joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002bc0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a6432
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], 0
mov dword [edi], 0x100c68ac
mov dword [ebp - 0x14], edi
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [edi]
lea esi, [edi + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [eax + 4]
push esi
add ecx, edi
call fcn.10003ba0
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.10004720
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x4c], 0
mov byte [esi + 0x45], 0
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x100dcee8]
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], 0
mov eax, dword [ebp + 0xc]
push ecx
or eax, 1
push eax
push dword [ebp + 8]
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.10003e20
test eax, eax
jne 0x10002d15
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 0xc]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x10002d0d
or eax, 4
push 0
push eax
call fcn.100017b0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10002d30
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a6432
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], 0
mov dword [edi], 0x100c68ac
mov dword [ebp - 0x14], edi
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [edi]
lea esi, [edi + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ecx, dword [eax + 4]
push esi
add ecx, edi
call fcn.10003ba0
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.10004720
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x4c], 0
mov byte [esi + 0x45], 0
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x100dcee8]
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], 0
sub esp, 8
mov ecx, esi
push dword [ebp + 8]
mov byte [ebp - 4], 3
call fcn.10003ed0
test eax, eax
jne 0x10002e80
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 0xc]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x10002e78
or eax, 4
push 0
push eax
call fcn.100017b0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100036f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a6472
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], 0
mov dword [edi], 0x100c6854
mov dword [ebp - 0x14], edi
mov dword [edi + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [edi]
lea esi, [edi + 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov dword [edi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
push esi
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.10003ba0
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.10004720
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x4c], 0
mov byte [esi + 0x45], 0
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x100dcee8]
mov dword [esi + 0x50], 0
mov dword [esi + 0x48], eax
mov dword [esi + 0x40], 0
push ecx
push 0x22
push dword [ebp + 8]
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.10003e20
test eax, eax
jne 0x10003832
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + edi + 0xc]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x38], 0
jne 0x1000382a
or eax, 4
push 0
push eax
call fcn.100017b0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100040d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a7878
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0x40], 0
push edi
je 0x10004224
cmp byte [ebx + 0x45], 0
je 0x10004224
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10004127
xor al, al
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [esp + 0x10], 0
xorps xmm0, xmm0
movq qword [esp + 0x10], xmm0
lea eax, [esp + 0x10]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], 8
mov byte [eax + 8], 0
mov dword [esp + 0x34], 0
mov edi, edi
cmp dword [esp + 0x24], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0xc]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x24]
lea edi, [esp + 0x14]
cmovae edi, dword [esp + 0x14]
lea esi, [esp + 0x14]
cmovae esi, dword [esp + 0x14]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100041a1
dec eax
je 0x100041a5
sub eax, 2
je 0x100041fb
xor bl, bl
jmp 0x100041fd
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
cmp ecx, 0x10
lea eax, [esp + 0x10]
cmovae eax, edx
sub esi, eax
je 0x100041dc
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x18]
cmovae eax, edx
push 1
push eax
call fcn.1008689d
add esp, 0x10
cmp esi, eax
jne 0x1000419d
cmp byte [ebx + 0x45], 0
je 0x100041fb
test esi, esi
jne 0x10004160
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.10003a50
jmp 0x10004160
mov bl, 1
cmp dword [esp + 0x24], 0x10
jb 0x10004210
push dword [esp + 0x10]
call fcn.100852d7
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a360
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a6a9f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
lea esi, [ecx + 0xc]
mov dword [ebp - 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
lea edi, [ecx + 0x18]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea ebx, [ecx + 0x24]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov byte [ebp - 4], 5
push dword [ebp + 8]
mov eax, dword [ebp + 8]
push dword [eax + 4]
push dword [eax]
push dword [ecx + 4]
call fcn.10024500
push dword [ebp + 8]
mov eax, dword [ebp + 8]
mov ecx, esi
push dword [eax + 0x10]
push dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
push dword [eax + 0x10]
call fcn.10024500
push dword [ebp + 8]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push dword [esi + 0x1c]
mov ecx, edi
push dword [esi + 0x18]
push dword [eax + 0x1c]
call fcn.10024500
push dword [ebp + 8]
mov edi, dword [ebp - 0x10]
push dword [esi + 0x28]
mov ecx, ebx
push dword [esi + 0x24]
push dword [edi + 0x28]
call fcn.100246f0
push dword [ebp + 8]
lea ecx, [edi + 0x30]
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [edi + 0x34]
call fcn.100246f0
push dword [ebp + 8]
lea ecx, [edi + 0x3c]
push dword [esi + 0x40]
push dword [esi + 0x3c]
push dword [edi + 0x40]
call fcn.100246f0
mov eax, dword [esi + 0x48]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x48], eax
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1000fcc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [esp + 0xc], ebx
test esi, esi
je 0x1000fe04
mov eax, esi
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000fce1
sub eax, edi
sar eax, 1
je 0x1000fe04
push esi
call fcn.10086e18
add esp, 4
mov ecx, str.aWJBB3tdWAcMV01DUSRFQUwLWkE
mov esi, eax
call fcn.10045550
sub esp, 0x18
mov ecx, esp
push eax
call fcn.100020e0
mov ecx, 3
call fcn.1002bd20
push 0x14
call fcn.10085dc2
add esp, 0x1c
mov dword [esp + 0x14], eax
dec esi
jne 0x1000fdf7
cmp byte [0x100dd156], 0
jne 0x1000fe04
push esi
push dword [ebp + 0xc]
mov byte [0x100dd156], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, eax
lea eax, [esp + 0x38]
push eax
push edi
mov dword [esp + 0x18], edi
call ebx
mov esi, dword [esp + 0x40]
sub esi, dword [esp + 0x38]
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x10]
call ebx
push 2
lea eax, [esp + 0x2c]
push eax
push edi
mov edi, dword [sym.imp.USER32.dll_MapWindowPoints]
push 0
call edi
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov ebx, dword [sym.imp.USER32.dll_MoveWindow]
push 1
sub eax, ecx
push eax
push 0x8c
push ecx
lea eax, [esi - 0xa0]
push eax
push dword [esp + 0x20]
call ebx
mov esi, dword [ebp + 8]
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x18]
push 0
call edi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
push 1
sub eax, ecx
push eax
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
push eax
push ecx
push 0x14
push esi
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1000fe04
push eax
call fcn.10085c14
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a7b8b
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
mov edi, ecx
mov ecx, str.aWdAB3pTVQopWVZadhNEQVcK
call fcn.10045550
sub esp, 0x18
mov edx, esp
mov esi, eax
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [esi], 0
jne 0x1001115e
xor ecx, ecx
jmp 0x1001116c
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10011163
sub ecx, ebx
push ecx
push esi
mov ecx, edx
call fcn.10004460
mov ecx, 2
call fcn.1002bd20
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
add esp, 0x18
push 0
push edi
call ebx
mov ecx, dword [0x100dd158]
test ecx, ecx
je 0x100111a7
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [0x100dd158], 0
push 0x42
call dword [sym.imp.USER32.dll_IsCharUpperA]
push edi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x28]
push ecx
push eax
mov dword [esp + 0x18], eax
call esi
lea eax, [esp + 0x18]
push eax
push edi
call esi
mov esi, dword [esp + 0x10]
push 2
lea eax, [esp + 0x1c]
push eax
push esi
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0
push 0
push 0x31
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x10
mov dword [esp + 0x14], eax
call fcn.10086a49
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x44], 0
test eax, eax
je 0x1001123b
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push edi
push dword [esp + 0x14]
sub ecx, edx
push ecx
mov ecx, dword [esp + 0x24]
sub eax, ecx
sub eax, 0x1e
push eax
push edx
push ecx
mov ecx, dword [esp + 0x2c]
push esi
call fcn.10004d80
jmp 0x1001123d
xor eax, eax
push 0
push dword [eax + 4]
mov dword [0x100dd158], eax
call ebx
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018750
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a76fb
push eax
mov dword fs:[0], esp
sub esp, 0xa4
mov ecx, str.aWVSC0x7WwAL
push esi
push edi
call fcn.10045550
sub esp, 0x18
mov edx, esp
mov esi, eax
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [esi], 0
jne 0x1001879e
xor ecx, ecx
jmp 0x100187ac
mov ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100187a3
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.10004460
mov ecx, 3
call fcn.1002bd20
add esp, 0x18
push dword [0x100dd460]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100daeb4], eax
test eax, eax
je 0x10018877
cmp eax, 0xffffffff
je 0x10018877
push 0x927c0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
call fcn.100114d0
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 8
lea ecx, [esp + 0x18]
call fcn.100059e0
push esi
push ecx
mov ecx, str.aWVSC0x7WwALEH1JXRIQ
mov dword [esp + 0xbc], 0
call fcn.10045550
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.10007e30
add esp, 4
mov ecx, eax
call fcn.100054d0
sub esp, 0x18
lea ecx, [esp + 0x28]
push esp
call fcn.10005aa0
mov ecx, 3
call fcn.1002bd20
add esp, 0x18
lea ecx, [esp + 0x10]
call fcn.10005000
xor eax, eax
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, str.aWVSC0x7WwALEH1JXRIQGBgCVVtVAAcURgkZAktdVxVTEl4XTFdO
call fcn.10045550
sub esp, 0x18
mov edx, esp
mov esi, eax
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [esi], 0
jne 0x100188a2
xor ecx, ecx
jmp 0x100188b0
mov ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100188a7
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.10004460
mov ecx, 3
call fcn.1002bd20
mov ecx, dword [esp + 0xc4]
add esp, 0x18
mov eax, 0xfffffffe
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001e910
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a76fb
push eax
mov dword fs:[0], esp
sub esp, 0xa4
mov ecx, str.aX5cAVN7WwAL
push esi
push edi
call fcn.10045550
sub esp, 0x18
mov edx, esp
mov esi, eax
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [esi], 0
jne 0x1001e95e
xor ecx, ecx
jmp 0x1001e96c
mov ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e963
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.10004460
mov ecx, 3
call fcn.1002bd20
add esp, 0x18
push dword [0x100dd460]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100daeb4], eax
test eax, eax
je 0x1001ea23
cmp eax, 0xffffffff
je 0x1001ea23
push 0x927c0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.100059e0
push esi
push ecx
mov ecx, str.aX5cAVN7WwALEH1JXRIQ
mov dword [esp + 0xbc], 0
call fcn.10045550
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.10007e30
add esp, 4
mov ecx, eax
call fcn.100054d0
sub esp, 0x18
lea ecx, [esp + 0x28]
push esp
call fcn.10005aa0
mov ecx, 3
call fcn.1002bd20
add esp, 0x18
lea ecx, [esp + 0x10]
call fcn.10005000
xor eax, eax
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, str.aX5cAVN7WwALEH1JXRIQGBgCVVtVAAcURgkZAktdVxVTEl4XTFdO
call fcn.10045550
sub esp, 0x18
mov edx, esp
mov esi, eax
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [esi], 0
jne 0x1001ea4e
xor ecx, ecx
jmp 0x1001ea5c
mov ecx, esi
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001ea53
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.10004460
mov ecx, 3
call fcn.1002bd20
mov ecx, dword [esp + 0xc4]
add esp, 0x18
mov eax, 0xfffffffe
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10022a80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a6a07
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], 0
mov dword [edi], 0x100c6854
mov dword [ebp - 0x14], edi
mov dword [edi + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov eax, dword [edi]
lea esi, [edi + 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], 1
mov dword [edi + eax], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push ecx
lea eax, [ecx - 8]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
push esi
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.10003ba0
mov dword [ebp - 4], 2
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ecx + edi - 4], eax
mov ecx, esi
call fcn.10004720
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x4c], 0
mov byte [esi + 0x45], 0
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [0x100dcee8]
mov dword [esi + 0x48], eax
mov eax, edi
mov dword [esi + 0x50], 0
mov dword [esi + 0x40], 0
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10025ba0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ecx, str.f1xAFlleWgQXZ1FfUAlHDwI3XF1OMgpaVglO
call fcn.10045550
sub esp, 0x18
mov edx, esp
mov esi, eax
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [esi], 0
jne 0x10025bd4
xor eax, eax
jmp 0x10025be0
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10025bd7
sub eax, ebx
push eax
push esi
mov ecx, edx
call fcn.10004460
mov ecx, 2
call fcn.1002bd20
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
add esp, 0x18
push 1
push dword [edi + 8]
call esi
push dword [edi + 8]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 0
push dword [edi + 0x38]
call esi
push dword [edi + 8]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10027f00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [0x100dd364]
mov ecx, str.el1SBlFcUTYMXlxeQ1wKfVEAUWVQCwdbRQ
call fcn.10045550
sub esp, 0x18
mov edx, esp
mov esi, eax
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [esi], 0
jne 0x10027f38
xor ecx, ecx
jmp 0x10027f49
mov ecx, esi
lea ebx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10027f40
sub ecx, ebx
push ecx
push esi
mov ecx, edx
call fcn.10004460
mov ecx, 2
call fcn.1002bd20
add esp, 0x18
push dword [edi + 4]
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetParent]
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret