joyce8/EMBER2024-capa huggingface dataset:
Function at 0x218de09
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, bx
bswap eax
mov ax, 0x22ef
setae bh
jmp 0x218de2d
mov bx, cx
cmc
lea ebp, [ebx*4]
setge ah
rdtsc
lea edi, [eax + ebp]
jmp 0x218ddda
pop bp
shl ebx, cl
push dword [esp + 7]
add esp, 0x25
cld
jmp 0x218ddf0
lea edx, reloc.kernel32.dll_DeleteCriticalSection
sub esp, 0x1f
push edi
btc bp, si
jmp 0x218de57
lea eax, reloc.kernel32.dll_DeleteCriticalSection
xchg dx, cx
neg bp
push eax
mov edi, edx
xchg dx, cx
jmp 0x218de17
xchg dword [esp + 0x1a], ecx
bswap ebx
mov esi, dword [esp + 0x11]
lea esp, [esp + 0x1d]
jmp 0x218de6f
mov ebp, dword [esp + 6]
mov dword [esp + 0x20], eax
xchg word [esp + 0x1d], cx
bts eax, eax
cpuid
xchg dword [esp + 0xf], ecx
jmp 0x218de41
setge ah
xchg word [esp + 3], si
rdtsc
mov eax, dword [esp + 4]
not esi

Function at 0x218e1fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt edx, ebx
lea esp, [esp + 0x34]
lea esp, [esp]
mov bx, cx
setle ah
jmp 0x218e215
rdtsc
pushal
jmp 0x218e1e4
sub esp, 0
xchg bx, dx
mov dword [esp], esp
lea esp, [esp + 3]
and edi, eax
jmp 0x218e227
cmp dx, ax
mov ebx, dword [esp]
mov cx, word [esp]
add esp, 0
push edi
bswap edi
jmp 0x218e1ff
lea edi, [edx + edi]
mov ax, word [esp + 1]
mov ch, ah
xchg word [esp], dx
bts ebx, edi
std
jmp 0x218e273
mov eax, 0x6bf6b7c7
xchg dl, bh
mov di, 0x2e51

Function at 0x218e49c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov esi, 0x63e38ff6
xchg ch, dh
jmp 0x218e4a9
bsr ebx, edi
mov bh, 0xae
pop word [esp + 2]
mov ax, 0x2439
xchg esi, ebx
rdtsc
jmp 0x218e4da

Function at 0x218e7fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.0218e910
je fcn.0218e7fb
imul ecx, dword [eax], reloc.kernel32.dll_DeleteCriticalSection
dec eax
das
fidiv dword [ecx]
mov ebx, 0xef9c0d92
Function at 0x1000aaf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x10063768
call fcn.10009f90
add esp, 0xc
push 0x10063768
push 1
call fcn.10015640
mov ebx, 0xc8cf88
push 0xfffffffffffffff0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0xc00000
jne 0x1000ab81
push 0
push 0xf020
push 0x112
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x10063768
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop ebp
ret
push 0x41010
push str.CLEO_error
push 0x10063768
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
pop ebp
ret

Function at 0x1000bab0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1003c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
cmp byte [eax], 0
jne 0x1000bbd3
push ebx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
mov ecx, dword [esi + 0x3c]
add ecx, esi
movzx ebx, word [ecx + 0x14]
movzx eax, word [ecx + 6]
add ebx, 0x18
add ebx, ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1000bbcb
push edi
nop dword [eax + eax]
mov ecx, str..text
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1000bb27
test dl, dl
je 0x1000bb23
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1000bb27
add eax, 2
add ecx, 2
test dl, dl
jne 0x1000bb07
xor eax, eax
jmp 0x1000bb2c
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000bb60
mov eax, 0x1003418c
mov ecx, ebx
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1000bb57
test dl, dl
je 0x1000bb53
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1000bb57
add ecx, 2
add eax, 2
test dl, dl
jne 0x1000bb37
xor eax, eax
jmp 0x1000bb5c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000bbb8
mov edi, dword [ebx + 8]
add edi, 0xfff
and edi, 0xfffff000
push edi
push dword [ebx + 0xc]
push ebx
push str.Unprotecting_memory_region__s:_0x_08X__size:_0x_08X_
push 3
call fcn.1000aac0
mov eax, dword [ebx + 0x24]
lea ecx, [ebp - 8]
and eax, 0x20000000
add esp, 0x14
neg eax
sbb eax, eax
and eax, 0x3c
add eax, 4
push ecx
push eax
mov eax, dword [ebx + 0xc]
push edi
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000bbb8
push str.Virtual_protect_error
call fcn.1000aaf0
add esp, 4
mov edx, dword [ebp - 0xc]
add ebx, 0x28
dec edx
mov dword [ebp - 0xc], edx
test edx, edx
jne 0x1000bb00
pop edi
mov eax, dword [ebp - 0x10]
pop esi
pop ebx
mov byte [eax], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d081
mov esp, ebp
pop ebp
ret
Function at 0x1000bf60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003c040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.1000bc20
mov ecx, dword [0x1003d008]
mov esi, eax
test cl, 1
jne 0x1000bfaf
or ecx, 1
mov dword [0x1003d00c], 0x10034254
mov dword [0x1003d008], ecx
mov dword [0x1003d014], 0
mov dword [0x1003d010], 0
call fcn.1000bd20
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 4
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1000bfeb
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 8], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002d081
mov esp, ebp
pop ebp
ret

Function at 0x1000c000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov bl, byte [esi]
test eax, eax
je 0x1000c051
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 8], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.1002d081
mov esp, ebp
pop ebp
ret

Function at 0x1000c550
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x10064180
call fcn.10009f90
add esp, 0xc
push 0x10064180
push 1
call fcn.10015640
mov ebx, 0xc8cf88
push 0xfffffffffffffff0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0xc00000
jne 0x1000c5e1
push 0
push 0xf020
push 0x112
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x10064180
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop ebp
ret
push 0x41010
push str.CLEO_error
push 0x10064180
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
pop ebp
ret
Function at 0x1000d790
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1003c040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.Injecting_CustomOpcodeSystem...
push 3
call fcn.1000c4d0
mov eax, dword [0x10063318]
add esp, 8
mov edx, dword [eax*4 + 0x1003c65c]
xor eax, eax
nop
mov ecx, dword [edx + eax]
mov dword [eax + 0x1005d570], ecx
mov dword [edx + eax], 0x1000d380
add eax, 4
cmp eax, 0x6c
jb 0x1000d7c0
mov eax, 0x1000d380
mov ecx, 0x148
mov edi, 0x1005d040
rep stosd dword es:[edi], eax
mov eax, dword [0x10063318]
mov eax, dword [eax*4 + 0x1003c670]
mov dword [eax], 0x1005d040
mov dword [0x469ef0], 0x1005d040
mov ecx, dword [0x10063318]
mov eax, dword [ecx*4 + 0x1003c6c0]
mov dword [0x1005d038], eax
mov eax, dword [ecx*4 + 0x1003c6fc]
mov dword [0x1005d02c], eax
mov eax, dword [ecx*4 + 0x1003c738]
mov dword [0x1005d034], eax
mov eax, dword [ecx*4 + 0x1003c74c]
mov dword [0x1005d5dc], eax
test ecx, ecx
jne 0x1000d8c6
mov eax, dword [0x1003d008]
test al, 1
jne 0x1000d86f
or eax, 1
mov dword [0x1003d00c], 0x10034254
mov dword [0x1003d008], eax
mov dword [0x1003d014], ecx
mov dword [0x1003d010], ecx
call fcn.1000bd20
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
mov esi, 0x583a07
mov dword [ebp - 0x14], 4
push 4
push esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1000d8ae
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
mov dword [0x1005d560], esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d081
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ecx*4 + 0x1003c710]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [0x1005d560], eax
pop esi
call fcn.1002d081
mov esp, ebp
pop ebp
ret 4
Function at 0x10015b80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10015bac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10015bd4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10015bda
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10015c42
jg 0x10015bf1
test esi, esi
je 0x10015c42
test ecx, ecx
jl 0x10015c3d
jg 0x10015bfb
test eax, eax
je 0x10015c3d
cmp edi, ecx
jg 0x10015c0f
jl 0x10015c05
cmp esi, eax
jae 0x10015c0f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x10015c45
mov ecx, dword [ebp + 8]
jmp 0x10015c4f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10015c69
jg 0x10015c4f
test esi, esi
je 0x10015c69
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10015c69
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10015c80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [esp + 8], esi
push edi
test eax, eax
jg 0x10015cb2
jl 0x10015ca5
test ecx, ecx
jne 0x10015cb2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10015ccc
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
test eax, eax
je 0x10015d1f
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [esp + 0x14], edx
mov eax, dword [eax]
test eax, eax
je 0x10015d26
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [esp + 0x14]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0xc]
jmp 0x10015d26
lea eax, [ebx + 0x2c]
mov dword [esp + 0x14], eax
cmp dword [ebx + 0x4c], 0
je 0x10015d96
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10015d50
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10015d84
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10015d96
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10015d60
test edi, edi
je 0x10015d96
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10016120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1003c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10016150
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d081
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1001618c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1001618c
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d081
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10016263
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100161b4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100161c0
movsx eax, bl
jmp 0x100161f8
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10016222
sub eax, 1
je 0x10016222
sub eax, 2
jne 0x10016263
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d081
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10016240
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10016263
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d081
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002d081
mov esp, ebp
pop ebp
ret 4
Function at 0x10016400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1003c040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100164bc
cmp byte [esi + 0x3d], 0
je 0x100164bc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100164aa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10016471
sub eax, 1
je 0x10016475
sub eax, 2
jne 0x100164aa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d081
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10016493
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100164aa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d081
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002d081
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1002d081
mov esp, ebp
pop ebp
ret

Function at 0x10016c80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x10064ea0
call fcn.10009f90
add esp, 0xc
push 0x10064ea0
push 1
call fcn.10015640
mov ebx, 0xc8cf88
push 0xfffffffffffffff0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0xc00000
jne 0x10016d11
push 0
push 0xf020
push 0x112
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x10064ea0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop ebp
ret
push 0x41010
push str.CLEO_error
push 0x10064ea0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
pop ebp
ret
Function at 0x100174f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003c040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.Injecting_MenuStatusNotifier...
push 3
call fcn.10016ea0
mov esi, dword [0x10063318]
add esp, 8
mov eax, dword [esi*4 + 0x1003c1e8]
mov esi, dword [esi*4 + 0x1003c2b0]
mov dword [0x1005d5e4], eax
inc esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi]
add esi, 4
add eax, esi
mov dword [0x1005d5e0], eax
mov eax, dword [0x10063318]
mov esi, dword [eax*4 + 0x1003c2b0]
push esi
push str.Replacing_call:_0x_08X
push 3
call fcn.10016ea0
mov ecx, dword [ebp - 4]
mov eax, esi
inc esi
add esp, 0xc
xor ecx, ebp
mov byte [eax], 0xe8
mov eax, 0x10016ed0
sub eax, esi
sub eax, 4
mov dword [esi], eax
pop esi
call fcn.1002d081
mov esp, ebp
pop ebp
ret 4
Function at 0x1001d5b0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Create thread
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002f403
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1003c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], esi
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [ebp - 4], 0
push 0xa0
mov dword [esi + 4], 0
call fcn.1002d08f
add esp, 4
mov dword [esi + 4], eax
lea esi, [eax + 0x10]
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x14]
mov ecx, esi
mov dword [ebp - 0x18], esi
push dword [eax]
call fcn.1000d0f0
lea edi, [esi + 0x18]
xorps xmm0, xmm0
mov dword [ebp - 0x24], edi
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov byte [ebp - 4], 4
lea esi, [edi + 0x24]
mov dword [ebp - 0x14], esi
push 0x44
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1002d08f
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 5
xorps xmm0, xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov word [edi + 0x38], 1
movups xmmword [edi + 0x48], xmm0
push 8
movq qword [edi + 0x58], xmm0
mov dword [edi + 0x60], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x64], 0xffffffff
mov dword [edi + 0x3c], 2
mov dword [edi + 0x68], 0
call fcn.1002d08f
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], 0x1001bc50
lea esi, [edi + 0x70]
mov byte [ebp - 4], 6
push esi
push 0
push eax
push 0x1001d940
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x20
mov dword [edi + 0x6c], eax
test eax, eax
je 0x1001d764
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
mov dword [ecx], edx
mov ecx, dword [eax + 4]
mov dword [ecx + 4], edx
mov ecx, dword [eax + 4]
mov dword [ecx + 8], edx
mov ecx, dword [eax + 4]
mov byte [ecx + 0xc], 0
mov ecx, dword [eax + 4]
mov byte [ecx + 0xd], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002d081
mov esp, ebp
pop ebp
ret 0x14
push 6
mov dword [esi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x10027570
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x100666b8
call fcn.10009f90
add esp, 0xc
push 0x100666b8
push 1
call fcn.10015640
mov ebx, 0xc8cf88
push 0xfffffffffffffff0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0xc00000
jne 0x10027601
push 0
push 0xf020
push 0x112
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x100666b8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop ebp
ret
push 0x41010
push str.CLEO_error
push 0x100666b8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
pop ebp
ret

Function at 0x1002c430
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x10066eb8
call fcn.10009f90
add esp, 0xc
push 0x10066eb8
push 1
call fcn.10015640
mov ebx, 0xc8cf88
push 0xfffffffffffffff0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0xc00000
jne 0x1002c4c1
push 0
push 0xf020
push 0x112
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x10066eb8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop ebp
ret
push 0x41010
push str.CLEO_error
push 0x10066eb8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
pop ebp
ret