joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004ddd0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b1c38
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], 0
mov byte [esp + 0x50], 0
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
mov byte [esp + 0x78], 2
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0xbc]
mov edi, eax
lea ecx, [esp + 0x20]
lea eax, [edi + 0x3888]
cmp ecx, eax
je 0x1004de79
push 0xffffffffffffffff
push 0
push eax
call fcn.10003660
lea eax, [edi + 0x38a0]
lea ecx, [esp + 0x50]
cmp ecx, eax
je 0x1004de91
push 0xffffffffffffffff
push 0
push eax
call fcn.10003660
lea eax, [edi + 0x38b8]
lea ecx, [esp + 0x38]
cmp ecx, eax
je 0x1004dea9
push 0xffffffffffffffff
push 0
push eax
call fcn.10003660
cmp dword [esp + 0x34], 0x10
lea eax, [esp + 0x20]
mov edi, dword [sym.imp.MSVCR120.dll__strnicmp]
cmovae eax, dword [esp + 0x20]
push 4
push str.ATI
push eax
call edi
add esp, 0xc
test eax, eax
je 0x1004def1
cmp dword [esp + 0x34], 0x10
lea eax, [esp + 0x20]
push 4
cmovae eax, dword [esp + 0x24]
push str.AMD
push eax
call edi
add esp, 0xc
test eax, eax
je 0x1004def1
xor eax, eax
jmp 0x1004def6
mov eax, 1
mov byte [esi + 0x1098], al
mov ecx, esi
mov eax, dword [esi]
mov dword [esi + 0x109c], 0
call dword [eax + 8]
lea eax, [esp + 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
cmp byte [esi + 0x1098], 0
push dword [esi + 0xec8]
mov edx, dword [ecx]
je 0x1004df38
inc eax
push eax
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
push eax
push 0
push 0
call dword [edx]
cmp dword [esp + 0x4c], 0x10
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x1004df5e
push dword [esp + 0x38]
call esi
add esp, 4
cmp dword [esp + 0x64], 0x10
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
jb 0x1004df83
push dword [esp + 0x50]
call esi
add esp, 4
cmp dword [esp + 0x34], 0x10
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], 0
mov byte [esp + 0x50], 0
jb 0x1004dfa8
push dword [esp + 0x20]
call esi
add esp, 4
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.100ab974
mov esp, ebp
pop ebp
ret

Function at 0x1004dfe0
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x1004fd80
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
mov eax, dword [edi + 0x9c]
mov byte [edi + 0xa8], 1
cmp eax, 0xffffffff
je 0x1004fda2
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push ebx
push esi
lea eax, [edi + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0xa0]
lea ebx, [edi + 0xa0]
mov esi, dword [eax]
cmp esi, eax
je 0x1004fe36
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0x80
push 0xffff
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_closesocket]
cmp byte [esi + 0xd], 0
jne 0x1004fe32
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x1004fe11
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x1004fe32
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x1004fe05
jmp 0x1004fe32
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x1004fe30
lea ebx, [ebx]
cmp esi, dword [eax + 8]
jne 0x1004fe30
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x1004fe20
mov esi, eax
cmp esi, dword [ebx]
jne 0x1004fdc3
lea esi, [edi + 0xac]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [edi + 8]
test eax, eax
je 0x1004fe56
push 0xc8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebx]
mov ecx, ebx
push eax
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.10050bb0
push dword [ebx]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
mov eax, dword [edi + 8]
add esp, 4
mov dword [edi], vtable.TThread_class_CTcpProxy_.0
pop esi
pop ebx
test eax, eax
je 0x1004fe8e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10050670
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0
push 1
push 2
mov dword [ebp - 0x230], esi
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x100507f0
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x100507e9
test eax, eax
je 0x100507e9
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 1
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 4
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 1
push eax
push 1
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
push 0xfc
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x124], 1
push 0
push eax
mov dword [ebp - 0x120], edi
call sub.MSVCR120.dll_memset
push 0xfc
lea eax, [ebp - 0x224]
mov dword [ebp - 0x22c], 1
push 0
push eax
mov dword [ebp - 0x228], edi
call sub.MSVCR120.dll_memset
add esp, 0x18
xor esi, esi
cmp byte [ebx + 0xa8], 0
jne 0x100507ce
cmp esi, 0xa
jge 0x100507ce
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0
push eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x23c], 0x186a0
push eax
lea eax, [ebp - 0x124]
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x100507ce
cmp dword [ebp - 0x124], 0
ja 0x10050806
cmp dword [ebp - 0x22c], 0
ja 0x100507ce
inc esi
cmp byte [ebx + 0xa8], 0
je 0x10050775
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
push dword [ebp - 0x230]
push str.connnect__s:_d_failed_n
call dword [sym.imp.MSVCR120.dll_printf]
add esp, 0xc
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100ab974
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x124]
push eax
push edi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
setne al
test al, al
je 0x100507ce
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
push dword [ebp - 0x230]
push str.connnect__s:_d_success_n
call dword [sym.imp.MSVCR120.dll_printf]
mov ecx, dword [ebp - 8]
add esp, 0xc
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100ab974
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10053b70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.10053a20
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.MSVCR120.dll_fseek]
push 0
push 0
push edi
call ebx
push edi
call dword [sym.imp.MSVCR120.dll_fgetc]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10053bc3
push edi
call dword [sym.imp.MSVCR120.dll_ferror]
add esp, 4
test eax, eax
je 0x10053bc3
push 0
push 0
push 5
push esi
call fcn.10053c40
mov eax, dword [esi + 0x38]
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 2
push 0
push edi
call ebx
push edi
call dword [sym.imp.MSVCR120.dll_ftell]
push 0
push 0
push edi
mov ebx, eax
call dword [sym.imp.MSVCR120.dll_fseek]
add esp, 0x1c
cmp ebx, 0xffffffff
je 0x10053baa
cmp ebx, 0xffffffff
jae 0x10053baa
test ebx, ebx
jne 0x10053c06
push ebx
push ebx
push 0xd
push esi
call fcn.10053c40
mov eax, dword [esi + 0x38]
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 4
lea eax, [ebx + 1]
push eax
call fcn.100ab8c2
push edi
push ebx
push 1
push eax
mov dword [esi + 0x50], eax
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x14
cmp eax, ebx
jne 0x10053baa
mov eax, dword [esi + 0x50]
mov ecx, esi
mov byte [ebx + eax], 0
call fcn.10053d20
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10056a20
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov bl, cl
mov bh, dl
push 0
movzx esi, bl
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
add esi, 0xffffffdf
movzx edi, ax
cmp esi, 0x6f
ja case.0x10056a4b.41
movzx eax, byte [esi + 0x10056aac]
jmp dword [eax*4 + 0x10056aa4]
or edi, 0x100
xorps xmm0, xmm0
movzx eax, bl
movdqu xmmword [ebp - 0x1c], xmm0
mov word [ebp - 0x18], ax
xor ecx, ecx
test bh, bh
movq qword [ebp - 0xc], xmm0
mov eax, 2
mov dword [ebp - 4], 0
cmovne eax, ecx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push 1
mov word [ebp - 0x16], di
call dword [sym.imp.USER32.dll_SendInput]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10076d10
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100acf78
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
lea eax, [eax*2 + 2]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x14], 8
mov edx, eax
mov eax, dword [esi + 0x10]
jb 0x10076d77
mov ecx, dword [esi]
jmp 0x10076d79
mov ecx, esi
test eax, eax
je 0x10076d8a
add eax, eax
push eax
push ecx
push edx
call sub.MSVCR120.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [edi + 0x3dd0]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [edi + 0x464c]
cmp ecx, esi
je 0x10076dc9
push 0xffffffffffffffff
push 0
push esi
call fcn.10004ff0
lea eax, [esp + 0x10]
push esi
push eax
call fcn.1009b240
add esp, 8
mov dword [esp + 0x38], 0
lea eax, [esp + 0x10]
cmp dword [esp + 0x24], 0x10
lea ecx, [edi - 4]
cmovae eax, dword [esp + 0x10]
push eax
push str.app_copy_clipboard
call fcn.1007abb0
cmp dword [esp + 0x24], 0x10
jb 0x10076e0f
push dword [esp + 0x10]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.100ab974
mov esp, ebp
pop ebp
ret 4
Function at 0x10078dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x100b3650
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
sub esp, 0x18
lea edi, [esi - 4]
mov eax, esp
mov dword [eax], vtable.._AV___Func_impl_U___Callable_obj_V_lambda_8bd808d2f6a05fe2d92a87ada12b34dc____0A__std__V__allocator_V___Func_class_X___V_std___2_X___V_std__.0
mov dword [eax + 4], edi
mov dword [eax + 0x10], eax
mov dword [esp + 0x78], 0xffffffff
call fcn.10005c50
mov eax, dword [esi + 0x3de4]
movdqu xmm0, xmmword [str.0900006000]
mov dword [esp + 0x28], eax
mov eax, dword [0x100bbccc]
mov dword [esp + 0x4c], eax
mov ax, word [0x100bbcd0]
mov word [esp + 0x50], ax
xor eax, eax
push 0xa
movdqu xmmword [esp + 0x40], xmm0
push eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x3c], 0x6e
call dword [sym.imp.MSVCR120.dll_wcstoul]
add esp, 0x24
cmp eax, 5
ja 0x10078e82
xor eax, eax
jmp 0x10078e85
sub eax, 4
shl eax, 0x18
or eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
lea eax, [esi + 0x4260]
push eax
mov dword [esp + 0x24], 2
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x60], 1
mov eax, dword [esi + 0x4258]
mov esi, dword [eax]
cmp esi, eax
je 0x10078f23
lea ecx, [ecx]
push 0xc
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
push dword [esi + 0x10]
call fcn.1007de30
cmp byte [esi + 0xd], 0
jne 0x10078f17
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x10078efc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x10078f17
lea ebx, [ebx]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x10078ef0
jmp 0x10078f17
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x10078f15
cmp esi, dword [eax + 8]
jne 0x10078f15
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x10078f05
mov esi, eax
mov eax, dword [esp + 0x14]
cmp esi, dword [eax + 0x4258]
jne 0x10078ec0
mov eax, dword [esp + 0x14]
add eax, 0x4260
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.100ab974
mov esp, ebp
pop ebp
ret
Function at 0x100791a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x100b3650
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
sub esp, 0x18
lea edi, [esi - 4]
mov eax, esp
mov dword [eax], vtable.._AV___Func_impl_U___Callable_obj_V_lambda_cd1742751e33b5627f28dfe6033ee00d____0A__std__V__allocator_V___Func_class_X___V_std___2_X___V_std__.0
mov dword [eax + 4], edi
mov dword [eax + 0x10], eax
mov dword [esp + 0x78], 0xffffffff
call fcn.10005c50
mov eax, dword [esi + 0x3de4]
movdqu xmm0, xmmword [str.0900006000]
mov dword [esp + 0x28], eax
mov eax, dword [0x100bbccc]
mov dword [esp + 0x4c], eax
mov ax, word [0x100bbcd0]
mov word [esp + 0x50], ax
xor eax, eax
push 0xa
movdqu xmmword [esp + 0x40], xmm0
push eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x3c], 0x6e
call dword [sym.imp.MSVCR120.dll_wcstoul]
add esp, 0x24
cmp eax, 5
ja 0x10079252
xor eax, eax
jmp 0x10079255
sub eax, 4
shl eax, 0x18
or eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
lea eax, [esi + 0x4260]
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x60], 1
mov eax, dword [esi + 0x4258]
mov esi, dword [eax]
cmp esi, eax
je 0x100792f3
lea ecx, [ecx]
push 0xc
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
push dword [esi + 0x10]
call fcn.1007de30
cmp byte [esi + 0xd], 0
jne 0x100792e7
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100792cc
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100792e7
lea ebx, [ebx]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100792c0
jmp 0x100792e7
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100792e5
cmp esi, dword [eax + 8]
jne 0x100792e5
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100792d5
mov esi, eax
mov eax, dword [esp + 0x14]
cmp esi, dword [eax + 0x4258]
jne 0x10079290
mov eax, dword [esp + 0x14]
add eax, 0x4260
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.100ab974
mov esp, ebp
pop ebp
ret
Function at 0x100796d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b3708
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x430c]
call fcn.10095e30
xor eax, eax
mov byte [esi + 0x3ddc], 1
push eax
push 0x100bc324
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
call fcn.10005210
mov dword [esp + 0x38], 0
lea edx, [esp + 0x10]
mov ecx, dword [esi + 0x3dd8]
push edx
push 0x64
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x24], 8
jb 0x10079779
push dword [esp + 0x10]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esi + 0x3dd8]
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [esi + 0x4318]
call fcn.10043300
push 0
push 0x100bc324
lea ecx, [esi + 0x4650]
call fcn.10005210
cmp dword [esi + 0x42f8], 0
jne 0x100797be
lea ecx, [esi + 0x42e8]
cmp ecx, edi
je 0x100797be
push 0xffffffffffffffff
push 0
push edi
call fcn.10003660
call fcn.1009be30
test al, al
je 0x100797e5
push 0x100
push esi
push 0x10079600
push 0xa
push 0x1194
call dword [sym.imp.WINMM.dll_timeSetEvent]
mov dword [esi + 0x42e4], eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100ab974
mov esp, ebp
pop ebp
ret 4
Function at 0x1007a4a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x100b3568
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov dword [esp + 0x10], ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
lea eax, [edi + 0xc]
push eax
mov dword [esp + 0x24], eax
call fcn.100ab8c2
mov esi, eax
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], esi
mov dword [esi], 0x6a
mov eax, dword [eax + 0x3de4]
movdqu xmm0, xmmword [str.0900006000]
mov ecx, dword [0x100bbccc]
mov dword [esp + 0x14], eax
xor eax, eax
push 0xa
movdqu xmmword [esp + 0x28], xmm0
push eax
mov word [esp + 0x30], ax
lea eax, [esp + 0x2c]
mov dword [esp + 0x3c], ecx
mov cx, word [0x100bbcd0]
push eax
mov word [esp + 0x44], cx
call dword [sym.imp.MSVCR120.dll_wcstoul]
add esp, 0xc
cmp eax, 5
ja 0x1007a553
xor eax, eax
jmp 0x1007a556
sub eax, 4
shl eax, 0x18
or eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
push edi
push dword [esp + 0x1c]
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
push eax
call sub.MSVCR120.dll_memcpy
mov edi, dword [esp + 0x1c]
add esp, 0xc
add edi, 0x4240
mov dword [esp + 0x14], edi
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x60], 0
mov eax, dword [ecx + 0x4238]
mov esi, dword [eax]
cmp esi, eax
je 0x1007a616
mov edi, dword [esp + 0x1c]
lea eax, [ecx - 4]
mov dword [esp + 0x18], eax
nop
push dword [esp + 0x20]
mov ecx, eax
push edi
push dword [esi + 0x10]
call fcn.1007de30
cmp byte [esi + 0xd], 0
jne 0x1007a602
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x1007a5e4
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x1007a602
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x1007a5d8
jmp 0x1007a602
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x1007a600
lea ecx, [ecx]
cmp esi, dword [eax + 8]
jne 0x1007a600
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x1007a5f0
mov esi, eax
mov eax, dword [esp + 0x10]
cmp esi, dword [eax + 0x4238]
mov eax, dword [esp + 0x18]
jne 0x1007a5b0
mov edi, dword [esp + 0x14]
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.100ab974
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1007b670
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100eb380
push eax
call fcn.100a4960
cmp dword [eax + 0x14], 8
jb 0x1007b698
mov eax, dword [eax]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmp dword [ebp - 8], 8
mov esi, eax
jb 0x1007b6b7
push dword [ebp - 0x1c]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
test esi, esi
jne 0x1007b6d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1007b6d7
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab974
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100ab974
mov esp, ebp
pop ebp
ret