joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100038e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe28
push esi
push edi
push str.InitDLL:_Starting_up..._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push str.resdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x10030514], eax
mov dword [0x100304f4], 0x100236e8
mov dword [0x100304f8], 0x10023708
mov dword [0x100304c0], 0x10023738
mov dword [0x10030508], 0
call fcn.10003870
mov ecx, 4
mov eax, 0x10030510
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x10003948
call fcn.10003320
test ax, ax
je 0x10003965
call fcn.10003260
call fcn.10001000
mov eax, dword [0x10030514]
push 0x10023f24
lea ecx, [esp + 0x14]
push 0x100
push ecx
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x724], 0x10003830
mov dword [esp + 0x220], 0
mov dword [esp + 0x21c], 0x65
call fcn.1000e5c8
add esp, 0xc
push 0x10023f2c
lea edx, [esp + 0x21c]
push 0x100
push edx
call fcn.1000e560
add esp, 0xc
push str.BUTTONMPLAYER
lea eax, [esp + 0x31c]
push 0x100
push eax
call fcn.1000e5c8
add esp, 0xc
push str.ToolButtonMplayer
lea ecx, [esp + 0x51c]
push 0x100
push ecx
call fcn.1000e560
add esp, 0xc
push str.Run_Media_Player
lea edx, [esp + 0x61c]
push 0x100
push edx
call fcn.1000e560
mov eax, dword [0x10030514]
add esp, 0xc
push 0x10023f24
lea ecx, [esp + 0x728]
push 0x100
push ecx
mov dword [esp + 0x728], 1
mov dword [esp + 0x72c], eax
mov dword [esp + 0xe38], 0x10003850
mov dword [esp + 0x934], 0
mov dword [esp + 0x930], 0x67
call fcn.1000e5c8
add esp, 0xc
push 0x10023f80
lea edx, [esp + 0x930]
push 0x100
push edx
call fcn.1000e560
add esp, 0xc
push str.BUTTONWEB
lea eax, [esp + 0xa30]
push 0x100
push eax
call fcn.1000e5c8
add esp, 0xc
push str.ToolButtonMSIE
lea ecx, [esp + 0xc30]
push 0x100
push ecx
call fcn.1000e560
add esp, 0xc
push str.Go_Trappola_Library_Website
lea edx, [esp + 0xd30]
push 0x100
push edx
call fcn.1000e560
add esp, 0xc
push 0x400
call fcn.1000df4c
add esp, 4
push 0x400
mov esi, eax
call fcn.1000df4c
add esp, 4
push eax
push esi
lea eax, [esp + 0x10]
push eax
call fcn.10007210
add esp, 0xc
mov esi, 0x10023640
mov edi, 6
mov ecx, esi
call fcn.10003bd0
add esi, 0x18
sub edi, 1
jne 0x10003b05
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004690
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x14]
push ecx
mov edi, 0x100305f8
call fcn.10005360
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x1000475c
call fcn.1000e3ec
xor eax, eax
mov edi, dword [esp + 0x14]
cmp edi, dword [eax + 0x18]
jne 0x100046cc
call fcn.1000e3ec
mov edx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
lea esi, [esp + 0x10]
lea ebx, [esp + 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
call fcn.10005070
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x10004764
call fcn.1000e3ec
xor eax, eax
mov esi, dword [esp + 0x1c]
cmp esi, dword [eax + 0x18]
jne 0x10004704
call fcn.1000e3ec
cmp byte [esi + 0x34], 0
jne 0x10004826
mov ecx, dword [esi + 0x24]
add ecx, dword [esi + 0x28]
push 4
push 0x3000
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0x1c], eax
test ebp, ebp
jne 0x10004768
call fcn.1000e3ec
xor eax, eax
cmp edi, dword [eax + 0x18]
jne 0x1000473c
call fcn.1000e3ec
mov eax, dword [esi + 0x18]
mov edi, dword [edi + 0x18]
dec eax
cmp eax, 0xfe
ja case.0x10004755.3
movzx edx, byte [eax + 0x10004850]
jmp dword [edx*4 + 0x10004840]
mov eax, dword [ebp]
jmp 0x100046be
mov eax, dword [eax]
jmp 0x100046f6
mov eax, dword [ebp]
jmp 0x10004732
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x1c]
push eax
push edi
push ecx
call fcn.1000ebc0
mov eax, dword [esi + 0x1c]
add esp, 0xc
mov byte [esi + 0x34], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov edx, dword [esi + 0x24]
add edx, dword [esi + 0x28]
mov eax, dword [esi + 0x1c]
push edx
push edi
push eax
call fcn.1000ebc0
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x20]
add eax, dword [esi + 0x24]
add esp, 0xc
push ecx
push edx
push eax
call fcn.1000ebc0
mov eax, dword [esi + 0x1c]
add esp, 0xc
mov byte [esi + 0x34], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov ecx, dword [esi + 0x30]
mov edx, dword [esi + 0x1c]
push ecx
push edi
push edx
call fcn.1000ebc0
mov eax, dword [esi + 0x28]
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
add edx, dword [esi + 0x30]
add esp, 0xc
push eax
push ecx
push edx
call fcn.1000ebc0
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x30]
mov edx, ecx
sub edx, eax
add edx, dword [esi + 0x24]
add esp, 0xc
push edx
lea edx, [eax + edi]
push edx
mov edx, dword [esi + 0x1c]
add edx, eax
add edx, ecx
push edx
call fcn.1000ebc0
add esp, 0xc
mov byte [esi + 0x34], 1
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
push str.CRM::AllocResource_Returning_already_allocated_address.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esi + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x10004a50
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x208
push ebx
push ebp
mov ebp, dword [esp + 0x214]
push esi
push edi
mov esi, eax
lea ebx, [esp + 0x10]
call fcn.10005070
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10004abf
call fcn.1000e3ec
xor eax, eax
mov edi, dword [esp + 0x14]
cmp edi, dword [eax + 0x18]
jne 0x10004a89
call fcn.1000e3ec
mov dword [edi + 0x24], ebp
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push ebp
push eax
push ecx
lea edx, [esp + 0x24]
push str.SetResource_old_size_for_res__I64d_to__d_bytes.
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 4
mov eax, dword [eax]
jmp 0x10004a7b
Function at 0x1000eba8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002e590]
jne 0x1000ebb2
repz ret
jmp fcn.10013921

Function at 0x10018a2a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100114f1
and dword [ebp - 4], 0
cmp dword [0x100303c0], 0
mov ebx, eax
jne 0x10018adb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10018b8c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10018b8c
push eax
call fcn.1001147f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100303c0], eax
call esi
push eax
call fcn.1001147f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100303c4], eax
call esi
push eax
call fcn.1001147f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100303c8], eax
call esi
push eax
call fcn.1001147f
pop ecx
mov dword [0x100303d0], eax
test eax, eax
je 0x10018adb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001147f
pop ecx
mov dword [0x100303cc], eax
mov eax, dword [0x100303cc]
cmp eax, ebx
je 0x10018b33
cmp dword [0x100303d0], ebx
je 0x10018b33
push eax
call fcn.100114fa
push dword [0x100303d0]
mov esi, eax
call fcn.100114fa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10018b33
test edi, edi
je 0x10018b33
call esi
test eax, eax
je 0x10018b2a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10018b2a
test byte [ebp - 0xc], 1
jne 0x10018b33
or dword [ebp + 0x10], 0x200000
jmp 0x10018b6c
mov eax, dword [0x100303c4]
cmp eax, ebx
je 0x10018b6c
push eax
call fcn.100114fa
pop ecx
test eax, eax
je 0x10018b6c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10018b6c
mov eax, dword [0x100303c8]
cmp eax, ebx
je 0x10018b6c
push eax
call fcn.100114fa
pop ecx
test eax, eax
je 0x10018b6c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100303c0]
call fcn.100114fa
pop ecx
test eax, eax
je 0x10018b8c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10018b8e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001d010
Capabilities:
Get system information on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [0x1003051c]
test eax, eax
je 0x1001d024
jmp 0x1001d16d
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
push str.RtlInitAnsiString
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003052c], eax
push str.RtlInitUnicodeString
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030530], eax
push str.LdrGetProcedureAddress
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030520], eax
push str.NtSuspendThread
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030524], eax
push str.DbgPrint
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030528], eax
push str.NtCurrentTeb
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030534], eax
push str.NtSetEvent
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030538], eax
push str.NtPulseEvent
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030540], eax
push str.NtResetEvent
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003053c], eax
push str.NtClose
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030544], eax
push str.NtCreateEvent
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030548], eax
push str.NtOpenEvent
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003054c], eax
push str.NtQueryInformationThread
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030550], eax
push str.LdrGetDllHandle
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030554], eax
push 0x24
push 0
push 0x10030558
call fcn.10010710
add esp, 0xc
push 0x10030558
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov byte [0x1003051c], 1
mov esp, ebp
pop ebp
ret
Function at 0x1001d720
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 8]
mov dword [edx + 4], 0
push 4
call fcn.1000e4f0
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
mov dword [eax], 1
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0
je 0x1001d77e
push 0x40
push 0x1000
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 4], 0
jne 0x1001d792
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001d7aa
mov ecx, dword [ebp + 8]
push ecx
push 0x90
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call fcn.10010710
add esp, 0xc
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001dd50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 8]
call fcn.1001d670
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001ddd8
mov edx, dword [ebp + 0x10]
push edx
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp + 8]
call fcn.1001d970
push eax
mov ecx, dword [ebp + 8]
call fcn.1001d680
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp + 8]
call fcn.1001d670
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x1001e290
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.100086a0
jmp 0x1001e2ac
lea ecx, [ebp - 8]
call fcn.10008760
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.100086d0
push eax
lea ecx, [ebp - 8]
call fcn.10008780
movzx edx, al
test edx, edx
je 0x1001e2fc
lea ecx, [ebp - 8]
call fcn.10008740
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001e2a4
mov esp, ebp
pop ebp
ret
Function at 0x1001e300
Capabilities:
Enumerate threads
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f229
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x1002e590]
xor eax, ebp
mov dword [ebp - 0x30], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x30c], eax
mov dword [ebp - 0x308], 0
mov byte [ebp - 0x29], 1
push 0x1c
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.10010710
add esp, 0xc
push 0x2cc
push 0
lea ecx, [ebp - 0x304]
push ecx
call fcn.10010710
add esp, 0xc
mov dword [ebp - 0x28], 0x1c
mov dword [ebp - 0x304], 0x1003f
movzx edx, byte [ebp - 0x29]
test edx, edx
je 0x1001e4f2
mov byte [ebp - 0x29], 0
mov eax, dword [ebp + 0x14]
push eax
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0xffffffff
jne 0x1001e3c8
mov dword [ebp - 0x314], 0x80070006
push 0x10025250
lea ecx, [ebp - 0x314]
push ecx
call fcn.100107ff
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x308]
push eax
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x1001e3f7
mov dword [ebp - 0x318], 0x80004005
push 0x10025250
lea ecx, [ebp - 0x318]
push ecx
call fcn.100107ff
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp + 0x14]
jne 0x1001e40a
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x30c]
jne 0x1001e40f
jmp 0x1001e4c8
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.10008640
movzx edx, al
test edx, edx
je 0x1001e427
jmp 0x1001e4c8
mov eax, dword [ebp - 0x20]
push eax
push 0
push 0xa
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x310], eax
mov ecx, dword [ebp - 0x310]
push ecx
call fcn.1001cfd0
add esp, 4
lea edx, [ebp - 0x304]
push edx
mov eax, dword [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ecx, dword [ebp - 0x24c]
push ecx
lea ecx, [ebp + 8]
call fcn.1001d5b0
test eax, eax
jne 0x1001e4ab
mov edx, dword [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x310]
push eax
call fcn.1001cfd0
add esp, 4
lea ecx, [ebp - 0x304]
push ecx
mov edx, dword [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
jmp 0x1001e45e
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.10008700
mov ecx, dword [ebp - 0x310]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x29], 1
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x308]
push eax
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1001e3f7
mov ecx, dword [ebp - 0x308]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001e383
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.1001d600
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.1000eba8
mov esp, ebp
pop ebp
ret
Function at 0x1001eb50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f206
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x1002e590]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.1001d290
and eax, 0x8000
je 0x1001eb98
push 0xcc
mov ecx, dword [ebp - 0x2c]
add ecx, 0x44
call fcn.1001dc00
lea ecx, [ebp - 0x18]
call fcn.10007fc0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x24
call fcn.1001d680
mov esi, eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x44
call fcn.1001d970
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 5]
sub esi, edx
mov dword [ebp - 0x17], esi
push 5
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x44
call fcn.1001d9f0
mov ecx, dword [ebp - 0x2c]
add ecx, 0x44
call fcn.1001d970
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1001dde0
add esp, 8
mov byte [ebp - 0xd], al
push 0x14
call fcn.1000e4f0
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0
je 0x1001ec23
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
movzx edx, byte [ebp - 0xd]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.1001da90
mov dword [ebp - 0x30], eax
jmp 0x1001ec2a
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x6c], edx
movzx eax, byte [ebp - 0xd]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x6c]
call fcn.1001d9f0
movzx ecx, byte [ebp - 0xd]
cmp eax, ecx
je 0x1001eca0
push str.APIHook:_Initialize:_Error_ReadFrom.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x6c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
je 0x1001ec8b
push 1
mov ecx, dword [ebp - 0x24]
call fcn.10007fe0
mov dword [ebp - 0x34], eax
jmp 0x1001ec92
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x6c], 0
xor al, al
jmp 0x1001eca3
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x55b36a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x65cbd8]
jne 0x55b374
repz ret
jmp fcn.0055e05c

Function at 0x55fb3f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0055b46c
and dword [ebp - 4], 0
cmp dword [0x65e52c], 0
mov ebx, eax
jne 0x55fbf0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x55fca1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x55fca1
push eax
call fcn.0055b3fa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x65e52c], eax
call esi
push eax
call fcn.0055b3fa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x65e530], eax
call esi
push eax
call fcn.0055b3fa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x65e534], eax
call esi
push eax
call fcn.0055b3fa
pop ecx
mov dword [0x65e53c], eax
test eax, eax
je 0x55fbf0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0055b3fa
pop ecx
mov dword [0x65e538], eax
mov eax, dword [0x65e538]
cmp eax, ebx
je 0x55fc48
cmp dword [0x65e53c], ebx
je 0x55fc48
push eax
call fcn.0055b475
push dword [0x65e53c]
mov esi, eax
call fcn.0055b475
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x55fc48
test edi, edi
je 0x55fc48
call esi
test eax, eax
je 0x55fc3f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x55fc3f
test byte [ebp - 0xc], 1
jne 0x55fc48
or dword [ebp + 0x10], 0x200000
jmp 0x55fc81
mov eax, dword [0x65e530]
cmp eax, ebx
je 0x55fc81
push eax
call fcn.0055b475
pop ecx
test eax, eax
je 0x55fc81
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x55fc81
mov eax, dword [0x65e534]
cmp eax, ebx
je 0x55fc81
push eax
call fcn.0055b475
pop ecx
test eax, eax
je 0x55fc81
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x65e52c]
call fcn.0055b475
pop ecx
test eax, eax
je 0x55fca1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x55fca3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5609c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov ecx, dword [0x65c650]
add ecx, 0xffffea48
mov dword [0x65c654], ecx
mov dword [ebp - 0x10], eax
call fcn.00561ed4
xor ecx, ecx
mov edx, eax
mov dword [0x65c650], 0x249c
mov esi, dword [eax + 0x3c]
mov dword [0x65c654], 0x19ce
mov dword [0x65c650], 0xfffff674
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x65c650], 0xffffecdd
mov ebx, dword [eax + esi + 0x24]
mov dword [0x65c654], 0x23a3
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x560b62
jmp 0x560aaa
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [0x65c654], 0xffffe6b4
mov ecx, dword [ebp - 0x30]
add ecx, 2
mov edx, dword [ebp - 0x18]
cmp eax, edx
setb bl
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x39], bl
xor eax, eax
mov cl, byte [ebp - 0x39]
test cl, 1
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x28], eax
jne 0x560aba
jmp 0x560b62
mov al, byte [ebp - 0x45]
test al, 1
jne 0x560b2a
jmp 0x560a53
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov ecx, eax
mov edx, dword [ebp - 0x4c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x55], bh
mov byte [ebp - 0x45], cl
je 0x560a9d
mov eax, dword [ebp - 0x54]
add eax, 1
mov cl, byte [ebp - 0x55]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x45]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x50], eax
jne 0x560ad4
jmp 0x560a9d
mov eax, dword [ebp - 0x30]
mov cx, word [eax]
mov word [ebp - 0x58], cx
mov ax, word [ebp - 0x58]
movzx ecx, ax
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov dword [0x65c654], 0x17f3
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x65c650], 0x16e6
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret