joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004f593
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf5c
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
lea eax, [ebp - 0xf58]
push esi
push edi
mov ecx, 0x284
lea edi, [ebp - 0xf58]
lea esi, [ebx + 8]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0xa18]
mov ecx, 0x84
lea edi, [ebp - 0x218]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0xc28]
mov ecx, 0xcc
lea edi, [ebp - 0x548]
rep movsd dword es:[edi], dword [esi]
push 0xa10
xor esi, esi
push eax
mov dword [ebp - 0xf54], esi
call fcn.100167df
mov dword [ebp - 0xf54], eax
mov edi, 0x210
push edi
lea eax, [ebp - 0x218]
mov dword [ebp - 0x14], esi
push eax
call fcn.100167df
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x548]
push 0x330
push eax
mov dword [ebp - 0x540], esi
call fcn.100167df
mov dword [ebp - 0x540], eax
lea ecx, [ebp - 0xf58]
mov eax, 0x7473754d
lea edx, [edi + 0x74]
xor dword [ecx], eax
inc eax
lea ecx, [ecx + 4]
sub edx, 1
jne 0x1004f643
lea ecx, [ebp - 0x218]
mov edx, 0x84
xor dword [ecx], eax
inc eax
lea ecx, [ecx + 4]
sub edx, 1
jne 0x1004f659
lea ecx, [ebp - 0x548]
mov edx, 0xcc
xor dword [ecx], eax
inc eax
lea ecx, [ecx + 4]
sub edx, 1
jne 0x1004f66f
mov eax, dword [ebx + 0x1f58]
push dword [ebx + 0x1f60]
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebx + 0x1f58]
lea edx, [ebp - 0xf5c]
push edx
push 0xa10
lea edx, [ebp - 0xf58]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x18]
mov esi, bind
test esi, eax
jne 0x1004f6fb
mov eax, dword [ebx + 0x1f58]
lea edx, [ebp - 0xf5c]
push edx
push edi
lea edx, [ebp - 0x218]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x18]
test esi, eax
jne 0x1004f6fb
mov eax, dword [ebx + 0x1f58]
lea edx, [ebp - 0xf5c]
push edx
push 0x330
lea edx, [ebp - 0x548]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x18]
test esi, eax
jne 0x1004f6fb
xor eax, eax
jmp 0x1004f700
mov eax, 0xe001000d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
leave
ret
Function at 0x10053116
Capabilities:
Delete file

Disassembly:
push 0x1c
mov eax, 0x101a4c36
call fcn.1017516e
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], 0x10206714
and dword [ebp - 4], 0
or dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0x102066b4
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x1005314b
mov eax, dword [esi]
push 0
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1004d5a0
test eax, eax
jns 0x10053176
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10053165
mov eax, dword [esi]
push edi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1004d5a0
mov edi, eax
test edi, edi
js 0x100531d7
push 2
push 0
push 0xfffffffffffffff4
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x28]
push eax
push 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1004d786
mov edi, eax
test edi, edi
js 0x100531d7
cmp dword [ebp - 0x28], 0xc
je 0x100531ab
mov edi, 0xe0010001
jmp 0x100531d7
lea eax, [ebp - 0x24]
push eax
call fcn.1004d75e
cmp dword [ebp - 0x1c], 0x6368784c
jne 0x100531c6
cmp dword [ebp - 0x14], 0xbb8
jbe 0x100531d5
cmp dword [esi + 0x14], 8
jb 0x100531ce
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.1004d54f
mov eax, edi
call fcn.10175118
ret 4

Function at 0x10054b6d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x1e
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x10054b78
xor eax, eax
mov word [esi + 0x40], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x10055cc1
Capabilities:
Encode data using xor
Resolve dns

Disassembly:
push 0x40
mov eax, 0x101a5081
call fcn.1017516e
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
test esi, esi
je 0x10055e68
test edi, edi
je 0x10055e68
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x10055cf3
mov eax, dword [esi]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x10055d11
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
or eax, 0xe0300000
jmp 0x10055e6d
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
mov dword [ebp - 4], ebx
cmp dword [edi + 0x14], 0x10
jb 0x10055d31
mov edi, dword [edi]
cmp dword [esi + 0x14], 0x10
jb 0x10055d39
mov esi, dword [esi]
mov dword [ebp - 0x1c], 0x78
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor eax, 0x25
mov byte [ebp - 0x18], al
mov eax, dword [ebp - 0x1c]
inc al
xor eax, 0x73
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x1c]
add al, 2
xor eax, 0x3a
mov byte [ebp - 0x16], al
mov eax, dword [ebp - 0x1c]
add al, 3
xor eax, 0x25
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x1c]
add al, 4
xor eax, 0x73
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x1c]
add al, 5
mov byte [ebp - 0x12], bl
xor eax, 0x3a
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x18]
mov al, byte [ebp + edx - 0x18]
mov ecx, dword [ebp - 0x1c]
add cl, dl
movsx eax, al
xor ecx, eax
mov byte [ebp + edx - 0x18], cl
inc edx
cmp edx, 6
jb 0x10055d88
push edi
push esi
lea eax, [ebp - 0x18]
mov byte [ebp - 0x12], bl
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.100167ca
mov esi, dword [ebp - 0x48]
add esp, 0x10
jmp 0x10055e00
mov eax, dword [eax]
mov edx, ebx
mov byte [ebp - 0x44], 0x2d
mov byte [ebp - 0x43], 0x7b
mov byte [ebp - 0x42], 0x34
mov byte [ebp - 0x41], bl
mov cl, byte [ebp - 0x44]
mov cl, byte [ebp + edx - 0x44]
movsx ecx, cl
sub ecx, 8
mov byte [ebp + edx - 0x44], cl
inc edx
cmp edx, 3
jb 0x10055dd0
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.100167ca
add esp, 0xc
add dword [esi + 0xc], 4
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x10055dba
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
mov edx, dword [ebp - 0x30]
cmovae eax, dword [ebp - 0x40]
cmp byte [edx + eax - 1], 0x2c
je 0x10055e25
mov ebx, 0xe0010001
jmp 0x10055e58
mov esi, dword [ebp - 0x4c]
lea eax, [ebp - 0x40]
dec edx
lea edi, [ebp - 0x28]
cmp dword [ebp - 0x2c], 0x10
push 6
cmovae eax, dword [ebp - 0x40]
pop ecx
mov dword [ebp - 0x30], edx
push 6
mov byte [eax + edx], bl
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x4c]
lea esi, [ebp - 0x40]
pop ecx
rep movsd dword es:[edi], dword [esi]
push 6
pop ecx
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10017221
mov eax, ebx
jmp 0x10055e6d
mov eax, 0xe0010001
call fcn.10175118
ret 0xc
Function at 0x1005769a
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 0x3b
jb 0x100576a1
pop edi
mov byte [esi + 0x3f], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x100576d1
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0x26
jb 0x100576db
pop edi
xor eax, eax
pop esi
mov word [edx + 0x50], ax
lea eax, [edx + 4]
pop ebx
ret
Function at 0x10058235
Capabilities:
Encode data using xor

Disassembly:
push 0x40
mov eax, 0x101a575d
call fcn.1017516e
mov ebx, ecx
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
mov dword [ebp - 4], esi
lea eax, [ebp - 0x44]
push edx
push str._p:
push eax
call fcn.10057e5d
mov edi, esi
add esp, 0xc
cmp dword [ebp + 0xc], edi
jbe 0x100582a2
mov ebx, dword [ebp - 0x48]
movzx eax, byte [ebx + edi]
push eax
lea eax, [ebp - 0x44]
push str._02x
push eax
call fcn.10057e5d
add esp, 0xc
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x10058283
mov ebx, dword [ebp - 0x4c]
cmp dword [ebp - 0x30], 8
lea edx, [ebp - 0x44]
mov eax, 0xccf3
cmovae edx, dword [ebp - 0x44]
mov dword [ebp - 0x2c], 0xcc8b
mov word [ebp - 0x28], ax
add eax, 0xfffffff6
mov word [ebp - 0x26], ax
mov eax, 0xccea
mov word [ebp - 0x24], ax
lea ecx, [eax + 0xe]
add eax, 4
mov word [ebp - 0x22], cx
mov word [ebp - 0x20], ax
lea eax, [ecx - 0x47]
mov word [ebp - 0x1e], ax
mov word [ebp - 0x1c], ax
add eax, 0xfffffffa
mov word [ebp - 0x1a], ax
lea eax, [ecx - 0x4a]
mov word [ebp - 0x18], ax
add eax, 0x39
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], cx
mov word [ebp - 0x12], ax
mov ax, word [ebp - 0x28]
mov ax, word [ebp + esi*2 - 0x28]
movzx ecx, ax
movzx eax, word [ebp - 0x2c]
xor ecx, eax
mov word [ebp + esi*2 - 0x28], cx
inc esi
cmp esi, 0xb
jb 0x10058309
push edx
xor eax, eax
lea ecx, [ebp - 0x28]
push ecx
mov word [ebp - 0x12], ax
mov eax, dword [ebx]
push 2
push ebx
call dword [eax + 0x18]
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.1001701c
call fcn.10175118
ret
Function at 0x10062b1f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 0x11
jb 0x10062b26
pop edi
mov byte [esi + 0x15], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x10062b6d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0x11
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x10062b78
mov byte [edi + 0x15], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10062b94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 0xa
jb 0x10062b9b
pop edi
mov byte [esi + 0xe], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x10062c1d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0x16
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x10062c28
mov byte [edi + 0x1a], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10062c8b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 9
jb 0x10062c92
pop edi
mov byte [esi + 0xd], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x10062cb4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0x14
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x10062cbf
mov byte [edi + 0x18], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10062cf4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 0xe
jb 0x10062cfb
pop edi
mov byte [esi + 0x12], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x10062d1d
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0xc
jb 0x10062d27
pop edi
xor eax, eax
pop esi
mov word [edx + 0x1c], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x10062d4c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 0xc
jb 0x10062d53
pop edi
mov byte [esi + 0x10], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret
Function at 0x10062d8e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 4
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x10062d99
mov byte [edi + 8], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10062db5
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0xa
jb 0x10062dbf
pop edi
xor eax, eax
pop esi
mov word [edx + 0x18], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x10062dfb
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 0xf
jb 0x10062e02
pop edi
mov byte [esi + 0x13], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x10062e3d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0xe
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x10062e48
mov byte [edi + 0x12], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10062e64
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0xa
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x10062e6f
xor eax, eax
mov word [esi + 0x18], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10062e92
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 8
jb 0x10062e99
pop edi
mov byte [esi + 0xc], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x10062f1f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0xa
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x10062f2a
mov byte [edi + 0xe], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10062f46
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0xc
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x10062f51
mov byte [edi + 0x10], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x1006562c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x1c], eax
push edi
mov edi, edx
mov byte [ebp - 6], 0
xor edx, edx
mov ebx, dword [esi + 0x10]
mov dword [ebp - 0x18], 0x7d
mov byte [ebp - 0x14], 0x3b
mov byte [ebp - 0x13], 0x13
mov byte [ebp - 0x12], 0x10
mov byte [ebp - 0x11], 0x2c
mov byte [ebp - 0x10], 8
mov byte [ebp - 0xf], 0x18
mov byte [ebp - 0xe], 0xf
mov byte [ebp - 0xd], 4
mov byte [ebp - 0xc], 0x2f
mov byte [ebp - 0xb], 0x18
mov byte [ebp - 0xa], 0xe
mov byte [ebp - 9], 8
mov byte [ebp - 8], 0x11
mov byte [ebp - 7], 9
mov al, byte [ebp - 0x14]
mov al, byte [ebp + edx - 0x14]
movsx ecx, byte [ebp - 0x18]
movsx eax, al
xor eax, ecx
mov byte [ebp + edx - 0x14], al
inc edx
cmp edx, 0xe
jb 0x10065694
mov byte [ebp - 6], 0
lea ecx, [ebp - 0x14]
mov eax, dword [ebx]
push ecx
push ebx
call dword [eax + 0x60]
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
cmp eax, 6
je 0x100656d0
push 1
push ecx
call dword [edx + 0x5c]
mov eax, 0xe023004b
jmp 0x10065726
xor ebx, ebx
inc ebx
push ebx
push 0
push ecx
call dword [edx + 0x48]
test eax, eax
js 0x10065726
mov eax, dword [esi + 0x10]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
test eax, eax
je 0x1006571c
push 0xffffffffffffffff
push ecx
call dword [edx + 0x58]
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
cmp eax, 4
jne 0x1006571c
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
push 0xffffffffffffffff
push ecx
call dword [edx + 0x54]
mov eax, dword [esi + 0x10]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov dword [edi], ebx
jmp 0x10065724
push ebx
push ecx
call dword [edx + 0x5c]
and dword [edi], 0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
leave
ret 8

Function at 0x100661e1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
mov ecx, str.ntdll.dll
push edi
call fcn.10057e19
mov edi, eax
test edi, edi
je 0x10066271
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateFile
push edi
call ebx
mov dword [esi + 8], eax
test eax, eax
je 0x10066271
push str.NtReadFile
push edi
call ebx
mov dword [esi + 0x10], eax
test eax, eax
je 0x10066271
push str.NtOpenFile
push edi
call ebx
mov dword [esi + 0xc], eax
test eax, eax
je 0x10066271
push str.NtClose
push edi
call ebx
mov dword [esi + 0x14], eax
test eax, eax
je 0x10066271
push str.NtQueryInformationFile
push edi
call ebx
mov dword [esi + 4], eax
test eax, eax
je 0x10066271
push str.NtSetInformationFile
push edi
call ebx
mov dword [esi], eax
test eax, eax
je 0x10066271
push str.NtWaitForSingleObject
push edi
call ebx
cmp dword [esi], 0
mov dword [esi + 0x18], eax
pop ebx
je 0x10066271
pop edi
mov eax, esi
pop esi
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xe0ff0000
lea ecx, [ebp - 8]
push eax
call fcn.1000786e
push 0x1026b258
mov eax, ecx
push eax
call fcn.100e172b
int3
Function at 0x10066905
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor eax, eax
shr esi, 2
test esi, esi
je 0x10066956
lea ecx, [edx + 2]
mov dl, byte [ecx - 2]
cmp dl, 0x90
je 0x10066951
cmp dl, 0xcc
je 0x10066951
mov dl, byte [ecx - 1]
cmp dl, 0x90
je 0x10066951
cmp dl, 0xcc
je 0x10066951
mov dl, byte [ecx]
cmp dl, 0x90
je 0x10066951
cmp dl, 0xcc
je 0x10066951
mov dl, byte [ecx + 1]
cmp dl, 0x90
je 0x10066951
cmp dl, 0xcc
je 0x10066951
add eax, dword [ecx - 2]
add ecx, 4
sub esi, 1
jne 0x10066918
pop esi
pop ebp
ret 8
Function at 0x1006da46
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push 0
push 4
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1006da79
mov eax, 0xe0010001
jmp 0x1006db0c
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov dword [ebp - 0x2c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x20]
push eax
push ebx
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
jmp 0x1006dafe
cmp dword [ebp - 0x14], edi
jne 0x1006daf3
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x18], eax
je 0x1006daf3
push dword [ebp - 0x18]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x1006daf3
and dword [ebp - 0x38], 0
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
je 0x1006dae7
mov edi, eax
lea esi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x2c]
add dword [esi + 4], 0x10
jmp 0x1006daf3
lea ecx, [ebp - 0x3c]
push ecx
push eax
mov ecx, esi
call fcn.1004246a
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1006daa2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
leave
ret 4
Function at 0x1006db1c
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x2d4], eax
mov edi, dword [ebx + 4]
mov esi, dword [ebx]
cmp esi, edi
je 0x1006dc25
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1006db62
mov dword [esi + 4], 1
add esi, 0x10
cmp esi, edi
jne 0x1006db4e
mov esi, dword [ebx]
cmp esi, edi
je 0x1006dc25
xor ebx, ebx
cmp dword [esi + 4], 0
jne 0x1006db9f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1006db98
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x1e
jl 0x1006db75
jmp 0x1006db9f
mov dword [esi + 4], 1
add esi, 0x10
cmp esi, edi
jne 0x1006db73
mov esi, dword [ebp + 8]
mov esi, dword [esi]
jmp 0x1006dc21
cmp dword [esi + 4], 0
je 0x1006dc1e
xor ebx, ebx
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d0], 0x10001
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1006dbdc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1006dc12
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x218], eax
jb 0x1006dc1e
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x218], eax
jae 0x1006dc1e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1006dc1a
inc ebx
cmp ebx, 0x1e
jl 0x1006dbb5
jmp 0x1006dc1e
and dword [esi + 4], 0
add esi, 0x10
cmp esi, edi
jne 0x1006dbad
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
leave
ret 0xc
Function at 0x1006dc38
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x101a74bc
call fcn.1017513a
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
push 0xfffffffffffffffe
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1006da46
push dword [ebp + 0x10]
lea eax, [ebp - 0x1c]
push dword [ebp + 8]
push eax
call fcn.1006db1c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100242a4
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edi, dword [ebp - 0x1c]
mov esi, edi
jmp 0x1006dcbb
cmp dword [esi + 4], 0
je 0x1006dcb0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x10
cmp esi, dword [ebp - 0x18]
jne 0x1006dca2
push dword [ebp - 0x10]
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x1006dcef
mov eax, dword [ebp - 0x14]
sub eax, edi
and eax, 0xfffffff0
push eax
push edi
call fcn.10006a60
xor eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.10175103
ret 0xc