joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cacd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x503757
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x66582c
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.004edd76
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.004edd76
mov edi, dword [0x5056d8]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], 0x665818
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [0x505554]
lea ecx, [esp + 0xb0]
push ecx
call dword [0x505104]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.004cb7f0
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x10003910
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10003927
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10003958
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x10003954
cmp esi, eax
jae 0x10003958
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x10003944
cmp esi, eax
jb 0x1000395e
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x10016260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10096068
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push esi
mov eax, dword [0x100b8070]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x30], 0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0x34]
test esi, esi
je 0x100162b0
mov eax, dword [esi]
jmp 0x100162b2
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0xb0]
push edi
call eax
test eax, eax
jge 0x100162d3
push 0x100a5d58
push edi
push eax
call fcn.100800e0
push 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x10
push ebp
call fcn.10080d50
add esp, 0x10
test esi, esi
mov word [esp + 0xc], 0
je 0x10016324
lea edx, [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x10016324
mov eax, dword [esi]
test eax, eax
je 0x1001630b
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x1001631b
push eax
call fcn.10080a47
add esp, 4
push esi
call fcn.10080a47
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x20
ret 8
Function at 0x10017d00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp dword [edi + 0x544], 1
push ebx
push esi
je 0x10017d15
cmp dword [edi + 0x548], 0
je 0x10017d27
lea esi, [edi + 0x59834]
push esi
call fcn.10020bd0
push esi
call fcn.10021080
mov esi, edi
call fcn.100177a0
cmp dword [edi + 0x597c4], 1
jne 0x10017e25
call fcn.1007f280
test eax, eax
jne 0x10017e25
cmp dword [edi + 0x4a8], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x10017df8
push edi
call fcn.1001d610
mov dword [edi + 0x59818], eax
call ebx
mov esi, eax
sub esi, dword [edi + 0x5981c]
cmp dword [edi + 0x59798], 0
jne 0x10017dde
cmp dword [edi + 0x158], 0
je 0x10017db6
mov eax, dword [edi + 0x59818]
cmp eax, dword [edi + 0x160]
jae 0x10017db6
mov eax, dword [edi + 0x5975c]
call fcn.10003b60
cmp eax, dword [edi + 0x15c]
jbe 0x10017db6
cmp esi, dword [edi + 0x164]
jae 0x10017db6
mov ecx, edi
call fcn.10017cd0
test eax, eax
je 0x10017dde
push edi
call fcn.10019d50
push edi
call fcn.1001a190
push edi
call fcn.10018d60
mov eax, edi
call fcn.10018bf0
cmp dword [edi + 0x4a4], 0
jne 0x10017dde
push edi
call fcn.1001ad10
cmp dword [edi + 0x158], 0
je 0x10017df8
cmp dword [edi + 0x59818], 0
jne 0x10017df8
call ebx
mov dword [edi + 0x5981c], eax
call ebx
sub eax, dword [edi + 0x597e8]
cmp eax, 0x4e20
jbe 0x10017e3d
cmp dword [edi + 0x597e4], 1
jbe 0x10017e3d
lea esi, [edi + 0x597dc]
call fcn.1001d900
push edi
call fcn.1001a920
pop esi
pop ebx
pop ecx
ret
cmp dword [edi + 0x4a8], 0
jne 0x10017e3d
call fcn.1007f280
test eax, eax
jne 0x10017e3d
push edi
call fcn.10018d60
push edi
call fcn.1001a920
pop esi
pop ebx
pop ecx
ret
Function at 0x10022b40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, eax
test esi, esi
je 0x10022b8f
mov eax, 0x10037970
test eax, eax
je 0x10022b8f
mov dword [0x100bbc50], 0
mov dword [0x100bbc60], esi
mov dword [0x100bbc64], 0x10037970
call fcn.10081ab1
cdq
mov ecx, 5
idiv ecx
add edx, 0xb
mov dword [0x100bbc50], edx
call fcn.100225b0
cmp dword [0x100bbc54], 0
jne 0x10022b94
xor eax, eax
pop esi
pop ecx
ret
call fcn.10022680
call fcn.10022710
test al, al
je 0x10022b8f
mov edx, dword [0x100bbc58]
add edx, 5
push edi
push edx
call fcn.10080a42
add esp, 4
mov edi, eax
call fcn.10022580
mov ecx, dword [0x100bbc58]
cmp eax, ecx
je 0x10022bcc
pop edi
xor eax, eax
pop esi
pop ecx
ret
lea eax, [ecx + esi]
add ecx, edi
sub eax, ecx
mov byte [ecx], 0xe9
sub eax, 5
mov dword [ecx + 1], eax
mov ecx, dword [0x100bbc58]
lea eax, [esp + 8]
push eax
push 0x40
add ecx, 5
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.10022810
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x10023e50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10c
mov eax, dword [0x100b8070]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
mov ebp, dword [esp + 0x114]
push esi
mov esi, ecx
test esi, esi
mov dword [esp + 8], esi
je 0x10023fb3
test ebp, ebp
je 0x10023fb3
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10023e88
sub eax, edx
push ebx
mov ebx, eax
mov eax, ebp
mov dword [esp + 0x10], ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10023ea0
sub eax, edx
test ebx, ebx
push edi
mov edi, eax
je 0x10023f98
test bl, 1
jne 0x10023f98
test edi, edi
je 0x10023f98
push 0xff
lea eax, [esp + 0x1d]
push 0
push eax
mov byte [esp + 0x24], cl
call fcn.10082ee0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10023ee4
sub eax, edx
cmp eax, 0x100
jbe 0x10023efd
mov eax, 0x100
jmp 0x10023f0d
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10023f02
sub eax, edx
push eax
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.10083e00
lea edx, [esp + 0x24]
push edx
call fcn.10023d30
mov esi, dword [esp + 0x24]
add esp, 0x10
xor ebx, ebx
shr esi, 1
je 0x10023f4d
mov eax, ebx
xor edx, edx
div edi
mov cl, bl
and cl, 3
add ebx, 1
mov al, byte [edx + ebp]
sar al, cl
not al
xor byte [esp + ebx + 0x17], al
cmp ebx, esi
jb 0x10023f30
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10023f54
sub eax, edx
add eax, 1
cmp eax, 0x100
jbe 0x10023f70
mov eax, 0x100
jmp 0x10023f85
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10023f77
sub eax, edx
add eax, 1
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.10083e00
add esp, 0xc
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.10080c07
add esp, 0x10c
ret
mov ecx, dword [esp + 0x110]
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.10080c07
add esp, 0x10c
ret
Function at 0x100352b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100b8070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.100355a0
call fcn.10035260
xor ebx, ebx
cmp eax, ebx
jle 0x100353f2
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [0x100bb614]
mov ecx, dword [ebp - 0x18]
push ebx
push 4
lea edx, [ebp - 0x10]
push edx
lea edx, [ecx + eax + 0x18]
push edx
push 0xffffffffffffffff
mov dword [ebp - 0x10], ebx
call esi
mov al, byte [ebp - 0x10]
push ebx
push 4
lea ecx, [ebp - 0x14]
mov byte [ebp - 6], al
mov eax, dword [0x100bb610]
push ecx
push eax
push 0xffffffffffffffff
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
mov byte [ebp - 0xa], 0x31
mov byte [ebp - 9], 0x4d
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov dword [ebp - 0x14], eax
call esi
test eax, eax
je 0x100353dc
mov eax, dword [ebp - 0x14]
push ebx
push 4
lea edx, [ebp - 0x14]
push edx
add eax, 0x4644
push eax
push 0xffffffffffffffff
call esi
test eax, eax
je 0x100353dc
mov edx, dword [ebp - 0x14]
push ebx
push 4
lea ecx, [ebp - 0x14]
push ecx
add edx, 4
push edx
push 0xffffffffffffffff
call esi
test eax, eax
je 0x100353dc
cmp dword [ebp - 0x14], ebx
je 0x100353dc
mov eax, dword [0x100bb610]
push ebx
push 4
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x10], eax
call esi
test eax, eax
je 0x100353a5
mov eax, dword [ebp - 0x10]
push ebx
push 4
lea edx, [ebp - 0x10]
push edx
add eax, 0x4644
push eax
push 0xffffffffffffffff
call esi
test eax, eax
je 0x100353a5
mov ebx, dword [ebp - 0x10]
mov ecx, dword [0x100bb61c]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ecx
pushal
mov ecx, dword [ebp - 0x20]
mov edx, 6
mov eax, dword [ebp - 0x24]
push edx
push eax
call dword [ebp - 0x10]
popal
mov eax, dword [ebp - 0x14]
xor ebx, ebx
push ebx
push 7
lea edx, [ebp - 0xc]
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [ebp - 0x18], 0x24
sub dword [ebp - 0x1c], 1
jne 0x100352e9
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10080c07
mov esp, ebp
pop ebp
ret
Function at 0x10035410
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x100b8070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.100355a0
call fcn.10035260
mov edi, eax
xor ebx, ebx
cmp edi, ebx
mov dword [ebp - 0x30], edi
je 0x10035582
mov dword [ebp - 0x28], ebx
jle 0x10035582
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], ebx
mov edx, dword [0x100bb614]
mov eax, dword [ebp - 0x24]
push ebx
push 4
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [eax + edx + 0x18]
push ecx
push 0xffffffffffffffff
mov dword [ebp - 0x1c], ebx
call esi
mov dl, byte [ebp - 0x28]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push 4
mov byte [ebp - 0xa], dl
lea edx, [ebp - 0x20]
mov dword [ebp - 0x12], eax
mov eax, dword [0x100bb610]
push edx
push eax
push 0xffffffffffffffff
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], 0x11
mov byte [ebp - 0x16], 0x49
mov byte [ebp - 0x15], 0x6d
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], 1
mov dword [ebp - 0xe], ecx
mov dword [ebp - 0x20], eax
call esi
test eax, eax
je 0x10035565
mov ecx, dword [ebp - 0x20]
push ebx
push 4
lea eax, [ebp - 0x20]
push eax
add ecx, 0x4644
push ecx
push 0xffffffffffffffff
call esi
test eax, eax
je 0x10035565
mov eax, dword [ebp - 0x20]
push ebx
push 4
lea edx, [ebp - 0x20]
push edx
add eax, 4
push eax
push 0xffffffffffffffff
call esi
test eax, eax
je 0x10035565
cmp dword [ebp - 0x20], ebx
je 0x10035565
mov eax, dword [0x100bb610]
push ebx
push 4
lea ecx, [ebp - 0x1c]
push ecx
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x1c], eax
call esi
test eax, eax
je 0x1003552b
mov eax, dword [ebp - 0x1c]
push ebx
push 4
lea edx, [ebp - 0x1c]
push edx
add eax, 0x4644
push eax
push 0xffffffffffffffff
call esi
test eax, eax
je 0x1003552b
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [0x100bb61c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ecx
pushal
mov ecx, dword [ebp - 0x2c]
mov edx, 6
mov eax, dword [ebp - 0x34]
push edx
push eax
call dword [ebp - 0x1c]
popal
mov eax, dword [ebp - 0x20]
xor ebx, ebx
push ebx
push 0x13
lea edx, [ebp - 0x18]
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x28]
add dword [ebp - 0x24], 0x24
add eax, 1
cmp eax, edi
mov dword [ebp - 0x28], eax
jl 0x10035454
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10080c07
mov esp, ebp
pop ebp
ret 8
Function at 0x10037c50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], 0
je 0x10037cc8
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push eax
push 0x40
push 2
push esi
call edi
test eax, eax
je 0x10037cc8
lea ecx, [esp + 8]
push ecx
push 2
lea edx, [esp + 0x18]
push edx
add esi, 0xc
push esi
mov dword [esp + 0x20], 0xffff
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push eax
push ecx
push 2
push esi
call edi
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x1003c4a0
Capabilities:
Log keystrokes

Disassembly:
push ecx
cmp dword [esp + 8], 0
push esi
mov esi, ecx
je 0x1003c61e
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push edi
push 0
push 0xd
call ebp
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
and eax, 0xff
mov ebx, eax
shl ebx, 0x10
mov eax, ebx
or eax, 1
push eax
push 0xd
push 0x100
push ecx
call edi
mov edx, dword [esi + 4]
or ebx, 0xc0000001
push ebx
push 0xd
push 0x101
push edx
call edi
push 0x2f
call dword [sym.imp.USER32.dll_OemKeyScan]
mov ebx, eax
push 1
push ebx
call ebp
mov edx, dword [esi + 4]
and ebx, 0xff
shl ebx, 0x10
mov ecx, ebx
or ecx, 1
push ecx
push eax
push 0x100
push edx
mov dword [esp + 0x20], eax
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 4]
or ebx, 0xc0000001
push ebx
push eax
push 0x101
push ecx
call edi
push 0
push 8
call ebp
and eax, 0xff
mov ebx, eax
mov eax, dword [esi + 4]
shl ebx, 0x10
mov edx, ebx
or edx, 1
push edx
push 8
push 0x100
push eax
call edi
mov ecx, dword [esi + 4]
mov ebp, ebx
or ebp, 0x40000001
push ebp
push 8
push 0x100
push ecx
call edi
mov edx, dword [esi + 4]
push ebp
push 8
push 0x100
push edx
call edi
push ebp
push 8
mov eax, dword [esi + 4]
push 0x100
push eax
call edi
mov ecx, dword [esi + 4]
or ebx, 0xc0000001
push ebx
push 8
push 0x101
push ecx
call edi
mov ebp, dword [esp + 0x18]
mov eax, ebp
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x1003c5b0
sub eax, ecx
xor ebx, ebx
test eax, eax
mov dword [esp + 0x18], eax
jle 0x1003c5e0
movsx edx, byte [ebx + ebp]
mov eax, dword [esi + 4]
push 0
push edx
push 0x102
push eax
call edi
add ebx, 1
cmp ebx, dword [esp + 0x18]
jl 0x1003c5c5
push 0
push 0xd
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, dword [esi + 4]
and eax, 0xff
mov ebx, eax
shl ebx, 0x10
mov ecx, ebx
or ecx, 1
push ecx
push 0xd
push 0x100
push edx
call edi
mov eax, dword [esi + 4]
or ebx, 0xc0000001
push ebx
push 0xd
push 0x101
push eax
call edi
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 4
Function at 0x10045310
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009e7b4
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x100b8070]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
mov dword [esp + 0x14], ebx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ebx
mov byte [esi + 0x58], bl
mov dword [esi + 0x74], vtable.CDictation.0
mov dword [esi + 0x84], 1
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x88], ebx
lea eax, [esi + 0x8c]
push eax
mov byte [esp + 0x18], 4
call fcn.10016800
mov dword [esi + 0xb2a14], 0x2570
mov dword [esi + 0xb2a18], ebx
mov dword [esi + 0xb2a1c], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x100469b0
Capabilities:
Terminate thread

Disassembly:
push ebp
push esi
mov ebp, 1
lea esi, [edi + 0x8c]
mov dword [ebx + 4], ebp
call fcn.10016fd0
mov eax, dword [edi + 0xb2a18]
test eax, eax
je 0x100469e2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0xb2a18], 0
mov dword [ebx + 8], ebp
pop esi
mov dword [0x100bb2bc], ebp
pop ebp
ret

Function at 0x10046ac0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100b65f8
push 0x10082880
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100b8070]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
call fcn.10037a00
call fcn.10037c50
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], ebx
push str.f101019
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, ebx
je 0x10046b83
push 0xc
push ebx
push ebx
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x10046b83
push ebx
push ebx
mov eax, dword [esi]
push eax
push 0x10046a00
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100bb2b0], eax
cmp eax, ebx
je 0x10046b83
mov ecx, dword [esi + 0x10]
mov dword [0x100bb2b4], ecx
mov edx, dword [esi + 0x20]
mov dword [0x100bb2b8], edx
mov eax, dword [esi + 0x40]
mov dword [0x100bb2ac], eax
mov ecx, dword [esi + 0x70]
mov dword [0x100bb2a0], ecx
mov dword [ebp - 0x24], 1
mov dword [esi], ebx
call fcn.1007c7c0
mov dword [ebp - 4], 0xfffffffe
call fcn.10046bac
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004bc80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10096971
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100b8070]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esi], vtable.CPaths.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov byte [esp + 0x14], 2
call fcn.1004f270
fld dword [esp + 0x20]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edi
fstp dword [esi + 0x40]
mov dword [esi + 0x44], 0x2710
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x10050860
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
mov eax, dword [ebx + 0x14]
cmp dword [eax + 0x54c], 1
push esi
push edi
jne 0x100508a2
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [ebx + 0x591a4]
cmp eax, 0x1388
jbe 0x100508a2
mov eax, dword [ebx + 0x14]
call fcn.10019ff0
test eax, eax
je 0x100508a2
push 0x10
call fcn.10046e70
add esp, 4
call esi
mov dword [ebx + 0x591a4], eax
call fcn.1007fb40
test eax, eax
je case.default.0x100509b7
mov ecx, dword [ebx + 0x14]
mov esi, dword [ecx + 0x5975c]
mov edx, dword [esi]
mov eax, dword [edx + 0x54]
push 0x1b
mov ecx, esi
call eax
cmp eax, 0xa
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jl 0x100508e0
mov edx, dword [esi]
mov eax, dword [edx + 0x64]
push 0x1b
mov ecx, esi
call eax
push 0x1f4
call edi
mov edx, dword [esi]
mov eax, dword [edx + 0x54]
push 0x1c
mov ecx, esi
call eax
cmp eax, 0xa
jl 0x10050902
mov edx, dword [esi]
mov eax, dword [edx + 0x64]
push 0x1c
mov ecx, esi
call eax
push 0x1f4
call edi
mov edx, dword [esi]
mov eax, dword [edx + 0x54]
push 0x1d
mov ecx, esi
call eax
cmp eax, 0xa
jl 0x10050924
mov edx, dword [esi]
mov eax, dword [edx + 0x64]
push 0x1d
mov ecx, esi
call eax
push 0x1f4
call edi
mov edx, dword [esi]
mov eax, dword [edx + 0x54]
push 0x1e
mov ecx, esi
call eax
cmp eax, 0xa
jl 0x10050946
mov edx, dword [esi]
mov eax, dword [edx + 0x64]
push 0x1e
mov ecx, esi
call eax
push 0x1f4
call edi
mov edx, dword [esi]
mov eax, dword [edx + 0x54]
push 0x1f
mov ecx, esi
call eax
cmp eax, 0xa
jl 0x10050968
mov edx, dword [esi]
mov eax, dword [edx + 0x64]
push 0x1f
mov ecx, esi
call eax
push 0x1f4
call edi
mov edx, dword [esi]
mov eax, dword [edx + 0x54]
push 0x20
mov ecx, esi
call eax
cmp eax, 0xa
jl 0x1005098a
mov edx, dword [esi]
mov eax, dword [edx + 0x64]
push 0x20
mov ecx, esi
call eax
push 0x1f4
call edi
mov edx, dword [esi]
mov eax, dword [edx + 0x54]
push 0x21
mov ecx, esi
call eax
cmp eax, 0xa
jl 0x100509ac
mov edx, dword [esi]
mov eax, dword [edx + 0x64]
push 0x21
mov ecx, esi
call eax
push 0x1f4
call edi
mov ecx, dword [ebx + 0x14]
mov eax, dword [ecx + 0x24]
cmp eax, 9
ja case.default.0x100509b7
jmp dword [eax*4 + 0x10050a28]
push ebx
call fcn.10050a50
pop edi
pop esi
pop ecx
ret
push ebx
call fcn.10050e00
pop edi
pop esi
pop ecx
ret
push ebx
call fcn.10051a50
pop edi
pop esi
pop ecx
ret
push ebx
call fcn.10052730
pop edi
pop esi
pop ecx
ret
push ebx
call fcn.10053470
pop edi
pop esi
pop ecx
ret
push ebx
call fcn.100521e0
pop edi
pop esi
pop ecx
ret
push ebx
call fcn.10053df0
pop edi
pop esi
pop ecx
ret
mov ecx, ebx
call fcn.10054bb0
pop edi
pop esi
pop ecx
ret
mov ecx, ebx
call fcn.10055010
pop edi
pop esi
pop ecx
ret
mov eax, ebx
call fcn.10054ec0
pop edi
pop esi
pop ecx
ret