joyce8/EMBER2024-capa huggingface dataset:
Function at 0x133ebe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x23c], 0
jne 0x133ed34
mov eax, dword [esi + 0x240]
cmp eax, 0x10
jge 0x133ed34
test eax, eax
js 0x133ed34
mov eax, dword [esi + 0x234]
push eax
call fcn.01340df0
add esp, 4
test eax, eax
jne 0x133ed39
mov ecx, dword [esi + 0x240]
mov eax, dword [ebp + 0x10]
lea edx, [ecx + eax]
cmp edx, 0xc
jbe 0x133ec3a
or dword [esi + 0x238], 1
push ebx
push edi
xor edi, edi
test ecx, ecx
jne 0x133ec95
mov ecx, eax
and ecx, 0xfffffff0
mov dword [ebp + 8], ecx
jbe 0x133ec8e
lea ebx, [esi + 0x1f4]
xor eax, eax
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edi]
mov ecx, dword [ecx + edx]
xor dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jb 0x133ec54
push ebx
push esi
call fcn.01340d60
add esp, 8
add dword [esi + 0x248], 0x80
adc dword [esi + 0x24c], 0
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x133ec52
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
add ebx, edi
jmp 0x133ec98
mov ebx, dword [ebp + 0xc]
cmp edi, eax
jae 0x133ed2d
sub eax, edi
mov dword [ebp + 8], eax
mov ecx, 1
lea ebx, [ebx]
mov al, byte [ebx]
mov edx, dword [esi + 0x240]
mov byte [esi + edx + 0x224], al
add dword [esi + 0x240], ecx
add ebx, ecx
cmp dword [esi + 0x240], 0x10
jne 0x133ed23
lea edi, [esi + 0x1f4]
mov eax, edi
mov ecx, 4
lea ecx, [ecx]
movzx edx, byte [eax + 0x30]
xor byte [eax], dl
movzx edx, byte [eax + 0x31]
xor byte [eax + 1], dl
movzx edx, byte [eax + 0x32]
xor byte [eax + 2], dl
movzx edx, byte [eax + 0x33]
xor byte [eax + 3], dl
add eax, 4
dec ecx
jne 0x133ece0
push edi
push esi
call fcn.01340d60
xor eax, eax
add esp, 8
add dword [esi + 0x248], 0x80
mov dword [esi + 0x240], eax
adc dword [esi + 0x24c], eax
mov ecx, 1
sub dword [ebp + 8], ecx
jne 0x133ecb0
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
mov eax, 0x10
pop esi
pop ebp
ret
Function at 0x1340bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], edi
cmp eax, edi
je 0x1340c54
push esi
mov eax, dword [ebp + 0x10]
dec dword [ebp + 0xc]
test eax, eax
je 0x1340be1
call eax
dec dword [ebp - 8]
call fcn.0135b9f8
mov esi, eax
call fcn.0135b9f8
cmp esi, eax
jne 0x1340c00
xor edi, 1
call fcn.0135b9f8
cmp esi, eax
je 0x1340bf4
call fcn.0135b9f8
mov esi, eax
call fcn.0135b9f8
cmp esi, eax
jne 0x1340c1c
xor ebx, 1
call fcn.0135b9f8
cmp esi, eax
je 0x1340c10
cmp edi, ebx
je 0x1340be4
mov eax, dword [ebp - 4]
lea ecx, [eax + eax]
or ecx, edi
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
jne 0x1340be1
mov eax, dword [ebp + 8]
mov dl, cl
mov byte [eax], dl
inc eax
cmp dword [ebp + 0xc], 0
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 8
jne 0x1340bd5
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1340d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
add eax, eax
lea edx, [ecx + eax*8 + 0x258]
push 0x10
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.01359f40
add esp, 0xc
mov esi, 1
mov edx, 0x100
movzx ecx, byte [esi + edi]
mov ebx, dword [ebp + 8]
add ecx, edx
xor eax, eax
add ecx, ecx
lea ecx, [ebx + ecx*8 + 0x258]
jmp 0x1340db0
mov ebx, dword [ecx]
xor dword [ebp + eax - 0x10], ebx
add eax, 4
add ecx, 4
cmp eax, 0x10
jl 0x1340db0
add edx, 0x100
inc esi
cmp edx, 0x1000
jl 0x1340d94
push 0x10
lea edx, [ebp - 0x10]
push edx
push edi
call fcn.01359f40
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x134a537
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, edx
mov eax, edx
xor eax, dword [ebp + 0x10]
shr ecx, 5
inc ecx
cmp edx, ecx
jb 0x134a56e
push esi
push edi
mov esi, dword [ebp + 8]
movzx esi, byte [esi + edx - 1]
mov edi, eax
shl edi, 5
add esi, edi
mov edi, eax
shr edi, 2
add esi, edi
sub edx, ecx
xor eax, esi
cmp edx, ecx
jae 0x134a54e
pop edi
pop esi
pop ebp
ret

Function at 0x134e6d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
mov esi, 0x200
call fcn.01342377
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.01342216
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.01359b2c
add esp, 0x20
jmp 0x134e735
cmp esi, 0x3fffffff
ja 0x134e719
add esi, esi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.01342216
push dword [ebp + 0xc]
push esi
push 1
push eax
call fcn.01359b2c
add esp, 0x18
add dword [ebp - 0x208], eax
cmp eax, esi
jae 0x134e70f
lea eax, [ebp - 0x210]
push eax
call fcn.013422df
pop ecx
pop esi
leave
ret

Function at 0x134e74f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.01342377
push dword [ebp + 0x10]
lea eax, [ebp - 0x210]
push eax
call fcn.01342216
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push 1
push eax
call fcn.01359b2c
mov esi, eax
add dword [ebp - 0x208], esi
lea eax, [ebp - 0x210]
push eax
call fcn.013422df
xor eax, eax
add esp, 0x24
cmp eax, esi
sbb eax, eax
neg eax
pop esi
leave
ret

Function at 0x134ea40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, eax
call fcn.01343325
pop ecx
mov esi, eax
sub esi, ebx
push 1
pop edi
je 0x134ead1
push ebx
push dword [ebp + 8]
dec esi
call fcn.013434b4
pop ecx
pop ecx
cmp eax, 3
jne 0x134ea9a
test edi, edi
je 0x134eac6
push 0
push ebx
push dword [ebp + 8]
call fcn.0134369d
fstp qword [esp + 4]
mov dword [esp], str._.14g
push dword [ebp + 0xc]
call fcn.0135716e
add esp, 0x10
test eax, eax
jle 0x134eac6
xor edi, edi
inc edi
jmp 0x134eac8
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
call fcn.01342e99
add esp, 0xc
test edi, edi
je 0x134eac6
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp - 4]
inc edi
push edi
push eax
call fcn.0135889f
add esp, 0x10
cmp eax, dword [ebp - 4]
je 0x134eac8
xor edi, edi
inc ebx
test esi, esi
jne 0x134ea5b
test edi, edi
je 0x134ead6
xor eax, eax
inc eax
jmp 0x134eae5
push 0
push 0
push dword [ebp + 8]
call fcn.01342040
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423b0c
Capabilities:
Encode data using xor

Disassembly:
pop ebx
push eax
mov cl, 0xe2
push ecx
xor eax, esp
mov ebx, dword [edi]
or byte [eax + 0x4e0eb8a9], 0x7c
push ecx
mov eax, 0x3ec852e2
cmp al, 0xe
dec esi
xor dword [edi + 0x5b], esp
push eax
mov cl, 0xe2
push ecx
xor eax, esp
mov byte [edi], bl
or byte [eax + 0x4e0eb8e6], 0x7c
imul edi, dword [eax + 0x7bc852e2], 0x3c
cmp al, 0xe
cmp al, 0xe
dec esi
xor dword [edi + 0x5b], esp
push eax
mov cl, 0xe2
push ecx
xor eax, esp
mov bl, byte [edi]
or byte [eax + 0x4e0eb81c], 0x7c
jge 0x423ad8
loop 0x423b74
enter 0x3cb0, 0xe
dec esi
push 0x5223d05f
dec esi
scasd eax, dword es:[edi]
mov cs, word [eax + 0x4e0e53f0]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
inc ebx
xor dword [edi + 0x5b], esp
push eax
mov cl, 0xe2
push ecx
xor eax, esp
mov dword [edi], ebx
or byte [eax + 0x4e0eb851], 0x7c
mov byte [eax - 0x1a37ad1e], bh
cmp al, 0xe
dec esi
xor dword [edi + 0x5b], esp
push eax
mov cl, 0xe2
push ecx
xor eax, esp
mov byte [edi], bl
or byte [eax + 0x4e0e78ce], 0x7c
invalid
ret 0xe75
Function at 0x401784
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
call fcn.004011fc
mov dword [ebp - 0x10], 0x41319b
mov ebx, eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040176c
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0xc]
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x1c], ecx
jmp 0x40184d
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 0x18]
test ebx, ebx
jne 0x4017cd
xor eax, eax
jmp 0x401862
mov eax, ebx
mov edx, dword [eax + 0x3c]
add edx, ebx
mov eax, edx
mov ecx, dword [eax + 0x78]
add ecx, ebx
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [edx + 0x1c]
mov eax, dword [eax + 0x20]
add ecx, ebx
add eax, ebx
mov dword [ebp - 0x24], ecx
mov esi, eax
mov edx, dword [ebp - 0x20]
mov edx, dword [edx + 0x24]
add edx, ebx
xor edi, edi
mov dword [ebp - 0x28], edx
jmp 0x401843
mov eax, dword [esi]
add eax, ebx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x14]
push ecx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00401704
add esp, 0xc
push eax
call fcn.00401150
pop ecx
mov edx, dword [ebp + 8]
cmp eax, edx
jne 0x40183b
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
movzx eax, word [ecx]
mov eax, dword [edx + eax*4]
add eax, ebx
jmp 0x401862
add dword [ebp - 0x28], 2
inc edi
add esi, 4
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x18]
cmp edi, ecx
jb 0x401802
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
jne 0x4017bc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x23130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x23140
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea esi, [esi + eax*2]
lea edi, [edi + eax*2]
cmp eax, 1
jne 0x23150
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x23710
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x228
mov eax, dword [0x2416ec]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x22c]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 4]
lea ecx, [esp + 0x14]
xor esi, esi
push ecx
mov ecx, dword [edi]
or edx, 0x2001f
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.000236a0
mov ebp, eax
cmp ebp, esi
je 0x23774
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x2376d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x2380d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
push esi
push esi
push esi
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x44]
push ecx
push esi
push edx
mov dword [esp + 0x40], 0x100
call ebx
test eax, eax
jne 0x237da
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.00023710
mov ebp, eax
cmp ebp, esi
jne 0x2375e
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push esi
push esi
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x44]
push eax
push esi
push ecx
mov dword [esp + 0x40], 0x100
call ebx
test eax, eax
je 0x237a0
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x237ef
push eax
call ebp
mov dword [esp + 0x14], esi
mov ebx, dword [esp + 0x24]
mov eax, edi
mov dword [esp + 0x18], esi
call fcn.00023890
mov edi, eax
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x2380b
push eax
call ebp
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00168a41
add esp, 0x228
ret 4
Function at 0x243e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x1d2ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x2416ec]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x414]
xor esi, esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, esi
jne 0x2445f
call fcn.00022970
mov esi, eax
jmp 0x24554
mov eax, dword [ebp - 0x14]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, esi
jne 0x2447b
call fcn.00022970
jmp 0x2454b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp eax, esi
jne 0x24494
call fcn.00022970
jmp 0x2454b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
mov dword [ebp - 0x14], ebx
cmp eax, ebx
jae 0x244b2
mov esi, 0x8007000e
jmp 0x2454d
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
mov byte [ebp - 4], 2
cmp ecx, esi
ja 0x244c7
cmp eax, 0xffffffff
jbe 0x244d1
push 0x80070216
call fcn.00024db0
cmp eax, 0x400
jbe 0x244fa
lea ecx, [ebp]
push ecx
call fcn.00023110
jmp 0x24500
lea edx, [ebp + 4]
mov dword [ebp], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp]
cmp eax, esi
jne 0x24515
mov esi, 0x8007000e
jmp 0x2454d
push ebx
push eax
mov eax, dword [ebp - 0x18]
push ebx
push eax
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
jne 0x24530
call fcn.00022970
jmp 0x2454b
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x418]
mov ecx, dword [ebp]
push eax
lea esi, [ebp - 0x24]
call fcn.00024250
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x24564
lea eax, [ebp]
call fcn.000230f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.00168a41
lea esp, [ebp + 0x408]
pop ebp
ret 0xc
Function at 0x26000
Capabilities:
Get common file path

Disassembly:
cmp dword [0x25d554], 0
jne 0x260b8
cmp byte [0x25d450], 0
jne 0x2608d
push 0x25d450
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x104
jb 0x26056
push 0x104
push 0x25d450
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x25d450
call fcn.0016a2d0
add esp, 8
test eax, eax
je 0x26056
mov byte [eax + 1], 0
mov eax, 0x25d450
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x26060
mov ecx, dword [str._debug.log]
mov edx, dword [0x1f8ac8]
mov dword [eax], ecx
mov cx, word [0x1f8acc]
mov dword [eax + 4], edx
mov dl, byte [0x1f8ace]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
push 0x1f8ad0
push 0x25d450
call fcn.0016a19e
add esp, 8
mov dword [0x25d554], eax
test eax, eax
jne 0x260ab
xor al, al
ret
push 2
push 0
push eax
call fcn.0016a67f
add esp, 0xc
mov al, 1
ret
Function at 0x260c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x1c9f2b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x2416ec]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x2416ec]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x29c]
cmp dword [ebp + 0x10], 0
je 0x2627c
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x7e]
push ecx
mov word [esp + 0x80], ax
call fcn.0016e420
add esp, 0xc
push 0x104
lea edx, [esp + 0x78]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x74]
push 0x5c
push eax
call fcn.0016a0b4
add esp, 8
test eax, eax
je 0x26154
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [esp + 0x74]
lea edx, [eax + 2]
jmp 0x26160
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x26160
sub eax, edx
sar eax, 1
mov edx, 0x104
sub edx, eax
push edx
lea eax, [esp + 0x78]
push 0x1f8ad4
push eax
call fcn.00169f23
xor ecx, ecx
add esp, 0xc
cmp dword [ebp + 0x14], 0x10
mov word [esp + 0x27a], cx
jb 0x2619e
mov eax, dword [ebp]
jmp 0x261a0
mov eax, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call ebx
mov esi, eax
test esi, esi
je 0x2627c
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00167a7c
add esp, 4
mov edi, eax
cmp dword [ebp + 0x14], 0x10
jb 0x261e4
mov ebp, dword [ebp]
push esi
push edi
or esi, 0xffffffff
push esi
push ebp
push 0
push 0xfde9
call ebx
test eax, eax
je 0x2626c
push 0x44
lea eax, [esp + 0x30]
push 0
push eax
call fcn.0016e420
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push edi
lea eax, [esp + 0x98]
push eax
mov dword [esp + 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x2625c
mov ecx, dword [esp + 0x1c]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call ebx
mov eax, dword [esp + 0x1c]
push eax
call ebx
jmp 0x2626c
push 0x10
push str.Fatal_error
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
mov dword [esp + 0x298], esi
call fcn.00169081
add esp, 4
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.00168a41
add esp, 0x284
ret
Function at 0x262d0
Capabilities:
Print debug messages
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x1cd653
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x2416ec]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
mov eax, dword [0x2416ec]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x58], 0
mov eax, dword [edi]
cmp eax, dword [0x25d448]
jl 0x264f0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [edi + 8]
call fcn.00026f30
push 2
mov ebx, 1
push 0x1f8b18
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], bl
call fcn.000278a0
cmp dword [0x25d44c], 0
lea ebp, [ebx + 0xf]
je 0x26362
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebp
jae 0x2635b
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x25d44c], ebx
je 0x263d8
call fcn.00026000
test al, al
je 0x263d8
cmp byte [0x25d55a], 0
jne 0x2638d
push 0x25d3dc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x25d55a], bl
push 0x25d3dc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x25d554]
push 2
push 0
push edx
call fcn.0016a67f
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp dword [esp + 0x28], ebp
jae 0x263b9
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x25d554]
push 0x1f8b1c
push eax
call fcn.0016a1b5
add esp, 0xc
push 0x25d3dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi], 3
jne 0x264c3
mov ecx, dword [0x25d554]
push ecx
call fcn.00169ec7
add esp, 4
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x26405
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x264c3
cmp dword [0x25d55c], 0
je 0x2643c
lea edx, [esp + 0x30]
push edx
lea ecx, [edi + 8]
call fcn.00026f30
push eax
mov byte [esp + 0x5c], 2
call dword [0x25d55c]
add esp, 4
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], bl
call fcn.000e0ca0
jmp 0x264c3
mov eax, dword [0x244e74]
cmp byte [eax], 0
jne 0x26470
lea ecx, [esp + 0x30]
push ecx
lea ecx, [edi + 8]
call fcn.00026f30
push eax
mov byte [esp + 0x5c], 3
call fcn.000260c0
add esp, 4
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], bl
call fcn.000e0ca0
jmp 0x264b5
lea edx, [esp + 0x30]
push edx
lea ecx, [edi + 8]
call fcn.00026f30
cmp dword [eax + 0x14], ebp
jb 0x26484
mov eax, dword [eax]
push eax
push 0x1f8b20
call fcn.00169acd
add eax, 0x40
push eax
call fcn.0016a1b5
add esp, 0xc
lea ecx, [esp + 0x30]
call fcn.000e0ca0
call fcn.00169acd
add eax, 0x40
push eax
call fcn.00169ec7
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [esp + 0x58], 0
cmp dword [esp + 0x28], ebp
jb 0x264db
mov eax, dword [esp + 0x14]
push eax
call fcn.00168a36
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
lea esi, [edi + 0x68]
mov ecx, esi
mov dword [esp + 0x58], 0xffffffff
call fcn.00026e90
push esi
mov dword [esi], vtable.std::ios_base.0
call fcn.00167cfc
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00168a41
add esp, 0x4c
ret
Function at 0x28ac0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1caff6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x2416ec]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0016812f
push 4
mov dword [esp + 0x28], 0
call fcn.00168a50
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
mov byte [esp + 0x24], 1
test edi, edi
je 0x28b4b
call fcn.00168007
mov dword [edi], eax
call fcn.00167dc6
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.001680f0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x28b40
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00168118
jmp 0x28b4d
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x2ba00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1cbf58
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x2416ec]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
cmp dword [esi + 0x30], 0x10
jb 0x2ba41
mov eax, dword [esi + 0x1c]
push eax
call fcn.00168a36
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x1c], bl
mov dword [esp + 0x18], 0xffffffff
cmp dword [esi + 0x14], 0x10
jb 0x2ba67
mov eax, dword [esi]
push eax
call fcn.00168a36
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x2d150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1cae18
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x2416ec]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0x1c]
cmp dword [esi + 0x30], 0x10
jb 0x2d18e
mov eax, dword [esi + 0x1c]
push eax
call fcn.00168a36
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x1c], bl
mov dword [esp + 0x14], 0xffffffff
cmp dword [esi + 0x14], 0x10
jb 0x2d1b4
mov eax, dword [esi]
push eax
call fcn.00168a36
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret