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
jne 0x100061b0
xor al, al
jmp 0x10006218
movzx eax, byte [ebp + 8]
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
mov dword [ebp - 0x20], eax
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0x10006470
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.10014010
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x100061fa
mov al, 1
jmp 0x10006218
mov esi, esp
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10014010
xor al, al
jmp 0x10006218
xor al, al
push edx
mov ecx, ebp
push eax
lea edx, [0x10006240]
call fcn.10014040
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret 4

Function at 0x10006f30
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
shr eax, 0xf
xor eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
imul eax, dword [0x1001ba84]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
shr eax, 0xd
xor eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
imul eax, dword [0x1001ba88]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
shr eax, 0x10
xor eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e7b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x18]
jne 0x1000e7f2
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp + 0x1c]
jne 0x1000e7f2
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0x20]
jne 0x1000e7f2
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp + 0x24]
je 0x1000e8cf
mov esi, esp
mov eax, dword [0x1001f12c]
push eax
push str._rError:_128_bit_hash_test__i:_Internal_sanity_check_failed._n
mov edi, esp
call dword [sym.imp.MSVCR100D.dll___iob_func]
cmp edi, esp
call fcn.10014010
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100D.dll_fprintf]
add esp, 0xc
cmp esi, esp
call fcn.10014010
mov eax, dword [ebp + 0x20]
mov esi, esp
push eax
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov cl, 0x20
call fcn.100143e0
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
mov cl, 0x20
call fcn.100143e0
push eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov cl, 0x20
call fcn.100143e0
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov cl, 0x20
call fcn.100143e0
push eax
push str._rGot__0x_08X_08XULL__0x_08X_08XULL___expected__0x_08X_08XULL___08X_08XULL___n
mov edi, esp
call dword [sym.imp.MSVCR100D.dll___iob_func]
cmp edi, esp
call fcn.10014010
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100D.dll_fprintf]
add esp, 0x28
cmp esi, esp
call fcn.10014010
mov esi, esp
push str._rNote:_If_you_modified_the_hash_functions__make_sure_to_either_update_the_values_nor_temporarily_comment_out_the_tests_in_BMK_sanityCheck._n
mov edi, esp
call dword [sym.imp.MSVCR100D.dll___iob_func]
cmp edi, esp
call fcn.10014010
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100D.dll_fprintf]
add esp, 8
cmp esi, esp
call fcn.10014010
mov esi, esp
push 1
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
mov eax, dword [0x1001f12c]
add eax, 1
mov dword [0x1001f12c], eax
push edx
mov ecx, ebp
push eax
lea edx, [0x1000e904]
call fcn.10014040
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret
Function at 0x10011990
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
je 0x10011a57
mov esi, esp
mov eax, dword [0x1001f124]
push eax
push str._rError:_32_bit_hash_test__i:_Internal_sanity_check_failed__n
mov edi, esp
call dword [sym.imp.MSVCR100D.dll___iob_func]
cmp edi, esp
call fcn.10014010
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100D.dll_fprintf]
add esp, 0xc
cmp esi, esp
call fcn.10014010
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._rGot_0x_08X__expected_0x_08X._n
mov edi, esp
call dword [sym.imp.MSVCR100D.dll___iob_func]
cmp edi, esp
call fcn.10014010
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100D.dll_fprintf]
add esp, 0x10
cmp esi, esp
call fcn.10014010
mov esi, esp
push str._rNote:_If_you_modified_the_hash_functions__make_sure_to_either_update_the_values_nor_temporarily_comment_out_the_tests_in_BMK_sanityCheck._n
mov edi, esp
call dword [sym.imp.MSVCR100D.dll___iob_func]
cmp edi, esp
call fcn.10014010
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100D.dll_fprintf]
add esp, 8
cmp esi, esp
call fcn.10014010
mov esi, esp
push 1
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
mov eax, dword [0x1001f124]
add eax, 1
mov dword [0x1001f124], eax
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret
Function at 0x10011bd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x10]
jne 0x10011c02
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp + 0x14]
je 0x10011cbb
mov esi, esp
mov eax, dword [0x1001f128]
push eax
push str._rError:_64_bit_hash_test__i:_Internal_sanity_check_failed__n
mov edi, esp
call dword [sym.imp.MSVCR100D.dll___iob_func]
cmp edi, esp
call fcn.10014010
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100D.dll_fprintf]
add esp, 0xc
cmp esi, esp
call fcn.10014010
mov eax, dword [ebp + 0x10]
mov esi, esp
push eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov cl, 0x20
call fcn.100143e0
push eax
mov ecx, dword [ebp + 8]
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov cl, 0x20
call fcn.100143e0
push eax
push str._rGot_0x_08X_08XULL__expected_0x_08X_08XULL._n
mov edi, esp
call dword [sym.imp.MSVCR100D.dll___iob_func]
cmp edi, esp
call fcn.10014010
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100D.dll_fprintf]
add esp, 0x18
cmp esi, esp
call fcn.10014010
mov esi, esp
push str._rNote:_If_you_modified_the_hash_functions__make_sure_to_either_update_the_values_nor_temporarily_comment_out_the_tests_in_BMK_sanityCheck._n
mov edi, esp
call dword [sym.imp.MSVCR100D.dll___iob_func]
cmp edi, esp
call fcn.10014010
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100D.dll_fprintf]
add esp, 8
cmp esi, esp
call fcn.10014010
mov esi, esp
push 1
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
mov eax, dword [0x1001f128]
add eax, 1
mov dword [0x1001f128], eax
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret

Function at 0x10013ca0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push str._s__n
mov edi, esp
call dword [sym.imp.MSVCR100D.dll___iob_func]
cmp edi, esp
call fcn.10014010
add eax, 0x40
push eax
call dword [sym.imp.MSVCR100D.dll_fprintf]
add esp, 0xc
cmp esi, esp
call fcn.10014010
mov esi, esp
push 1
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret

Function at 0x10014000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001f140]
jne 0x1001400a
repz ret
jmp fcn.10014a30
Function at 0x10016090
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10016240
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1001615d
mov edx, dword [ebp - 4]
cmp edx, dword [0x1001f138]
jb 0x100160da
mov eax, dword [ebp - 4]
cmp eax, dword [0x1001f13c]
ja 0x100160da
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100160aa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100D.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10016100
jmp 0x1001615d
cmp dword [ebp - 0x14], 0x10000
jne 0x10016143
cmp dword [ebp - 0x18], 0x10000
jb 0x10016143
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10016136
mov eax, dword [ebp - 8]
jmp 0x1001615f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10016158
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10016240
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100160aa
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10016170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10016270
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10016235
mov edx, dword [ebp - 4]
cmp edx, dword [0x1001f138]
jb 0x100161b5
mov eax, dword [ebp - 4]
cmp eax, dword [0x1001f13c]
ja 0x100161b5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10016185
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100D.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100161db
jmp 0x10016235
cmp dword [ebp - 0x14], 0x10000
jne 0x1001621e
cmp dword [ebp - 0x18], 0x10000
jb 0x1001621e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10016211
mov eax, dword [ebp - 8]
jmp 0x10016237
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10016230
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10016270
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10016185
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100178a0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10020c40], eax
je 0x100178be
mov eax, 0x10dd
jmp 0x1001799f
mov eax, dword [0x10020c50]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001793c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1001791a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1001791a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.100166f0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCR100D.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x100178c6
mov dword [0x10020c50], 0
call fcn.10016fd0
mov ecx, dword [0x10020c4c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10017989
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.MSVCR100D.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10017954
mov dword [0x10020c4c], 0
mov dword [0x10020c40], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10017e80
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10020c44], 0
je 0x10017e99
mov eax, dword [0x10020c44]
jmp 0x10017f39
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10017eab
xor eax, eax
jmp 0x10017f39
push 8
call sub.MSVCR100D.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10017f01
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10017eea
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCR100D.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10020c44], eax
mov dword [0x10020c48], 0
mov eax, dword [ebp - 8]
jmp 0x10017f39
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10017f1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x10017ecb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10020c4c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10020c4c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10018db0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10020c7c], 0
je 0x10018dc6
xor eax, eax
jmp 0x10018fe2
cmp dword [0x10020c78], 0
je 0x10018dd9
mov eax, dword [0x10020c78]
jmp 0x10018fe2
push 0x24
push 0
push 0x10020c54
call sub.MSVCR100D.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10020c54], eax
push 0
push 0
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x10020c58], eax
cmp dword [0x10020c58], 0
jne 0x10018e7e
mov dword [0x10020c7c], 1
cmp dword [0x10020c58], 0
je 0x10018e31
mov eax, dword [0x10020c58]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10020c5c], 0
mov dword [0x10020c60], 0
mov dword [0x10020c64], 0
mov dword [0x10020c68], 0
mov dword [0x10020c6c], 0
mov dword [0x10020c70], 0
mov dword [0x10020c74], 0
xor eax, eax
jmp 0x10018fe2
push str.ImagehlpApiVersionEx
mov ecx, dword [0x10020c58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10020c5c], eax
push str.SymInitialize
mov edx, dword [0x10020c58]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10020c60], eax
push str.SymSetOptions
mov eax, dword [0x10020c58]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10020c64], eax
push str.SymGetOptions
mov ecx, dword [0x10020c58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10020c68], eax
push str.SymLoadModule64
mov edx, dword [0x10020c58]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10020c6c], eax
push str.SymGetModuleInfo64
mov eax, dword [0x10020c58]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10020c70], eax
push str.SymFromName
mov ecx, dword [0x10020c58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10020c74], eax
push 8
push 0
lea edx, [ebp - 0xc]
push edx
call sub.MSVCR100D.dll_memset
add esp, 0xc
mov eax, 0xc
mov word [ebp - 0xc], ax
cmp dword [0x10020c5c], 0
je 0x10018f63
cmp dword [0x10020c60], 0
je 0x10018f63
cmp dword [0x10020c6c], 0
je 0x10018f63
cmp dword [0x10020c70], 0
je 0x10018f63
cmp dword [0x10020c74], 0
jne 0x10018f68
jmp 0x10018e12
lea ecx, [ebp - 0xc]
push ecx
call dword [0x10020c5c]
movzx edx, word [ebp - 0xc]
cmp edx, 0xc
jge 0x10018f80
jmp 0x10018e12
push 0
push 0
mov eax, dword [0x10020c54]
push eax
call dword [0x10020c60]
test eax, eax
jne 0x10018f99
jmp 0x10018e12
cmp dword [0x10020c68], 0
je 0x10018fd3
cmp dword [0x10020c64], 0
je 0x10018fd3
call dword [0x10020c68]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xfffffff8
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, 0x2704
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
call dword [0x10020c64]
mov dword [0x10020c78], 0x10020c54
mov eax, dword [0x10020c78]
mov esp, ebp
pop ebp
ret