joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10078108
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10078140
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100761d9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.100761b1
jmp 0x1007814c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x100797f6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10079838
call fcn.1007f190
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10079838
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1007982f
xor eax, eax
jmp 0x10079840
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10079846
pop edi
pop esi
pop ebx
ret 4
Function at 0x62c98a34
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x63810008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x63810008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x62c98b2f
jmp 0x62c98c0a
jmp 0x62c98ce5
jmp 0x62c98dc0
jmp 0x62c98e9b
jmp 0x62c98f76
jmp 0x62c99051
jmp 0x62c9912c
jmp 0x62c99207
jmp 0x62c992e2
jmp 0x62c993bd
jmp 0x62c99498
jmp 0x62c99573
jmp 0x62c9964e
jmp 0x62c99729
jmp 0x62c99804
jmp 0x62c998df
jmp 0x62c999ba
jmp 0x62c99a95
jmp 0x62c99b70
jmp 0x62c99c4b
jmp 0x62c99d26
jmp 0x62c99e01
jmp 0x62c99edc
jmp 0x62c99fb7
jmp 0x62c9a092
jmp 0x62c9a16d
jmp 0x62c9a248
jmp 0x62c9a323
mov dword [ebp - 0x14], 0
jmp 0x62c9a405
jmp 0x62c9a4e0
jmp 0x62c9a5bb
jmp 0x62c9a696
jmp 0x62c9a771
jmp 0x62c9a84c
jmp 0x62c9a927
jmp 0x62c9aa02
jmp 0x62c9aadd
jmp 0x62c9abb8
jmp 0x62c9ac93
jmp 0x62c9ad6e
jmp 0x62c9ae49
jmp 0x62c9af24
jmp 0x62c9afff
jmp 0x62c9b0da
jmp 0x62c9b1b5
jmp 0x62c9b290
jmp 0x62c9b36b
jmp 0x62c9b446
jmp 0x62c9b521
jmp 0x62c9b5fc
jmp 0x62c9b6d7
jmp 0x62c9b7b2
jmp 0x62c9b88d
jmp 0x62c9b968
jmp 0x62c9ba43
jmp 0x62c9bb1e
jmp 0x62c9bbf9
mov dword [ebp - 0x18], 0
jmp 0x62c9bcdb
jmp 0x62c9bdb6
jmp 0x62c9be91
jmp 0x62c9bf6c
jmp 0x62c9c047
jmp 0x62c9c122
jmp 0x62c9c1fd
jmp 0x62c9c2d8
jmp 0x62c9c3b3
jmp 0x62c9c48e
jmp 0x62c9c569
jmp 0x62c9c644
jmp 0x62c9c71f
jmp 0x62c9c7fa
jmp 0x62c9c8d5
jmp 0x62c9c9b0
jmp 0x62c9ca8b
jmp 0x62c9cb66
jmp 0x62c9cc41
jmp 0x62c9cd1c
jmp 0x62c9cdf7
jmp 0x62c9ced2
jmp 0x62c9cfad
jmp 0x62c9d088
jmp 0x62c9d163
jmp 0x62c9d23e
jmp 0x62c9d319
jmp 0x62c9d3f4
jmp 0x62c9d4cf
mov dword [ebp - 0x10], 0
jmp 0x62c9d5b1
jmp 0x62c9d68c
jmp 0x62c9d767
jmp 0x62c9d842
jmp 0x62c9d91d
jmp 0x62c9d9f8
jmp 0x62c9dad3
jmp 0x62c9dbae
jmp 0x62c9dc89
jmp 0x62c9dd64
jmp 0x62c9de3f
jmp 0x62c9df1a
jmp 0x62c9dff5
jmp 0x62c9e0d0
jmp 0x62c9e1ab
jmp 0x62c9e286
jmp 0x62c9e361
jmp 0x62c9e43c
jmp 0x62c9e517
jmp 0x62c9e5f2
jmp 0x62c9e6cd
jmp 0x62c9e7a8
jmp 0x62c9e883
jmp 0x62c9e95e
jmp 0x62c9ea39
jmp 0x62c9eb14
jmp 0x62c9ebef
jmp 0x62c9ecca
jmp 0x62c9eda5
mov dword [ebp - 0x10], 0
jmp 0x62ca6a02
jmp 0x62c9ee8c
jmp 0x62c9ef67
jmp 0x62c9f042
jmp 0x62c9f11d
jmp 0x62c9f1f8
jmp 0x62c9f2d3
jmp 0x62c9f3ae
jmp 0x62c9f489
jmp 0x62c9f564
jmp 0x62c9f63f
jmp fcn.62c9f71a
mov eax, dword [0x63810008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x62c9edb1
nop
leave
ret

Function at 0x62cecd70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6380f040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.62cecdd0
Function at 0x62cecdd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x63810378]
test esi, esi
jle 0x62cecebd
mov edi, dword [0x6381037c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x62cece04
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x62ceceb6
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x62cecdf0
mov dword [esp], eax
mov esi, eax
call fcn.62ced570
test eax, eax
mov edi, eax
je 0x62cecefa
mov esi, dword [0x6381037c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.62ced680
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x6381037c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x62ceceda
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x62ceceaf
sub eax, 0x40
and eax, 0xffffffbf
je 0x62ceceaf
mov eax, dword [esp + 0x20]
add ebx, dword [0x6381037c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x62cecec4
add dword [0x63810378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x62cece0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.62cecd70
mov eax, dword [0x6381037c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.62cecd70
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.62cecd70
lea esi, [esi]

Function at 0x62ced1e0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x63810388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x63810380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x62ced235
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x62ced22e
test esi, esi
je 0x62ced22e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x62ced210
mov dword [esp], 0x63810388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1001ee20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1001f490
lea eax, [ebp - 0x18]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], ecx
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], eax
test byte [edx + 0x20], 1
jne 0x1001eef3
mov eax, dword [edx]
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x10], 0
push ecx
push 0x40
push 5
mov dword [ebp - 0x28], eax
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x1001ef69
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x24]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x1001ef80
mov eax, dword [eax + 0x1c]
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x3c], ecx
push ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x38], eax
call dword [eax + 0xc]
mov esi, dword [ebp - 0x2c]
add esp, 4
mov ecx, 6
test al, al
je 0x1001ef96
mov eax, dword [ebp - 0x30]
push dword [eax + 0x14]
push dword [eax + 0xc]
push dword [ebp - 0x28]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp - 0x1d], 0
push dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
call dword [eax + 0x10]
mov esi, dword [ebp - 0x2c]
mov ecx, 9
add esp, 4
jmp 0x1001ef96
mov eax, dword [edx + 0x18]
test eax, eax
je 0x1001ef48
mov ecx, dword [edx + 0x1c]
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x28], eax
push eax
mov dword [ebp - 0x2c], ecx
call dword [ecx + 0xc]
add esp, 4
mov ecx, 6
test al, al
je 0x1001ef5d
mov eax, dword [ebp - 0x30]
push dword [eax + 0x14]
push dword [eax + 0xc]
push dword [eax]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp - 0x1d], 0
push dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
call dword [eax + 0x10]
mov ecx, 9
add esp, 4
jmp 0x1001ef5d
push dword [edx + 0x14]
push dword [edx + 0xc]
push dword [edx]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 9
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x10], 0
jmp 0x1001efb3
mov byte [ebp - 0x1d], 0
call sub.kernel32.dll_GetLastError
mov ecx, dword [ebp - 0x34]
mov dword [ecx], 1
mov dword [ecx + 4], eax
jmp 0x1001efe6
push dword [eax + 0x14]
push dword [eax + 0xc]
push dword [ebp - 0x28]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 9
lea eax, [ebp - 0x24]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x1d], 1
push eax
push esi
push 5
push dword [ebp - 0x28]
call sub.kernel32.dll_VirtualProtect
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x1d], 1
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
push edx
push ecx
push 0x64
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x34]
movsd xmm0, qword [ebp - 0x48]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004cfc0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
xorps xmm0, xmm0
call 0x1004cfd4
pop edi
lea eax, [esp + 0x20]
mov dword [esp + 0x40], 0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
call sub.kernel32.dll_GetSystemInfo
mov esi, dword [esp + 0x24]
test esi, esi
je 0x1004d234
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov ebx, dword [ebp + 8]
mov eax, ecx
div esi
lea eax, [esi + ecx]
sub eax, edx
test edx, edx
cmove eax, ecx
mov ecx, dword [ebp + 0x14]
test eax, eax
cmove eax, esi
mov dword [esp + 0xc], eax
test ecx, ecx
je 0x1004d0ca
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
lea esi, [eax + ecx*8]
jmp 0x1004d067
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ecx, dword [ecx*4 + 0x1004d24c]
add ecx, edi
jmp ecx
mov esi, dword [esp + 0xc]
mov al, 1
xor ecx, ecx
xor edx, edx
mov dword [esp + 4], 0
test al, al
je 0x1004d11d
mov eax, 1
cmp dword [esp + 4], 1
jne 0x1004d1a5
jmp 0x1004d11d
mov dword [ebx + 4], 7
jmp 0x1004d223
test ecx, ecx
je 0x1004d1b2
mov dword [ebx + 4], 8
jmp 0x1004d223
push eax
push 0x3000
push esi
push edx
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x1004d1d2
mov dword [ebx + 4], eax
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], 1
jmp 0x1004d210
call fcn.1009fce0
mov dword [ebx + 4], 0xa
jmp 0x1004d220
xor eax, eax
jmp 0x1004d228
mov dword [ebx + 8], eax
mov eax, 1
mov dword [ebx], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x1011a6c8
push 0x39
push 0x1011a6e0
call fcn.100f9870
add esp, 0xc
ud2
Function at 0x100552a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100576c0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ebp - 0x10], 7
push ecx
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 6
add eax, 4
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 5
add eax, 8
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 4
add eax, 0xc
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 3
lea ecx, [eax + 0x10]
call fcn.10055510
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 2
add eax, 0x2c
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 1
add eax, 0x30
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0
add eax, 0x34
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 9
add eax, 0x40
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 8
add eax, 0x44
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0xffffffff
add eax, 0x48
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1005a7a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov esi, esp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], esp
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x24], 0x1005ad20
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x20]
mov edx, dword fs:[0]
mov dword [esi + 0x20], edx
mov dword fs:[0], ecx
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0
mov ebx, dword [eax + 4]
mov eax, dword [ebx]
mov edi, dword [eax + 0x38]
push dword [ebp + 0xc]
call fcn.1006b7b0
add esp, 4
mov eax, dword [eax]
mov ecx, esi
mov dword [esi + 0x10], 1
mov dword [esi + 0x28], 0
mov dword [esi + 0x14], eax
push ecx
push 0
push 4
push 0
push eax
mov dword [esi + 0xc], ebx
push ebx
call edi
test eax, eax
js 0x1005a934
mov eax, dword [ebp + 0x10]
movss xmm1, dword [0x1011ca2c]
mov ebx, dword [esi + 0xc]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
movaps xmm6, xmm1
movss xmm3, dword [ecx]
movss xmm2, dword [edi]
movss xmm4, dword [edx]
movss xmm5, dword [eax]
mov eax, dword [esi]
movaps xmm0, xmm3
subss xmm0, xmm2
divss xmm6, xmm0
movaps xmm0, xmm4
subss xmm0, xmm5
divss xmm1, xmm0
movaps xmm0, xmm3
addss xmm0, xmm2
subss xmm2, xmm3
divss xmm0, xmm2
movaps xmm2, xmm4
addss xmm2, xmm5
subss xmm5, xmm4
divss xmm2, xmm5
movss dword [eax], xmm6
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
movss dword [eax + 0x14], xmm1
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x28], 0x3f000000
mov dword [eax + 0x2c], 0
movss dword [eax + 0x30], xmm0
movss dword [eax + 0x34], xmm2
mov dword [eax + 0x38], 0x3f000000
mov dword [eax + 0x3c], 0x3f800000
mov eax, dword [ebx]
mov edi, dword [eax + 0x3c]
mov dword [esi + 0x28], 0xffffffff
push dword [ebp + 0xc]
call fcn.1006b7b0
add esp, 4
mov eax, dword [eax]
mov dword [esi], 1
mov dword [esi + 0x28], 2
mov dword [esi + 4], eax
push 0
push eax
push ebx
call edi
mov eax, dword [esi + 0x20]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.1006d520
add esp, 4
mov dword [esi], eax
mov dword [esi + 4], edx
mov dword [esi + 0x28], 1
push 0x1011cf3c
push 0x1011ca30
mov eax, esi
push eax
push 3
push 0x1011cf38
call fcn.100f9a60
add esp, 0x14
ud2
Function at 0x1005c480
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x1005d210
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ebp - 0x10], 7
push ecx
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 6
add eax, 4
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 5
add eax, 8
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 4
add eax, 0xc
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 3
lea ecx, [eax + 0x10]
call fcn.1005c6f0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 2
add eax, 0x2c
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 1
add eax, 0x30
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0
add eax, 0x34
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 9
add eax, 0x40
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 8
add eax, 0x44
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0xffffffff
add eax, 0x48
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10060160
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10063ad0
mov ecx, dword fs:[0]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x10], 1
push dword [ebp + 0xc]
call fcn.1006b4e0
add esp, 4
or byte [eax + 4], 8
push 1
push 0x10
call fcn.1001d510
add esp, 8
test eax, eax
je 0x1006033a
movsd xmm0, qword [0x1011d780]
movsd xmm1, qword [str.imgui_dx12_0.2.0]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x10
mov dword [ebp - 0x28], 0x10
movsd qword [eax + 8], xmm0
movsd qword [eax], xmm1
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0xc]
call fcn.1005d400
add esp, 8
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x1006025a
mov ecx, 0x10
mov eax, esi
mul ecx
jo 0x10060348
mov edi, eax
test eax, eax
js 0x1006034f
push 4
push edi
call fcn.1001d510
add esp, 8
test eax, eax
je 0x10060356
mov ecx, esi
mov edx, eax
nop dword [eax]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0x2710
mov dword [edx + 0xc], 0x1388
add edx, 0x10
dec ecx
jne 0x10060230
mov dword [ebp - 0x10], 0
jmp 0x1006025f
mov eax, 4
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp + 0x20]
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x10], 0
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], esi
mov dword [edx + 0x20], esi
mov eax, dword [ebp + 0x24]
mov esi, dword [ebp + 0x18]
mov dword [edx + 8], ecx
mov dword [edx + 0xc], esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [edx + 0x10], edi
mov dword [edx + 4], eax
lea eax, [ebp + 0x1c]
mov dword [edx], esi
mov dword [edx + 0x14], 0
mov dword [edx + 0x28], 0
mov dword [edx + 0x24], 0
mov dword [edx + 0x30], 0
mov dword [edx + 0x2c], 0
mov dword [edx + 0x38], 0
mov dword [edx + 0x34], 0
mov dword [edx + 0x40], 0
mov dword [edx + 0x3c], 0
mov dword [edx + 0x48], 0
mov dword [edx + 0x44], 0
mov dword [edx + 0x50], 0
mov dword [edx + 0x4c], 0
mov dword [edx + 0x58], 0
mov dword [edx + 0x54], 0
mov dword [edx + 0x60], 0
mov dword [edx + 0x5c], 0
mov dword [edx + 0x68], 0
mov dword [edx + 0x64], 0
push eax
call fcn.10047c70
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
push 1
push 0x10
call fcn.100f97e0
add esp, 8
jmp 0x10060361
call fcn.100aabe0
jmp 0x10060361
call fcn.100aabe0
jmp 0x10060361
push 4
push edi
call fcn.100f97e0
add esp, 8
ud2
Function at 0x1006a350
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
xorps xmm0, xmm0
call 0x1006a364
pop edi
lea eax, [esp + 0x20]
mov dword [esp + 0x40], 0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
call sub.kernel32.dll_GetSystemInfo
mov esi, dword [esp + 0x24]
test esi, esi
je 0x1006a5c4
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov ebx, dword [ebp + 8]
mov eax, ecx
div esi
lea eax, [esi + ecx]
sub eax, edx
test edx, edx
cmove eax, ecx
mov ecx, dword [ebp + 0x14]
test eax, eax
cmove eax, esi
mov dword [esp + 0xc], eax
test ecx, ecx
je 0x1006a45a
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esp + 8], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
lea esi, [eax + ecx*8]
jmp 0x1006a3f7
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov ecx, dword [ecx*4 + 0x1006a5dc]
add ecx, edi
jmp ecx
mov esi, dword [esp + 0xc]
mov al, 1
xor ecx, ecx
xor edx, edx
mov dword [esp + 4], 0
test al, al
je 0x1006a4ad
mov eax, 1
cmp dword [esp + 4], 1
jne 0x1006a535
jmp 0x1006a4ad
mov dword [ebx + 4], 7
jmp 0x1006a5b3
test ecx, ecx
je 0x1006a542
mov dword [ebx + 4], 8
jmp 0x1006a5b3
push eax
push 0x3000
push esi
push edx
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x1006a562
mov dword [ebx + 4], eax
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], 1
jmp 0x1006a5a0
call fcn.1009fce0
mov dword [ebx + 4], 0xa
jmp 0x1006a5b0
xor eax, eax
jmp 0x1006a5b8
mov dword [ebx + 8], eax
mov eax, 1
mov dword [ebx], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10123ab0
push 0x39
push str.attempt_to_calculate_the_remainder_with_a_divisor_of_zeroVirtualFree_failed:__n
call fcn.100f9870
add esp, 0xc
ud2
Function at 0x1006be70
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x1006be8a
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
ja 0x1006be9f
jmp 0x1006beab
push edi
call fcn.1009c440
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jbe 0x1006beab
cmp byte [eax + 4], 0
mov esi, eax
jne 0x1006bf32
mov eax, dword [edi]
test eax, eax
je 0x1006bf0d
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x1006bf22
mov esi, eax
test eax, eax
jne 0x1006bef2
push 4
push 8
call fcn.1001d510
add esp, 8
test eax, eax
je 0x1006bf3a
mov byte [eax + 4], 0
mov dword [eax], edi
mov esi, eax
mov eax, dword [edi]
test eax, eax
jne 0x1006beea
push edi
call fcn.1009c440
add esp, 4
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x1006bf29
movzx eax, word [ecx]
mov byte [ecx], 0
mov edx, eax
shr edx, 8
and eax, 1
cmovne eax, edx
jmp 0x1006bf2b
push edi
call fcn.1009c440
add esp, 4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
jne 0x1006bebd
xor esi, esi
mov eax, esi
pop esi
pop edi
ret
xor eax, eax
mov byte [esi + 4], 1
mov byte [esi + 5], al
add esi, 5
mov eax, esi
pop esi
pop edi
ret
push 4
push 8
call fcn.100f97e0
add esp, 8
ud2