joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ee770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1014a018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100ee7b7
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012db16
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x18]
push eax
push 6
lea ecx, [ebp - 0x20]
push ecx
push edi
call ebx
mov edx, 0x1112
cmp word [ebp - 0x20], dx
jne 0x100ee8cc
cmp dword [ebp - 0x1e], 0x36
jne 0x100ee8cc
cmp byte [ebp + 0xc], 0
push esi
mov esi, 0x10233e5c
je 0x100ee7f7
mov esi, 0x10233e8c
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
call ebx
mov edx, dword [0x10233ebc]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi], edx
mov eax, dword [0x10233ec0]
xor eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov ecx, dword [0x10233ec4]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 8], ecx
mov edx, dword [0x10233ec8]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0xc], edx
call ebx
mov edx, dword [0x10233ebc]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi + 0x10], edx
mov eax, dword [0x10233ec0]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [0x10233ec4]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x18], ecx
mov edx, dword [0x10233ec8]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0x1c], edx
call ebx
mov edx, dword [0x10233ebc]
xor edx, dword [ebp - 0x14]
push edi
mov dword [esi + 0x20], edx
mov eax, dword [0x10233ec0]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov ecx, dword [0x10233ec4]
xor ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ecx
mov edx, dword [0x10233ec8]
xor edx, dword [ebp - 8]
mov dword [esi + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012db16
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.1012db16
mov esp, ebp
pop ebp
ret 8
Function at 0x100f0870
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x100f07f0
push 5
sub eax, 0x836486
xor edi, edi
push 0x836481
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x100f08cf
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x836481
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x836481
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100f08d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x100f0760
push 5
sub ecx, 0x7dd309
push 0x7dd304
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x100f0925
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x7dd304
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x7dd304
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100f092b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x100f0760
push 5
sub edx, 0x833b0d
push 0x833b08
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x100f097b
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x833b08
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x833b08
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100f0981
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100f2000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x100f2080
push 5
sub eax, 0x80f9b0
xor edi, edi
push 0x80f9ab
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x100f205f
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x80f9ab
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x80f9ab
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100f2065
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x10a71f88], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100f2590
Capabilities:
Read .ini file

Disassembly:
xor ecx, ecx
mov dword [0x11915cb8], 0x1013e830
mov dword [0x119208b0], ecx
mov dword [0x119208ac], ecx
mov dword [0x119208b4], ecx
mov dword [0x119208b8], ecx
mov eax, 0x11915cbc
lea esp, [esp]
or edx, 0xffffffff
mov word [eax], dx
add eax, 0xdc
cmp eax, 0x1192089c
jl 0x100f25c0
push str.Tahoma
push ecx
push 3
push ecx
push ecx
push 1
push ecx
push 1
push ecx
push 0x2bc
push ecx
push ecx
push ecx
push 0xd
call dword [sym.imp.GDI32.dll_CreateFontA]
push str..Settings.ini
push 7
push str.PostColor
push str.Game
mov dword [0x1192089c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x108c93ec], eax
cmp eax, 1
jl 0x100f261d
cmp eax, 9
jle 0x100f2627
mov dword [0x108c93ec], 9
mov eax, 0x11915cb8
ret
Function at 0x100f4f00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x11920f40]
push 7
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100f502f
push 8
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100f502f
push 0xc
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100f502f
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100f502f
push 0xf
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100f502f
push 0x41
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100f502f
push 0x4e
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x100f502f
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x100f502f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edx, dword [0x119208b0]
add edx, 0xfa
cmp eax, edx
jb 0x100f502e
mov eax, 0x7dd0f0
call eax
test eax, eax
jne 0x100f502e
cmp word [edi], ax
jl 0x100f502e
mov cl, byte [edi + 0x43]
mov word [ebp - 3], ax
lea edx, [ebp - 8]
mov dword [ebp - 7], eax
mov byte [ebp - 2], cl
mov byte [ebp - 1], al
push edx
lea ecx, [eax + 8]
mov dword [ebp - 8], 0x17908c1
mov word [ebp - 4], ax
mov byte [ebp - 1], al
call fcn.10100800
add esp, 4
call esi
mov dword [0x119208b0], eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100f5370
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013070b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x1014a018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [esi], eax
xor ebx, ebx
lea eax, [esi + 0x10]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], ebx
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
mov byte [eax + 0x1c], bl
mov dword [eax + 0x20], ebx
mov dword [eax + 0x24], ebx
mov byte [eax + 0x28], bl
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x30], ebx
mov byte [eax + 0x34], bl
mov dword [ebp - 4], ebx
mov ecx, dword [esi]
mov edx, dword [esi + 0xc]
push ecx
push edx
push eax
mov eax, dword [esi + 4]
push eax
push ecx
mov ecx, dword [esi + 8]
call fcn.100f55d0
add esp, 0x14
test al, al
mov eax, esi
jne 0x100f53f8
mov dword [esi + 8], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100fc170
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x5460e4]
mov eax, str.DataLocalEffectTRSData.bmd
call fcn.10001140
test al, al
je 0x100fc1e6
push 0
push 0x20
push 3
push 0
push 1
push connect
push str.DataLocalEffectTRSData.bmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100fc1e6
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xa2b20
je 0x100fc1fc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0xa2b20
lea esi, [ebx + 0x3650d4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100fc1df
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x85
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xfa
mov byte [esi + eax], dl
inc eax
cmp eax, 0xa2b20
jb 0x100fc224
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.1012db16
mov esp, ebp
pop ebp
ret

Function at 0x100fc260
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x5460e8]
mov eax, str.DataLocalTooltipTRSData.bmd
call fcn.10001140
test al, al
je 0x100fc2d6
push 0
push 0x20
push 3
push 0
push 1
push connect
push str.DataLocalTooltipTRSData.bmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100fc2d6
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x13e3c0
je 0x100fc2ec
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x13e3c0
lea esi, [ebx + 0x407bf4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100fc2cf
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x85
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xfa
mov byte [esi + eax], dl
inc eax
cmp eax, 0x13e3c0
jb 0x100fc314
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.1012db16
mov esp, ebp
pop ebp
ret
Function at 0x100fc350
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x5460ec]
mov eax, str.DataLocalMakeWorldTRSData.bmd
call fcn.10001140
test al, al
je 0x100fc3c6
push 0
push 0x20
push 3
push 0
push 1
push connect
push str.DataLocalMakeWorldTRSData.bmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100fc3c6
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x12c
je 0x100fc3dc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x12c
lea esi, [ebx + 0x545fb4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100fc3bf
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x85
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xfa
mov byte [esi + eax], dl
inc eax
cmp eax, 0x12c
jb 0x100fc404
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.1012db16
mov esp, ebp
pop ebp
ret

Function at 0x100fc440
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x5460e0]
mov eax, str.DataCustomMUXTEAM
call fcn.10001140
test al, al
je 0x100fc4f0
push 0
push 0x20
push 3
push 0
push 1
push connect
push str.DataCustomMUXTEAM
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100fc4f0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push edi
call esi
cmp eax, 0x3650d0
je 0x100fc4c6
push 0x3650d0
push 0
push edi
call esi
push eax
push str.Bug_Siez___d___d_
call fcn.10110fe0
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x3650d0
lea esi, [ebx + 4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100fc506
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x95
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xda
mov byte [esi + eax], dl
inc eax
cmp eax, 0x3650d0
jb 0x100fc508
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.1012db16
mov esp, ebp
pop ebp
ret
Function at 0x100fc540
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov al, 1
cmp byte [0x102346fc], al
jne 0x100fc57e
push str.32770
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100fc597
push 0
push str.Launcher.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp + 8]
test byte [ecx + 4], al
je 0x100fc597
push 0x102346fd
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x100fc569
pop ebp
ret 4

Function at 0x100fc5a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x1014a018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test byte [eax + 4], 2
je 0x100fc5fc
add eax, 0x45
push eax
lea eax, [ebp - 0x104]
push str.XTEAM_MAIN_10405__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x100fc60c
lea edx, [ebp - 0x104]
push edx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100fc620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x518
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x514], eax
cmp dword [edi + 0x254], 0
push ebx
push esi
je 0x100fc73a
cmp word [edi + 0x82c], 0
je 0x100fc73a
push 0x103
lea eax, [esp + 0x415]
push 0
push eax
mov byte [esp + 0x41c], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x414]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100fc696
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [edi + 0xd3]
push eax
lea esi, [esp + 0x414]
call fcn.10110e90
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x100fc6bf
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movzx ebx, word [edi + 0x82c]
call fcn.100fc750
test al, al
je 0x100fc6d7
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea esi, [esp + 0x10]
call section..text
mov edx, esi
push edx
lea esi, [esp + 0x10]
lea eax, [edi + 0xd3]
call fcn.10001140
test al, al
jne 0x100fc712
push 0x10
push str.Error
push str.Main.exe_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [edi + 0x254]
cmp eax, dword [esp + 0xc]
je 0x100fc73a
push 0x10
push str.Error
push str.Main.exe_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x51c]
pop esi
pop ebx
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
Function at 0x100fc750
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x1014a018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x124
lea eax, [ebp - 0x12c]
push 0
push eax
mov dword [ebp - 0x130], 0x128
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x130]
mov edi, eax
push ecx
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x100fc7e0
jmp 0x100fc7b0
lea edx, [ebp - 0x10c]
push str.main.exe
push edx
call dword [sym.imp.MSVCR100.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x100fc7ce
inc esi
cmp esi, ebx
jg 0x100fc7f9
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x100fc7b0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.1012db16
mov esp, ebp
pop ebp
ret

Function at 0x100fc820
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x440
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [ebx + 0x258], 0
push esi
push edi
je 0x100fc933
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0xf4]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x100fc8a0
lea ecx, [esp + 0x414]
push str.AntiHack__s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x258]
cmp eax, dword [esp + 0x10]
je 0x100fc8e1
lea ecx, [esp + 0x414]
push str.AntiHack__s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100fc921
push edi
lea eax, [esp + 0x414]
push str.AntiHack__s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Antihack
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1013e934
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100fc933
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
Function at 0x100fc950
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x440
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [ebx + 0x260], 0
push esi
push edi
je 0x100fca63
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0x134]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x100fc9d0
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin1
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x260]
cmp eax, dword [esp + 0x10]
je 0x100fca11
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin1
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100fca51
push edi
lea eax, [esp + 0x414]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin1
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1013e934
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100fca63
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
Function at 0x100fca80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x440
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [ebx + 0x264], 0
push esi
push edi
je 0x100fcb93
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0x154]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x100fcb00
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin2
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x264]
cmp eax, dword [esp + 0x10]
je 0x100fcb41
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin2
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100fcb81
push edi
lea eax, [esp + 0x414]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin2
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1013e934
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100fcb93
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret