joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001494d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1001495c
pop dword [ebp - 0x14]
mov eax, 0x30ac815
add eax, 0xcf68147
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x417ee
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x4547
mov esi, eax
mov edi, 0x78bf3c41
add edi, 0x97591fbf
add edi, dword [ebp - 0x14]
mov ebx, 0x88335491
xor dword [ebp - 0x10], 0xb8983e2e
mov edx, dword [edi]
xor edx, ebx
sub dword [ebp - 0x10], ecx
mov dword [esi], edx
add dword [ebp - 4], eax
add esi, 0x4787e35f
sub esi, 0x4787e35b
add edi, 4
loop 0x100149aa
add eax, 0x654a047a
sub eax, 0x6548fc8b
mov ebx, eax
add eax, 0x5437ca2e
add eax, 0xabc835d7
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x100696fd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x10069780
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1006974a
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1006974a
cmp edi, ebx
jge 0x1006974a
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1006977a
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1006977a
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x10069792
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x10069a28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x1016c088], al
je 0x10069a5f
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10069ac3
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1001494d
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1001494d
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.1001494d
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1006e864
leave
ret 0x10
Function at 0x10069ad4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10069b00
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10069b31
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10069b2f
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1001494d
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10069b31
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006e864
leave
ret 8

Function at 0x10069bcc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100b1980]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1016c088], 0
mov eax, dword [ebp + 8]
je 0x10069bf4
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10069c0e
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1001494d
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1006e864
leave
ret 4

Function at 0x1006e864
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100b1980]
jne 0x1006e86e
repz ret
jmp fcn.1006ef63
Function at 0x10001590
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006c040]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov cl, byte [esi]
mov byte [ebp - 0x1d], cl
test eax, eax
je 0x100015e8
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov cl, byte [ebp - 0x1d]
movzx eax, cl
sub eax, 0xe8
je 0x100016ba
sub eax, 1
je 0x100016ba
sub eax, 0x16
jne 0x100016a1
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
inc esi
mov dword [ebp - 0x18], 1
push 1
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov cl, byte [esi]
mov byte [ebp - 0x1d], cl
test eax, eax
je 0x10001646
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov cl, byte [ebp - 0x1d]
cmp cl, 0x15
je 0x10001650
cmp cl, 0x25
jne 0x100016a1
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x18], 4
push 4
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov esi, dword [esi]
test eax, eax
je 0x1000168a
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov ecx, dword [esi]
mov eax, edi
mov dword [edi], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10035fc1
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10035fc1
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
inc esi
mov dword [ebp - 0x18], 4
push 4
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov ecx, dword [esi]
mov dword [ebp - 0x24], ecx
test eax, eax
je 0x100016f8
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov ecx, dword [ebp - 0x24]
lea eax, [esi + 4]
add eax, ecx
mov ecx, dword [ebp - 8]
mov dword [edi], eax
xor ecx, ebp
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.10035fc1
mov esp, ebp
pop ebp
ret
Function at 0x10001ca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1006c040]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword fs:[0x2c]
mov edx, dword [0x1006e120]
push ebx
push esi
push edi
mov edx, dword [eax + edx*4]
mov edi, ecx
mov eax, dword [0x1006eb78]
mov ecx, dword [edi + 8]
mov dword [ebp - 0xc], ecx
cmp eax, dword [edx + 4]
jle 0x10001d1d
push 0x1006eb78
call fcn.10036020
add esp, 4
cmp dword [0x1006eb78], 0xffffffff
jne 0x10001d1d
mov dword [0x1006ea60], str.Unknown_Plugin_Name
mov dword [0x1006ea68], 0
mov dword [0x1006ea64], 0
call fcn.10001720
push 0x1006eb78
call fcn.10035fcf
add esp, 4
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
lea ecx, [ebp - 0x34]
mov dword [eax], esi
call fcn.10001590
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
add esp, 4
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0x14]
mov byte [esi], 0xe8
test eax, eax
je 0x10001d6b
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x20]
call ebx
mov eax, dword [ebp - 0xc]
inc esi
sub eax, esi
mov dword [ebp - 0x2c], 4
sub eax, 4
mov dword [ebp - 0x30], esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 4
push esi
call ebx
mov ecx, dword [ebp - 0xc]
test eax, eax
setne byte [ebp - 0x24]
mov dword [esi], ecx
test eax, eax
je 0x10001dae
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x30]
call ebx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
mov dword [edi], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10035fc1
mov esp, ebp
pop ebp
ret 4
Function at 0x10004fd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10005031
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10005014
cmp edi, 2
jb 0x10005014
cmp byte [esi], cl
jne 0x10005014
cmp byte [esi + 1], cl
jne 0x10005014
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10060498]
jmp 0x10004fe5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10060498]
test edi, edi
jne 0x10004fe5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10005060
cmp cl, 0x23
jne 0x10005047
cmp byte [esi], cl
jne 0x10005047
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10060498]
test cl, cl
jne 0x10005038
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x100051e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10005203
push 0x628
push str.E:Visual_Studio_ProjectsMGRModLoaderMGRModLoaderimguiimgui.cpp
push str.filename__mode
call fcn.100451d7
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10005210
mov dword [edi], 0
mov edx, 0x1005d1fc
mov ecx, esi
call fcn.10005070
mov esi, eax
test esi, esi
je 0x100052ef
push esi
call fcn.10039c60
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x100052e6
push 2
push 0
push esi
call fcn.1003a26d
add esp, 0xc
test eax, eax
jne 0x100052e6
push esi
call fcn.10039c60
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x100052e6
push 0
push dword [ebp + 8]
push esi
call fcn.1003a26d
add esp, 0xc
test eax, eax
jne 0x100052e6
mov eax, dword [0x1006e80c]
test eax, eax
je 0x10005285
inc dword [eax + 0x374]
push ebx
call fcn.10045258
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x100052e6
push esi
push ebx
push 1
push eax
call fcn.10041bf0
add esp, 0x10
push esi
cmp eax, ebx
je 0x100052d0
call fcn.10039f50
mov eax, dword [0x1006e80c]
add esp, 4
test eax, eax
je 0x100052be
dec dword [eax + 0x374]
push dword [ebp + 8]
call fcn.10042d06
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.10039f50
add esp, 4
test edi, edi
je 0x100052de
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.10039f50
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10007350
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
jg 0x10007377
push 0x52d
push str.E:Visual_Studio_ProjectsMGRModLoaderMGRModLoaderimguiimgui.h
push str.Size___0
call fcn.100451d7
add esp, 0xc
mov ecx, dword [esi + 0xbc]
mov edi, 4
mov eax, dword [esi + 0xc4]
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10060498]
sub edi, 1
jne 0x10007391
mov ecx, dword [0x1006e80c]
not eax
pop edi
pop esi
cmp dword [ecx + 0x1a34], eax
jne 0x100073c3
mov dword [ecx + 0x1a38], eax
cmp dword [ecx + 0x1a6c], eax
jne 0x100073d2
mov byte [ecx + 0x1a70], 1
pop ebp
ret 4

Function at 0x10009640
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x10009659
cmp byte [edi + 0x2d94], 0
je 0x10009670
push 0xf38
push str.E:Visual_Studio_ProjectsMGRModLoaderMGRModLoaderimguiimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call fcn.100451d7
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x1005dcb9
mov al, 0x57
or ebx, 0xffffffff
nop dword [eax + eax]
cmp al, 0x23
jne 0x1000969e
cmp byte [esi], al
jne 0x1000969e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10060498]
test al, al
jne 0x10009690
mov esi, dword [edi + 0x2da8]
not edx
mov ecx, dword [edi + 0x2dac]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x10015c20
mov dword [ebp - 0xc], 0x10015c80
mov dword [ebp - 8], 0x10015d50
cmp esi, ecx
jne 0x10009772
inc esi
test ecx, ecx
je 0x100096f5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x100096fa
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x10009772
mov eax, dword [0x1006e80c]
test eax, eax
je 0x10009712
inc dword [eax + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call fcn.10045258
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2db0]
test eax, eax
je 0x10009766
mov ecx, dword [edi + 0x2da8]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call fcn.10038f90
mov ecx, dword [edi + 0x2db0]
add esp, 0xc
test ecx, ecx
je 0x1000975d
mov eax, dword [0x1006e80c]
test eax, eax
je 0x1000975d
dec dword [eax + 0x374]
push ecx
call fcn.10042d06
add esp, 4
mov dword [edi + 0x2db0], ebx
mov dword [edi + 0x2dac], esi
mov eax, dword [edi + 0x2da8]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2db0]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2da8]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000aa40
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1000aa7f
cmp bl, 0x23
jne 0x1000aa61
cmp byte [esi], bl
jne 0x1000aa61
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10060498]
test bl, bl
jne 0x1000aa52
mov ecx, dword [0x1006e80c]
not eax
mov esi, dword [ecx + 0x19f0]
mov edi, dword [ecx + 0x19f8]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1000aabe
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x1000aab8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1000aaba
mov esi, edx
test esi, esi
jne 0x1000aaa0
cmp edi, ebx
je 0x1000aacd
cmp dword [edi], eax
jne 0x1000aacd
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10034180
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003427a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10034273
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x10034259
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10034259
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10034259
mov edx, dword [esi]
test edx, edx
jne 0x10034222
push 0x200
push edx
push dword [0x1006e814]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10034273
jmp 0x1003424d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1003424d
shl eax, 3
push eax
push edx
push 0
push dword [0x1006e814]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10034273
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100341e1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x100342bf
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x100342bf
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100342b9
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.10034010
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10034286
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10035fc1
mov esp, ebp
pop ebp
ret

Function at 0x100342d0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
je 0x1003431c
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x1003430b
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10034304
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x100342e1
pop edi
push dword [ebx]
push 0
push dword [0x1006e814]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x10034320
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x1006ed00]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp - 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1003437c
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10035fc1
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10034397
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10035fc1
mov esp, ebp
pop ebp
ret

Function at 0x100343d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x1006ed08]
push ebx
push esi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x100344ad
mov eax, dword [0x1006ed00]
add eax, 0x14
test byte [eax], 2
je 0x1003440a
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x100343f5
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x100344ad
push edi
push 1
or edx, 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10034180
mov ecx, dword [0x1006ed08]
add esp, 4
cmp esi, ecx
jae 0x1003445b
imul edi, esi, 0x2c
mov eax, dword [0x1006ed00]
test byte [edi + eax + 0x14], 2
jne 0x10034450
mov ecx, esi
call fcn.10034320
mov ebx, eax
test ebx, ebx
jne 0x10034458
mov ecx, dword [0x1006ed08]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10034431
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100344ac
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1003449d
mov ebx, eax
nop dword [eax + eax]
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10034491
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10034470
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1006e814]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100348d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1006c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov edx, str.false
push esi
mov esi, ecx
mov eax, str.true
mov cl, byte [ebp + 0x10]
test cl, cl
mov byte [ebp - 0x15], cl
push edi
mov edi, dword [ebp + 8]
cmove eax, edx
push eax
lea eax, [ebp - 0x14]
push 0x1005d200
push eax
call fcn.10001570
add esp, 0xc
cmp dword [esi + 0x14], 0xf
jbe 0x1003491a
mov esi, dword [esi]
push esi
push 8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop edi
pop esi
mov ecx, str.true
lea eax, [ebp - 0xc]
pop ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10034958
test dl, dl
je 0x10034954
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10034958
add eax, 2
add ecx, 2
test dl, dl
jne 0x10034938
xor eax, eax
jmp 0x1003495d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10034973
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10035fc1
mov esp, ebp
pop ebp
ret 0xc
mov ecx, str.false
lea eax, [ebp - 0xc]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100349a0
test dl, dl
je 0x1003499c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100349a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10034980
xor ecx, ecx
jmp 0x100349a5
sbb ecx, ecx
or ecx, 1
movzx eax, byte [ebp - 0x15]
xor edx, edx
test ecx, ecx
mov ecx, dword [ebp - 4]
cmove eax, edx
xor ecx, ebp
call fcn.10035fc1
mov esp, ebp
pop ebp
ret 0xc