joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c8e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10077583
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [0x1011f930]
test eax, eax
je 0x1002c90a
inc dword [eax + 0x36c]
push esi
push edi
push 0x3a80
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea ecx, [ebp - 0xd]
mov dword [ebp - 0x14], eax
add esp, 4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1002c940
push ecx
mov ecx, eax
call fcn.10028a50
mov edi, eax
mov dword [ebp - 0x14], eax
jmp 0x1002c945
xor edi, edi
mov dword [ebp - 0x14], edi
cmp dword [0x1011f930], 0
jne 0x1002c955
mov eax, edi
mov dword [0x1011f930], eax
or edx, 0xffffffff
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x34], str.Window
mov esi, 0x100d7895
mov al, 0x57
or edi, 0xffffffff
cmp al, 0x23
jne 0x1002c97e
cmp byte [esi], al
jne 0x1002c97e
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100d2510]
test al, al
jne 0x1002c970
mov edi, dword [ebp - 0x14]
not edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], 0x10039b20
mov dword [ebp - 0x28], 0x10039bc0
mov esi, dword [edi + 0x2c50]
mov ecx, dword [edi + 0x2c54]
mov dword [ebp - 0x24], 0x10039c90
cmp esi, ecx
jne 0x1002ca5b
inc esi
test ecx, ecx
je 0x1002c9d8
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1002c9dd
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x1002ca5b
mov eax, dword [0x1011f930]
test eax, eax
je 0x1002c9f5
inc dword [eax + 0x36c]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edx, dword [edi + 0x2c58]
add esp, 4
mov dword [ebp - 0x14], eax
test edx, edx
je 0x1002ca4f
mov ecx, dword [edi + 0x2c50]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x2c58]
add esp, 0xc
test ecx, ecx
je 0x1002ca42
mov eax, dword [0x1011f930]
test eax, eax
je 0x1002ca42
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x14]
add esp, 4
mov dword [edi + 0x2c58], eax
mov dword [edi + 0x2c54], esi
mov eax, dword [edi + 0x2c50]
movups xmm0, xmmword [ebp - 0x34]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2c58]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [eax + ecx*8 + 0x10], xmm0
mov eax, edi
inc dword [edi + 0x2c50]
mov ecx, dword [ebp - 0xc]
mov byte [edi], 1
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002f500
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1002f53f
cmp bl, 0x23
jne 0x1002f521
cmp byte [esi], bl
jne 0x1002f521
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x100d2510]
test bl, bl
jne 0x1002f512
mov ecx, dword [0x1011f930]
not eax
mov esi, dword [ecx + 0x197c]
mov edi, dword [ecx + 0x1984]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1002f57e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x1002f578
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1002f57a
mov esi, edx
test esi, esi
jne 0x1002f560
cmp edi, ebx
je 0x1002f58d
cmp dword [edi], eax
jne 0x1002f58d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10034a20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1011f930]
lea edx, [ebp - 4]
push ebx
push esi
push edi
mov edi, dword [eax + 0x198c]
mov esi, 4
mov eax, dword [edi + 0x1c0]
add edi, 0x1c0
mov dword [ebp - 4], ecx
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100d2510]
sub esi, 1
jne 0x10034a52
mov ecx, dword [edi + 4]
not ebx
mov esi, dword [edi]
cmp esi, ecx
jne 0x10034a99
inc esi
test ecx, ecx
je 0x10034a87
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10034a8c
mov eax, 8
cmp eax, esi
mov ecx, edi
cmovg esi, eax
push esi
call fcn.1003a610
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039650
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [0x1011f930]
push esi
mov esi, ebx
mov dword [ebp - 4], ecx
push edi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov edi, dword [esi + 0x2c5c]
mov ecx, dword [esi + 0x2c60]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 0xc], 0
cmp edi, ecx
jne 0x10039742
inc edi
test ecx, ecx
je 0x100396b6
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x100396bb
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x10039742
test esi, esi
je 0x100396ce
inc dword [esi + 0x36c]
lea eax, [edi*8]
sub eax, edi
shl eax, 2
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov eax, dword [esi + 0x2c64]
test eax, eax
je 0x10039730
mov ecx, dword [esi + 0x2c5c]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 2
push edx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x2c64]
add esp, 0xc
test ecx, ecx
je 0x10039726
mov eax, dword [0x1011f930]
test eax, eax
je 0x10039726
dec dword [eax + 0x36c]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [esi + 0x2c64], ebx
mov ebx, dword [0x1011f930]
mov dword [esi + 0x2c60], edi
mov eax, dword [esi + 0x2c5c]
mov ecx, dword [esi + 0x2c64]
movups xmm0, xmmword [ebp - 0x24]
mov edi, dword [ebp - 4]
lea edx, [eax*8]
sub edx, eax
mov eax, dword [ebp - 0xc]
movups xmmword [ecx + edx*4], xmm0
movq xmm0, qword [ebp - 0x14]
movq qword [ecx + edx*4 + 0x10], xmm0
mov dword [ecx + edx*4 + 0x18], eax
inc dword [esi + 0x2c5c]
mov eax, dword [esi + 0x2c5c]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x2c64]
mov esi, edi
lea eax, [eax + ecx*4]
add eax, 0xffffffe4
lea ecx, [esi + 1]
mov dword [ebp - 8], eax
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x100397a0
sub esi, ecx
test ebx, ebx
je 0x100397b3
inc dword [ebx + 0x36c]
inc esi
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push esi
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [ebp - 8]
lea esi, [edi + 1]
add esp, 0x10
or edx, 0xffffffff
mov dword [ebx], eax
mov al, byte [edi]
test al, al
je 0x10039807
or edi, 0xffffffff
nop word [eax + eax]
cmp al, 0x23
jne 0x100397ee
cmp byte [esi], al
jne 0x100397ee
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100d2510]
test al, al
jne 0x100397e0
pop edi
not edx
mov eax, ebx
pop esi
mov dword [ebx + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039820
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, edx
mov edx, dword [0x1011f930]
mov dword [ebp - 0xc], edx
push edi
mov edi, ecx
test esi, esi
jne 0x10039849
mov esi, edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x10039840
sub esi, ecx
test edx, edx
je 0x10039853
inc dword [edx + 0x36c]
lea eax, [esi + 1]
push ebx
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push esi
push edi
push eax
lea ebx, [eax + esi]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [ebp - 0x10]
xor edx, edx
add esp, 0x10
mov byte [ebx], 0
xor edi, edi
mov dword [ebp - 8], edx
mov ecx, esi
cmp esi, ebx
jae 0x100399e2
nop dword [eax]
mov al, byte [ecx]
cmp al, 0xa
je 0x10039a10
cmp al, 0xd
je 0x10039a10
mov esi, ecx
cmp ecx, ebx
jae 0x100398b7
mov al, byte [esi]
cmp al, 0xa
je 0x100398b7
cmp al, 0xd
je 0x100398b7
inc esi
cmp esi, ebx
jb 0x100398a8
mov byte [esi], 0
mov al, byte [ecx]
cmp al, 0x3b
je 0x100399d4
cmp al, 0x5b
jne 0x100399bb
cmp esi, ecx
jbe 0x100399bb
cmp byte [esi - 1], 0x5d
lea ebx, [esi - 1]
jne 0x100399b8
lea edi, [ecx + 1]
mov byte [ebx], 0
mov eax, ebx
sub eax, edi
push eax
push 0x5d
push edi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
mov dword [ebp - 8], eax
test eax, eax
je 0x10039923
lea ecx, [eax + 1]
sub ebx, ecx
push ebx
push 0x5b
push ecx
call sub.VCRUNTIME140.dll_memchr
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x10039923
mov eax, dword [ebp - 8]
lea edx, [ecx + 1]
mov dword [ebp - 8], edx
mov byte [eax], 0
jmp 0x1003992b
mov dword [ebp - 8], edi
mov edi, str.Window
mov cl, byte [edi]
or eax, 0xffffffff
mov ebx, dword [0x1011f930]
inc edi
test cl, cl
je 0x1003996e
or ebx, 0xffffffff
nop
cmp cl, 0x23
jne 0x1003994f
cmp byte [edi], cl
jne 0x1003994f
cmp byte [edi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [edi]
inc edi
xor eax, dword [edx*4 + 0x100d2510]
test cl, cl
jne 0x10039940
mov ebx, dword [0x1011f930]
mov edx, dword [ebx + 0x2c50]
xor ecx, ecx
not eax
test edx, edx
jle 0x1003998f
mov edi, dword [ebx + 0x2c58]
cmp dword [edi + 4], eax
je 0x1003999b
inc ecx
add edi, 0x18
cmp ecx, edx
jl 0x10039982
xor edi, edi
mov ebx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x100399d4
test edi, edi
je 0x10039991
push dword [ebp - 8]
mov eax, dword [edi + 8]
push edi
push dword [ebp - 0xc]
call eax
mov ebx, dword [ebp - 4]
mov edx, eax
add esp, 0xc
mov dword [ebp - 8], edx
jmp 0x100399d4
mov ebx, dword [ebp - 4]
test edi, edi
je 0x100399d4
test edx, edx
je 0x100399d4
mov eax, dword [edi + 0xc]
push ecx
push edx
push edi
push dword [ebp - 0xc]
call eax
mov edx, dword [ebp - 8]
add esp, 0x10
lea ecx, [esi + 1]
cmp ecx, ebx
jb 0x10039890
mov esi, dword [ebp - 0x10]
pop ebx
test esi, esi
je 0x100399f6
mov eax, dword [0x1011f930]
test eax, eax
je 0x100399f6
dec dword [eax + 0x36c]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
mov byte [eax + 0x2c3c], 1
pop esi
mov esp, ebp
pop ebp
ret
inc ecx
jmp 0x10039890
Function at 0x10039a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x1011f930]
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [esi + 0x2c40], 0
test eax, eax
je 0x10039b11
push edi
lea edi, [esi + 0x2c44]
mov dword [esi + 0x2c40], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10039a74
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1003a910
mov dword [edi], 0
cmp dword [edi + 4], 0
jne 0x10039a89
push 8
mov ecx, edi
call fcn.1003a910
mov eax, dword [edi]
mov ecx, dword [edi + 8]
push ebx
mov dword [ebp - 4], 0
mov byte [ecx + eax], 0
inc dword [edi]
cmp dword [esi + 0x2c50], 0
jle 0x10039acc
xor ebx, ebx
mov eax, dword [esi + 0x2c58]
add eax, ebx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x2c50]
jl 0x10039aa7
mov edi, dword [edi]
mov ebx, 0x1011f7cf
mov ecx, dword [ebp - 8]
mov edx, 0x100d795c
lea eax, [edi - 1]
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esi + 0x2c4c]
test eax, eax
cmovne ebx, eax
call fcn.1002a210
mov esi, eax
test esi, esi
je 0x10039b0f
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005e020
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
sub eax, 0
je 0x1005e05d
sub eax, 1
jne 0x1005e1b5
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push esi
push 0x1005ddb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop esi
pop ebp
ret 0xc
cmp dword [ebp + 0x10], 0
jne 0x1005e1b5
mov ecx, 0x10149100
call fcn.10025ce0
mov ecx, 0x1014918c
call fcn.10025ce0
mov ecx, 0x10149164
call fcn.10025ce0
mov ecx, 0x101491a0
call fcn.10025ce0
mov ecx, 0x1014913c
call fcn.10025ce0
mov ecx, 0x10149150
call fcn.10025ce0
mov ecx, 0x101491c8
call fcn.10025ce0
mov ecx, 0x101491b4
call fcn.10025ce0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1011f470]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1014ab24]
cmp eax, dword [ecx + 4]
jle 0x1005e100
push 0x1014ab24
call fcn.10073f08
add esp, 4
cmp dword [0x1014ab24], 0xffffffff
jne 0x1005e100
push 0x10079180
call fcn.10074271
push 0x1014ab24
call fcn.10073eb7
add esp, 8
mov eax, dword [0x1014596c]
push edi
xor edi, edi
cmp dword [eax + 0xc], edi
jle 0x1005e146
push ebx
xor ebx, ebx
mov esi, dword [eax]
cmp dword [esi + ebx], 0xfffffffe
jne 0x1005e13c
mov ecx, dword [esi + ebx + 4]
test ecx, ecx
je 0x1005e13c
mov eax, dword [ecx + 8]
add ecx, 8
mov eax, dword [eax + 0x24]
call eax
test al, al
mov eax, dword [0x1014596c]
jne 0x1005e13c
mov dword [esi + ebx + 0x14], 0
inc edi
add ebx, 0x38
cmp edi, dword [eax + 0xc]
jl 0x1005e110
pop ebx
mov eax, dword [0x1014ab1c]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ecx + 0x20], eax
call fcn.10023e20
call fcn.1005d530
mov esi, dword [0x1011f930]
mov ecx, esi
mov dword [0x101453d4], 0
mov dword [0x101453dc], 0
call fcn.1002df10
pop edi
cmp dword [0x1011f930], esi
jne 0x1005e191
mov dword [0x1011f930], 0
test esi, esi
je 0x1005e1b5
mov ecx, esi
call fcn.1003ab00
mov eax, dword [0x1011f930]
test eax, eax
je 0x1005e1ab
dec dword [eax + 0x36c]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, 1
pop esi
pop ebp
ret 0xc
Function at 0x10069e00
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10069ef3
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10069eec
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x10069ed2
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10069ed2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10069ed2
mov edx, dword [esi]
test edx, edx
jne 0x10069e98
push 0x200
push edx
push dword [0x1011f944]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10069eec
jmp 0x10069ec3
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10069ec3
shl eax, 3
push eax
push edx
push 0
push dword [0x1011f944]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10069eec
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
lea eax, [ecx + 1]
mov dword [esi + 8], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10069e57
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x10069f39
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x10069f39
nop
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10069f33
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.10069cc0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10069f00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10069f40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x1014ace0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10069f86
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10069fa1
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10069fd0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x1014ace8]
push ebx
push esi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x1006a0ad
mov eax, dword [0x1014ace0]
add eax, 0x14
test byte [eax], 2
je 0x1006a00a
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x10069ff5
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x1006a0ad
push edi
push 1
or edx, 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.10069e00
mov ecx, dword [0x1014ace8]
add esp, 4
cmp esi, ecx
jae 0x1006a05b
imul edi, esi, 0x2c
mov eax, dword [0x1014ace0]
test byte [edi + eax + 0x14], 2
jne 0x1006a050
mov ecx, esi
call fcn.10069f40
mov ebx, eax
test ebx, ebx
jne 0x1006a058
mov ecx, dword [0x1014ace8]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x1006a031
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1006a0ac
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x1006a09d
mov ebx, eax
nop dword [eax + eax]
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1006a091
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x1006a070
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1011f944]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006f570
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x130
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov al, byte [0x100d8b04]
xorps xmm0, xmm0
movaps xmmword [esp], xmm0
mov ecx, 0x10148fc8
movq xmm0, qword [str.C:gloss_]
mov byte [esp + 8], al
lea eax, [esp]
push eax
mov dword [esp + 0x14], 9
mov dword [esp + 0x18], 0xf
movq qword [esp + 4], xmm0
mov byte [esp + 0xd], 0
call fcn.10012500
mov ecx, dword [esp + 0x14]
cmp ecx, 0xf
jbe 0x1006f607
mov edx, dword [esp]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006f5fd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006f5fd
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10073e7e
add esp, 8
cmp dword [0x10148fdc], 0xf
mov eax, 0x10148fc8
push 0
cmova eax, dword [0x10148fc8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0x10148b20
call fcn.1006b140
mov ecx, 0x10148b20
call fcn.1006c680
mov ecx, 0x10148b20
call fcn.1006d9c0
mov esp, ebp
pop ebp
ret
Function at 0x10074f8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push 0x1007a620
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x10074fb3
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x10074fb6
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10074f68
pop esi
leave
ret 8
Function at 0x401ef0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4e38e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4f5178
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x20], eax
push ecx
push 1
push eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CGdiObject::Attach
mov esi, dword [esp + 0x28]
lea edx, [esp + 8]
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject
mov ecx, dword [esp + 0x2c]
mov edi, eax
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x10]
push eax
push ecx
push edx
mov ecx, esi
call sub.MFC42.DLL_CDC::MoveTo
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CDC::LineTo
push edi
mov ecx, esi
call sub.MFC42.DLL_CDC::SelectObject
lea ecx, [esp + 8]
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [esp + 8], 0x4f4f14
lea ecx, [esp + 8]
mov dword [esp + 0x20], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x18
Function at 0x40d2e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e47d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x20]
call fcn.004a94e0
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], eax
call fcn.004178f0
push 1
lea eax, [esp + 0x20]
push 1
push eax
mov ecx, esi
call fcn.0040bbc0
mov ecx, dword [esi + 0x20]
push ecx
lea ecx, [esp + 0x30]
call fcn.004e2538
mov ecx, dword [esi + 0x20]
xor edi, edi
lea eax, [esp + 0x2c]
push edi
mov edx, dword [ecx]
push eax
mov dword [esp + 0x50], edi
call dword [edx + 0xe4]
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x1c]
push 2
push ecx
push edx
call dword [sym.imp.GDI32.dll_DPtoLP]
mov eax, dword [esi + 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
cmp dword [eax + 0x214], edi
jle 0x40d456
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x6c]
mov eax, dword [eax + 0x210]
lea edx, [esp + 0x68]
lea ecx, [eax + edi*8]
push ecx
push edx
lea ecx, [esp + 0x24]
call fcn.00417900
mov eax, dword [esp + 0x58]
test eax, eax
je 0x40d3c4
mov eax, dword [esi + 0x20]
mov ecx, dword [esp + 0x1e]
and ecx, 0xffff
push ebp
mov eax, dword [eax + 0x40]
push ebx
mov edx, dword [eax + 0xe4]
mov eax, dword [esp + 0x6c]
push eax
mov ecx, dword [edx + ecx*4]
mov edx, dword [esp + 0x6c]
push edx
call fcn.00461040
jmp 0x40d434
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x40d3ee
mov eax, dword [esi + 0x20]
mov ecx, dword [esp + 0x1e]
and ecx, 0xffff
push ebp
mov eax, dword [eax + 0x40]
push ebx
mov edx, dword [eax + 0xe4]
mov ecx, dword [edx + ecx*4]
call fcn.00460c70
jmp 0x40d434
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
add eax, ecx
mov ecx, dword [esi + 0x20]
cdq
sub eax, edx
mov edx, dword [esp + 0x24]
mov edi, eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [ecx + 0x40]
add eax, edx
cdq
mov ecx, dword [ecx + 0xe4]
sub eax, edx
mov edx, dword [esp + 0x1e]
push ebp
sar edi, 1
and edx, 0xffff
push ebx
sar eax, 1
mov ecx, dword [ecx + edx*4]
push edi
push eax
call fcn.00461040
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x40d440
mov dword [esp + 0x14], 1
mov eax, dword [esi + 0x20]
inc edi
mov dword [esp + 0x10], edi
cmp edi, dword [eax + 0x214]
jl 0x40d378
pop ebp
pop ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40d466
mov ecx, dword [esi + 0x20]
call fcn.004a9520
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call sub.MFC42.DLL_CClientDC::CClientDC
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret 0x18