joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000edd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1000f000
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
call fcn.10021a3e
add esp, 4
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
add edx, 5
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.1003ff50
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0xe9
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 4]
push eax
call fcn.1000efd0
add esp, 8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + edx + 1], eax
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x14], 0xe9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000efd0
add esp, 8
mov edx, 1
shl edx, 0
mov dword [ebp + edx - 0x14], eax
push 5
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1003ff50
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret

Function at 0x1000f000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x100d2058
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x100d2060
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 5
mov eax, 1
imul ecx, eax, 0
add ecx, 0x100d2058
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1004117a
add esp, 0xc
test eax, eax
jne 0x1000f073
mov eax, 0xb
jmp 0x1000f09e
push 5
mov eax, 1
imul ecx, eax, 0
add ecx, 0x100d2060
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1004117a
add esp, 0xc
test eax, eax
jne 0x1000f09b
mov eax, 5
jmp 0x1000f09e
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret
Function at 0x1000f580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov byte [ebp - 0x24], 0x24
mov byte [ebp - 0x23], 0x20
mov byte [ebp - 0x22], 0x16
mov byte [ebp - 0x21], 0x39
mov byte [ebp - 0x20], 0x3b
mov byte [ebp - 0x1f], 0x43
mov byte [ebp - 0x1e], 4
mov byte [ebp - 0x1d], 1
mov byte [ebp - 0x1c], 2
mov byte [ebp - 0x1b], 0x22
mov byte [ebp - 0x1a], 0x3b
mov byte [ebp - 0x19], 0x53
mov byte [ebp - 0x18], 0xc
mov byte [ebp - 0x17], 2
mov byte [ebp - 0x16], 0xea
mov byte [ebp - 0x15], 1
mov byte [ebp - 0x14], 1
mov byte [ebp - 0x13], 2
mov byte [ebp - 0x12], 0x50
mov byte [ebp - 0x11], 0x49
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0x27
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x4e
mov byte [ebp - 0xc], 7
mov byte [ebp - 0xb], 4
mov byte [ebp - 0xa], 6
mov byte [ebp - 9], 0x20
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0xdd
mov byte [ebp - 6], 0x1c
mov byte [ebp - 5], 0x9a
mov dword [ebp - 0x28], 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.1004be70
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0
jmp 0x1000f634
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x2c]
jge 0x1000f6b4
mov eax, dword [ebp - 0x30]
cdq
idiv dword [ebp - 0x28]
movsx eax, byte [ebp + edx - 0x24]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x30]
movsx edx, byte [ecx]
xor edx, eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x30]
mov byte [eax], dl
imul eax, dword [ebp - 0x30], 0x1a
cdq
mov ecx, 0xe
idiv ecx
mov eax, edx
cdq
idiv dword [ebp - 0x28]
movsx edx, byte [ebp + edx - 0x24]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x30]
movsx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x30]
mov byte [edx], cl
imul eax, dword [ebp - 0x30], 0x28
cdq
mov ecx, 0x26
idiv ecx
mov eax, edx
cdq
idiv dword [ebp - 0x28]
movsx edx, byte [ebp + edx - 0x24]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x30]
movsx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x30]
mov byte [edx], cl
jmp 0x1000f62b
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10015f80
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], 0x1c
mov dword [ebp - 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100160ea
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede500]
jne 0x10016001
mov eax, dword [0x10ede500]
push eax
call fcn.10017ce0
add esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede504]
jne 0x1001601d
mov eax, dword [0x10ede504]
push eax
call fcn.10017ce0
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede508]
jne 0x10016039
mov eax, dword [0x10ede508]
push eax
call fcn.10017ce0
add esp, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede50c]
jne 0x10016055
mov eax, dword [0x10ede50c]
push eax
call fcn.10017ce0
add esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede510]
jne 0x10016071
mov eax, dword [0x10ede510]
push eax
call fcn.10017ce0
add esp, 4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede514]
jne 0x1001608d
mov eax, dword [0x10ede514]
push eax
call fcn.10017ce0
add esp, 4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede518]
jne 0x100160a9
mov eax, dword [0x10ede518]
push eax
call fcn.10017ce0
add esp, 4
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x24], 0
je 0x100160d5
cmp dword [ebp - 0x28], 0
je 0x100160d5
cmp dword [ebp - 0x2c], 0
je 0x100160d5
cmp dword [ebp - 0x30], 0
je 0x100160d5
cmp dword [ebp - 0x34], 0
je 0x100160d5
cmp dword [ebp - 0x38], 0
je 0x100160d5
cmp dword [ebp - 0x3c], 0
je 0x100160d5
jmp 0x100160ea
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10015fe5
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], 0
je 0x1001611e
cmp dword [ebp - 0x28], 0
je 0x1001611e
cmp dword [ebp - 0x2c], 0
je 0x1001611e
cmp dword [ebp - 0x30], 0
je 0x1001611e
cmp dword [ebp - 0x34], 0
je 0x1001611e
cmp dword [ebp - 0x38], 0
je 0x1001611e
cmp dword [ebp - 0x3c], 0
jne 0x10016125
mov eax, 1
jmp 0x10016127
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret
Function at 0x10016140
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], 0x1c
mov dword [ebp - 0x3c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x10016264
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede500]
jne 0x100161b7
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede504]
jne 0x100161c9
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede508]
jne 0x100161db
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede50c]
jne 0x100161ed
mov dword [ebp - 0x30], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede510]
jne 0x100161ff
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede514]
jne 0x10016211
mov dword [ebp - 0x38], 1
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x10ede518]
jne 0x10016223
mov dword [ebp - 0x3c], 1
cmp dword [ebp - 0x24], 0
je 0x1001624f
cmp dword [ebp - 0x28], 0
je 0x1001624f
cmp dword [ebp - 0x2c], 0
je 0x1001624f
cmp dword [ebp - 0x30], 0
je 0x1001624f
cmp dword [ebp - 0x34], 0
je 0x1001624f
cmp dword [ebp - 0x38], 0
je 0x1001624f
cmp dword [ebp - 0x3c], 0
je 0x1001624f
jmp 0x10016264
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100161a5
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], 0
je 0x10016298
cmp dword [ebp - 0x28], 0
je 0x10016298
cmp dword [ebp - 0x2c], 0
je 0x10016298
cmp dword [ebp - 0x30], 0
je 0x10016298
cmp dword [ebp - 0x34], 0
je 0x10016298
cmp dword [ebp - 0x38], 0
je 0x10016298
cmp dword [ebp - 0x3c], 0
jne 0x1001629f
mov eax, 1
jmp 0x100162a1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret
Function at 0x100162c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acda1
mov eax, dword fs:[0]
push eax
sub esp, 0x3fc
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x100164a3
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x228]
call fcn.10003900
mov dword [ebp - 4], 0
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x400]
push ecx
call fcn.100206b0
add esp, 8
mov dword [ebp - 0x408], eax
mov edx, dword [ebp - 0x408]
push edx
lea ecx, [ebp - 0x228]
call fcn.10014ef0
lea ecx, [ebp - 0x400]
call fcn.10003d20
mov dword [ebp - 0x22c], 0x10ede598
mov ecx, dword [ebp - 0x22c]
call fcn.1001c440
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x22c]
call fcn.1001c4c0
mov dword [ebp - 0x234], eax
jmp 0x1001639b
mov eax, dword [ebp - 0x230]
add eax, 0x18
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
cmp eax, dword [ebp - 0x234]
je 0x10016491
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x238]
push eax
lea ecx, [ebp - 0x250]
push ecx
call fcn.100206b0
add esp, 8
mov byte [ebp - 4], 1
push 0
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x228]
call fcn.1001ea70
cmp eax, dword [0x100b2960]
je 0x1001647d
mov eax, dword [ebp - 0x238]
push eax
lea ecx, [ebp - 0x268]
push ecx
call fcn.10020d50
add esp, 8
mov byte [ebp - 4], 2
push 0x100
lea ecx, [ebp - 0x268]
call fcn.100068d0
push eax
lea eax, [ebp - 0x368]
push eax
call fcn.1005e630
add esp, 0xc
mov eax, 1
imul ecx, eax, 0xff
mov dword [ebp - 0x404], ecx
cmp dword [ebp - 0x404], 0x100
jae 0x1001644c
jmp 0x10016451
call fcn.10021c6f
mov edx, dword [ebp - 0x404]
mov byte [ebp + edx - 0x368], 0
lea eax, [ebp - 0x368]
push eax
call fcn.10017780
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x268]
call fcn.10003cd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x250]
call fcn.10003d20
jmp 0x1001638c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.10003d20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret
Function at 0x10016520
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
cmp dword [0x107da23c], 0
je 0x1001654c
push 0
mov eax, dword [0x107da23c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x107da23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10ede4e4], 0
je 0x1001656f
push 0
mov eax, dword [0x10ede4e4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x10ede4e4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10ede4e8], 0
je 0x10016592
push 0
mov eax, dword [0x10ede4e8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x10ede4e8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10ede4ec], 0
je 0x100165b5
push 0
mov eax, dword [0x10ede4ec]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x10ede4ec]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10ede4f0], 0
je 0x100165d8
push 0
mov eax, dword [0x10ede4f0]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x10ede4f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10ede4f4], 0
je 0x100165fb
push 0
mov eax, dword [0x10ede4f4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x10ede4f4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10ede4f8], 0
je 0x1001661e
push 0
mov eax, dword [0x10ede4f8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x10ede4f8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016f90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ace36
mov eax, dword fs:[0]
push eax
sub esp, 0x548
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x23c], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0x240]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10017176
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0x1001715b
push 0x104
lea eax, [ebp - 0x450]
push eax
push 0
mov ecx, dword [ebp - 0x248]
push ecx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x1001714e
push 0xc
lea ecx, [ebp - 0x45c]
call fcn.10006350
lea ecx, [ebp - 0x45c]
call fcn.10014720
mov dword [ebp - 4], 0
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x550]
call fcn.10003900
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x45c]
push ecx
lea edx, [ebp - 0x550]
push edx
call fcn.100189e0
add esp, 8
mov byte [ebp - 0x535], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x550]
call fcn.10003d20
movzx eax, byte [ebp - 0x535]
test eax, eax
je 0x1001713c
lea eax, [ebp - 0x45c]
push eax
lea ecx, [ebp - 0x474]
push ecx
call fcn.1001cb00
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x474]
push ecx
call fcn.10007bb0
add esp, 8
movzx edx, al
test edx, edx
je 0x10017131
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x554], eax
lea ecx, [ebp - 0x474]
call fcn.10003cd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x45c]
call fcn.10003d70
mov eax, dword [ebp - 0x554]
jmp 0x10017185
lea ecx, [ebp - 0x474]
call fcn.10003cd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x45c]
call fcn.10003d70
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0x240]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10016ff2
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret
Function at 0x10017600
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
cmp dword [0x100d5f90], 0
jne 0x10017638
mov dword [ebp - 0x54], 2
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x50]
call fcn.1000fa80
push eax
call fcn.10013500
add esp, 4
mov dword [0x100d5f90], 0
push 0x7042a2
push 0
push 0x100d5f98
call fcn.10040a50
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push 0x7042a2
mov ecx, dword [0x100d2940]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0x7042a2
push 0x100d5f98
mov eax, dword [0x100d2940]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [0x100d5f90], 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret

Function at 0x100176b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x100d2948]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0
call dword [sym.imp.USER32.dll_GetTopWindow]
mov dword [ebp - 0xc], eax
jmp 0x100176e9
push 2
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10017768
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x100176ff
jmp 0x100176da
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10017714
jmp 0x100176da
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x14]
jne 0x10017763
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x100
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1005edd4
add esp, 0xc
mov dword [ebp - 8], 1
jmp 0x10017768
jmp 0x100176da
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002161d
mov esp, ebp
pop ebp
ret
Function at 0x10017780
Capabilities:
Create thread
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
push str.Hack_detected:__s_n
call fcn.1000ed40
add esp, 8
push 0xd0
call fcn.1005e75f
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 3
mov eax, dword [ebp + 8]
push eax
call fcn.1004be70
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.1004be70
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
add edx, 8
push edx
call fcn.1005e630
add esp, 0xc
push 0x10
push 0x100d5f50
mov eax, dword [ebp - 8]
add eax, 0x6c
push eax
call fcn.1005e630
add esp, 0xc
push 0
push 0xd0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x100d2910]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call fcn.1005dd3a
add esp, 4
push 2
call fcn.10018b60
add esp, 4
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], 0xffffffff
jne 0x1001784a
push str.Error_on_send_cheat_packet.
call fcn.10018210
add esp, 4
push 2
mov eax, dword [0x100d2910]
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
push str.Ending_because_of_cheat_detection.
call fcn.10018210
add esp, 4
mov eax, dword [ebp - 8]
add eax, 8
push eax
call fcn.10018210
add esp, 4
push 0
push 0
push 0
push 0x10016d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100179b0
Capabilities:
Create thread
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ace68
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x100d2948]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
sub esp, 0x18
mov eax, esp
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x14]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp + 0x1c]
mov dword [eax + 0x14], edx
push str.Hack_detected:__s_n
call fcn.1000ed40
add esp, 0x1c
push 0xd0
call fcn.1005e75f
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 3
lea ecx, [ebp + 8]
call fcn.10006c50
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
lea ecx, [ebp + 8]
call fcn.10006c50
push eax
lea ecx, [ebp + 8]
call fcn.100068d0
push eax
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
call fcn.1005e630
add esp, 0xc
push 0x10
push 0x100d5f50
mov eax, dword [ebp - 0x14]
add eax, 0x6c
push eax
call fcn.1005e630
add esp, 0xc
push 0
push 0xd0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [0x100d2910]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.1005dd3a
add esp, 4
push 2
call fcn.10018b60
add esp, 4
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x10], 0xffffffff
jne 0x10017ac1
push str.Error_on_send_cheat_packet.
call fcn.10018210
add esp, 4
push 2
mov eax, dword [0x100d2910]
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
push str.Ending_because_of_cheat_detection.
call fcn.10018210
add esp, 4
mov eax, dword [ebp - 0x14]
add eax, 8
push eax
call fcn.10018210
add esp, 4
push 0
push 0
push 0
push 0x10016d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10003cd0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017ce0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10017d07
xor eax, eax
jmp 0x10017d23
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10017d1e
xor eax, eax
jmp 0x10017d23
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret