joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037e40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a69b6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100d1400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 2
mov eax, 0x3f
mov dword [esi + 4], 0x3f800000
mov word [esi + 0x3c], ax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x3f800000
call fcn.10037fa0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10039bd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100d1400]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100d3ed8], 0
push ebx
push esi
push edi
jne 0x10039d24
mov eax, dword [0x100d1ec8]
mov ebx, dword [eax + 0x84]
lea ecx, [eax + 0x84]
mov dword [ebp - 0x18], ecx
cmp dword [ebx + 0x10], 0
jne 0x10039c79
cmp dword [ebx + 0xc], 0
jne 0x10039c2a
cmp dword [ebx + 0x44], 0
jne 0x10039c1e
push ecx
mov ecx, ebx
call fcn.10036580
mov ecx, ebx
call fcn.10036b70
mov eax, dword [0x100d1ec8]
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x10039c79
mov ecx, dword [ebx + 0x14]
imul ecx, dword [ebx + 0x18]
inc dword [eax + 0x318]
mov eax, dword [eax + 0xc0]
shl ecx, 2
push ecx
call eax
mov ecx, dword [ebx + 0x14]
add esp, 4
imul ecx, dword [ebx + 0x18]
mov edx, eax
mov dword [ebx + 0x10], edx
test ecx, ecx
jle 0x10039c79
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
shl eax, 0x18
lea edx, [edx + 4]
or eax, 0xffffff
dec ecx
mov dword [edx - 4], eax
test ecx, ecx
jg 0x10039c60
mov eax, dword [ebx + 0x14]
mov edi, dword [ebx + 0x10]
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
push 0x8069
call dword [sym.imp.OPENGL32.dll_glGetIntegerv]
push 0x100d3ed8
push 1
call dword [sym.imp.OPENGL32.dll_glGenTextures]
push dword [0x100d3ed8]
push 0xde1
call dword [sym.imp.OPENGL32.dll_glBindTexture]
mov esi, dword [sym.imp.OPENGL32.dll_glTexParameteri]
push 0x2601
push 0x2801
push 0xde1
call esi
push 0x2601
push 0x2800
push 0xde1
call esi
push 0
push 0xcf2
call dword [sym.imp.OPENGL32.dll_glPixelStorei]
push edi
push 0x1401
push 0x1908
push 0
push ebx
push dword [ebp - 0x1c]
push 0x1908
push 0
push 0xde1
call dword [sym.imp.OPENGL32.dll_glTexImage2D]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, dword [0x100d3ed8]
mov dword [ecx], eax
push dword [ebp - 0x14]
push 0xde1
call dword [sym.imp.OPENGL32.dll_glBindTexture]
movd xmm0, dword [0x100d3aa4]
lea eax, [ebp - 0x10]
movd xmm1, dword [0x100d3aa8]
mov edi, dword [0x100d1ec8]
cvtdq2ps xmm0, xmm0
push eax
mov dword [edi + 0x94], 0x3f800000
mov dword [edi + 0x98], 0x3f800000
cvtdq2ps xmm1, xmm1
movss dword [edi + 4], xmm0
movss dword [edi + 8], xmm1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [0x100d3ec8]
mov edx, dword [ebp - 0xc]
sbb edx, dword [0x100d3ecc]
call fcn.100a1bd0
mov edx, dword [0x100d3ec4]
mov ecx, dword [0x100d3ec0]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.100a1bd0
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0xc], xmm1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [0x100d3ec8], eax
mov dword [0x100d3ecc], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xe9], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xea], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xec], 0
mov byte [edi + 0xeb], al
call fcn.100131b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007a635
mov esp, ebp
pop ebp
ret
Function at 0x10048240
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a70cf
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100d1400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 8]
lea ecx, [ebx + 0x70]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], eax
mov dword [ebx], 0x100bbea4
call fcn.10048f30
sub esp, 8
mov dword [ebp - 4], 0
lea esi, [ebx + 0x10]
mov dword [ebp - 0x24], 1
mov ecx, ebx
mov dword [ebp - 0x18], esi
push esi
call fcn.10048e40
mov dword [ebp - 4], 1
mov eax, dword [ebx]
mov dword [ebp - 0x14], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + ebx - 4], eax
mov ecx, esi
call fcn.10049040
lea eax, [ebx + 0x10]
lea ebx, [eax + 4]
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [eax + 0xc], ebx
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea esi, [eax + 8]
mov byte [eax + 0x48], 0
lea edi, [eax + 0x14]
mov byte [eax + 0x3d], 0
lea edx, [eax + 0x24]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [0x101255b4]
mov dword [eax], 0
mov eax, dword [0x101255b0]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x18]
mov dword [edi], 0
mov dword [edx], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x38], 0
mov byte [ebp - 4], 2
cmp dword [ebx + 0x4c], 0
jne 0x100483d6
push 0x40
push 1
push dword [ebp - 0x1c]
call fcn.10077044
add esp, 0xc
test eax, eax
je 0x100483d6
push 1
push eax
mov ecx, ebx
call fcn.10048c50
mov eax, dword [ebx + 0x34]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.100495a0
add esp, 4
mov ecx, ebx
push eax
call fcn.10048af0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x100483bf
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x100483bf
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp - 0x10]
push 0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, esi
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.1003d710
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10048e40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a713d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100d1400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [edi]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov esi, dword [eax + 4]
add esi, edi
mov ecx, esi
call fcn.1003d790
mov eax, dword [ebp + 8]
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x3c], 0
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 1
push eax
call fcn.10049470
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov byte [ebp - 4], 0
mov bl, al
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10048ef8
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x10048ef8
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x10048f11
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.1003d710
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10049040
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a6b20
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100d1400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1007a728
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10076cc1
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.10048fe0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10054130
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100d1400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100d3f24]
push esi
push edi
test ebx, ebx
je 0x100541f7
mov edi, dword [0x100d3f2c]
test edi, edi
je 0x100541f7
add edi, 0xfffffffb
mov edx, ebx
cmp ebx, edi
jae 0x100541f7
mov esi, ebx
sub esi, 0x100bf70c
nop dword [eax]
nop dword [eax + eax]
xor eax, eax
nop dword [eax]
nop word [eax + eax]
mov cl, byte [eax + 0x100bf70c]
cmp cl, byte [esi + eax + 0x100bf70c]
jne 0x100541ed
inc eax
cmp eax, 5
jb 0x10054190
mov dword [ebp - 0xc], edx
test edx, edx
je 0x100541fe
lea edi, [ebx - 2]
mov eax, edx
cmp edx, edi
jbe 0x100542ce
mov esi, edx
mov dword [ebp - 0xc], edx
sub esi, 0x100bf714
nop dword [eax]
nop dword [eax + eax]
xor ecx, ecx
mov al, byte [ecx + 0x100bf714]
cmp al, byte [esi + ecx + 0x100bf714]
jne 0x100542c1
inc ecx
cmp ecx, 2
jb 0x100541d2
jmp 0x10054200
inc edx
inc esi
cmp edx, edi
jb 0x10054180
mov dword [ebp - 0xc], 0
xor edx, edx
mov eax, dword [ebp - 0xc]
push 0xb
push eax
push edx
push str.x____x____xx
push 0x100bf728
call fcn.100544a0
mov edi, eax
mov eax, dword [0x100d3f2c]
cmp ebx, eax
mov ecx, eax
cmovbe ecx, ebx
cmp edi, ecx
jb 0x100542d5
cmp ebx, eax
cmovbe ebx, eax
cmp edi, ebx
ja 0x100542d5
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov bl, 0x90
mov dword [0x100d3f90], edi
movzx eax, byte [edi]
mov byte [0x100d3f94], al
movzx eax, byte [edi + 1]
mov byte [0x100d3f95], al
movzx eax, byte [edi + 2]
push 0x100d8a94
mov byte [0x100d3f96], al
movzx eax, byte [edi + 3]
push 0x40
mov byte [0x100d3f97], al
movzx eax, byte [edi + 4]
push 5
push edi
mov byte [0x100d3f98], al
mov dword [ebp - 0xc], 0x90909090
call esi
mov eax, dword [ebp - 0xc]
push 0x100d8a94
mov dword [edi], eax
mov byte [edi + 4], bl
push dword [0x100d8a94]
push 5
push edi
call esi
push 5
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007a635
mov esp, ebp
pop ebp
ret
dec edx
dec esi
cmp edx, edi
ja 0x100541d0
mov eax, dword [ebp - 0xc]
xor edx, edx
jmp 0x10054203
push str.COffsets::PatchInterpolationTime
push str._s:_not_found._n
call fcn.10065d50
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor al, al
pop edi
pop esi
pop ebx
call fcn.1007a635
mov esp, ebp
pop ebp
ret

Function at 0x10058f80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a7dd0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
mov eax, dword [0x100d1400]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebx + 8]
push dword [0x100bba48]
Function at 0x1005f2b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a735d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100d1400]
xor eax, ebp
mov dword [ebp - 0x14], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov eax, edx
mov dword [0x100d8a88], 1
lea edi, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1005f2f0
mov ecx, 0x7fffffff
sub eax, edi
sub ecx, dword [0x100d21c4]
cmp ecx, eax
jb 0x1005f401
cmp dword [0x100d21c8], 0xf
mov ecx, 0x100d21b4
push eax
cmova ecx, dword [0x100d21b4]
push edx
push dword [0x100d21c4]
push ecx
push ecx
push dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
call fcn.1000ddb0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0xf
push 0
cmova eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
sub esp, 0x18
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.100486b0
call fcn.100562d0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.100486b0
call fcn.10057600
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.100486b0
call fcn.10058f80
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.100486b0
call fcn.1005d5a0
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.100486b0
call fcn.1005b000
lea eax, [ebp - 0x2c]
mov ecx, esp
push eax
call fcn.100486b0
call fcn.1005c100
mov ecx, dword [ebp - 0x18]
add esp, 0x18
cmp ecx, 0xf
jbe 0x1005f3e5
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1005f3db
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005f406
push ecx
push edx
call fcn.1007a86d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007a635
mov esp, ebp
pop ebp
ret 4
call fcn.100017b0
call fcn.100809b1
int3
Function at 0x1005fd30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100d1400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x100b2dc0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call fcn.1008b21c
mov edi, dword [ebp - 8]
add esp, 0xc
test edi, edi
jne 0x1005fd7c
lea eax, [edi - 3]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007a635
mov esp, ebp
pop ebp
ret 4
push 2
push 0
push edi
call fcn.1008a725
add esp, 0xc
test eax, eax
je 0x1005fd94
mov esi, 0xfffffffd
jmp 0x1005fe06
push edi
call fcn.10089b2f
mov esi, eax
add esp, 4
test esi, esi
js 0x1005fd8d
jne 0x1005fda9
xor esi, esi
jmp 0x1005fe06
lea eax, [esi + 1]
push 0x100ab032
push eax
call fcn.1007ae2c
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1005fdc5
lea esi, [eax - 2]
jmp 0x1005fe06
push 0
push 0
push edi
mov byte [ebx + esi], 0
call fcn.1008a725
add esp, 0xc
push edi
push esi
push 1
push ebx
call fcn.1008b449
add esp, 0x10
cmp eax, esi
je 0x1005fdf4
push ebx
call fcn.1007a643
mov esi, 0xfffffffd
jmp 0x1005fe03
push eax
push ebx
call fcn.10060ac0
push ebx
mov esi, eax
call fcn.1007a643
add esp, 4
push dword [ebp - 8]
call fcn.1008a3e0
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1007a635
mov esp, ebp
pop ebp
ret 4

Function at 0x10063590
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [0x100d43e0], 0
push esi
je 0x100635be
cmp dword [0x100d43e4], 0
je 0x100635b5
cmp byte [0x100d4078], 0
je 0x100635be
cmp byte [0x10124ff4], 0
je 0x100635ea
cmp byte [0x1012552e], 0
je 0x100635de
cmp byte [0x100d43e8], 0
je 0x100635de
push str._forward
call dword [0x100d3868]
add esp, 4
mov byte [0x1012552e], 0
pop esi
mov esp, ebp
pop ebp
ret
movss xmm0, dword [0x100d43ec]
divss xmm0, dword [0x100c26c4]
mulss xmm0, dword [0x100c2620]
cvtps2pd xmm1, xmm0
movsd xmm0, qword [0x100d23c8]
addsd xmm1, qword [0x100c2570]
ucomisd xmm0, xmm1
movsd qword [esp + 8], xmm1
lahf
test ah, 0x44
jnp 0x10063689
push 0x100d8a94
push 0x40
push 8
push dword [0x100d3f88]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [esp + 8]
mulsd xmm0, qword [0x100c2610]
mov eax, dword [0x100d3f88]
push 0x100d8a94
movsd qword [eax], xmm0
push dword [0x100d8a94]
mov esi, dword [0x100d3f88]
push 8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [esp + 8]
movsd qword [0x100d23c8], xmm0
cmp byte [0x100d43e8], 0
je 0x100636b0
cmp byte [0x1012552e], 0
jne 0x100636a2
mov byte [0x1012552e], 1
push str.forward
call dword [0x100d3868]
add esp, 4
mov byte [0x1012552e], 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10065ca0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x100d8a94
push 0x40
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne al
pop ebp
ret 8

Function at 0x10065d00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push 0x100d8a94
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 0xc]
push 0x100d8a94
mov eax, dword [ecx]
mov dword [edi], eax
mov al, byte [ecx + 4]
mov byte [edi + 4], al
push dword [0x100d8a94]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop ebp
ret 0xc
Function at 0x10068170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movsd xmm0, qword [0x100d23c8]
ucomisd xmm0, xmm1
movsd qword [ebp - 8], xmm1
lahf
test ah, 0x44
jnp 0x100681f1
push esi
push 0x100d8a94
push 0x40
push 8
push dword [0x100d3f88]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [ebp - 8]
mulsd xmm0, qword [0x100c2610]
mov eax, dword [0x100d3f88]
push 0x100d8a94
movsd qword [eax], xmm0
push dword [0x100d8a94]
mov esi, dword [0x100d3f88]
push 8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [ebp - 8]
movsd qword [0x100d23c8], xmm0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10078650
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10078410
add esp, 4
test eax, eax
jne 0x100786ac
mov dword [ebp - 4], 9
jmp 0x10078739
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x10078739
mov dword [ebp - 8], 0
jmp 0x100786ca
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10078739
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1007b6e8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10078737
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.1007b6e8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.10078230
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1007b6e8
jmp 0x100786c1
mov eax, dword [ebp - 4]
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.1007b6e8
mov esp, ebp
pop ebp
ret

Function at 0x10078750
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x100787fb
mov dword [ebp - 4], 0
jmp 0x10078783
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x100787de
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1007b6e8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100787dc
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.1007b6e8
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1007b6e8
jmp 0x1007877a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x100d2cb4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.1007b6e8
pop esi
add esp, 8
cmp ebp, esp
call fcn.1007b6e8
mov esp, ebp
pop ebp
ret