joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463a40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
xor edx, edx
cmp dword [ecx + 4], 3
sete dl
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x463a91
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
jne 0x463a70
xor eax, eax
jmp 0x463b1a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
call dword [eax + 0xc]
add esp, 0x10
mov dword [ebp - 4], eax
jmp 0x463ae2
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
jne 0x463ac5
push 0x46b728
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov edx, dword [ebp + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x463ac5
or eax, 0xffffffff
jmp 0x463b1a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x463b17
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0
je 0x463b0b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x125f0376
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3a072e16
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x100028c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10002921
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10002904
cmp edi, 2
jb 0x10002904
cmp byte [esi], cl
jne 0x10002904
cmp byte [esi + 1], cl
jne 0x10002904
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10040f58]
jmp 0x100028d5
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10040f58]
test edi, edi
jne 0x100028d5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10002950
cmp cl, 0x23
jne 0x10002937
cmp byte [esi], cl
jne 0x10002937
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10040f58]
test cl, cl
jne 0x10002928
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10002b00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10002b25
push 0x599
push str.C:UsersCheekOneDriveDesktopBo2_ProjImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10002b32
mov dword [edi], 0
mov edx, 0x10040c5c
mov ecx, esi
call fcn.10002960
mov esi, eax
test esi, esi
je 0x10002c22
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10002c18
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002c18
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x10002c18
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002c18
mov eax, dword [0x1004b860]
test eax, eax
je 0x10002bac
inc dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10002c18
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x10002bfd
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1004b860]
add esp, 4
test eax, eax
je 0x10002bea
dec dword [eax + 0x374]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x10002c0f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100057a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbc], 0
jg 0x100057c8
push 0x502
push str.C:UsersCheekOneDriveDesktopBo2_ProjImGui_DirectX_11_Kiero_Hookimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov ecx, dword [esi + 0xbc]
mov edi, 4
mov eax, dword [esi + 0xc4]
lea esi, [ebp + 8]
mov eax, dword [eax + ecx*4 - 4]
not eax
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10040f58]
sub edi, 1
jne 0x100057e2
mov ecx, dword [0x1004b860]
not eax
pop edi
pop esi
cmp dword [ecx + 0x19e4], eax
jne 0x10005814
mov dword [ecx + 0x19e8], eax
cmp dword [ecx + 0x1a18], eax
jne 0x10005823
mov byte [ecx + 0x1a1c], 1
pop ebp
ret 4

Function at 0x10008080
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi], 0
jne 0x10008099
cmp byte [edi + 0x2d2c], 0
je 0x100080b1
push 0xed0
push str.C:UsersCheekOneDriveDesktopBo2_ProjImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
push str._g.Initialized___g.SettingsLoaded
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov al, 0x57
mov esi, 0x1003f419
or ebx, 0xffffffff
nop dword [eax]
cmp al, 0x23
jne 0x100080de
cmp byte [esi], al
jne 0x100080de
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10040f58]
test al, al
jne 0x100080d0
mov esi, dword [edi + 0x2d40]
not edx
mov ecx, dword [edi + 0x2d44]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x10014c00
mov dword [ebp - 0xc], 0x10014c60
mov dword [ebp - 8], 0x10014d40
cmp esi, ecx
jne 0x100081b4
inc esi
test ecx, ecx
je 0x10008135
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1000813a
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x100081b4
mov eax, dword [0x1004b860]
test eax, eax
je 0x10008152
inc dword [eax + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2d48]
test eax, eax
je 0x100081a8
mov ecx, dword [edi + 0x2d40]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x2d48]
add esp, 0xc
test ecx, ecx
je 0x1000819e
mov eax, dword [0x1004b860]
test eax, eax
je 0x1000819e
dec dword [eax + 0x374]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [edi + 0x2d48], ebx
mov dword [edi + 0x2d44], esi
mov eax, dword [edi + 0x2d40]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2d48]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2d40]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009640
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1000967f
cmp bl, 0x23
jne 0x10009661
cmp byte [esi], bl
jne 0x10009661
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10040f58]
test bl, bl
jne 0x10009652
mov ecx, dword [0x1004b860]
not eax
mov esi, dword [ecx + 0x19a0]
mov edi, dword [ecx + 0x19a8]
lea ebx, [edi + esi*8]
test esi, esi
je 0x100096be
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x100096b8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x100096ba
mov esi, edx
test esi, esi
jne 0x100096a0
cmp edi, ebx
je 0x100096cd
cmp dword [edi], eax
jne 0x100096cd
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10014360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x1004b860]
push edi
cmp byte [esi + 0x2d58], 0
je 0x100143ff
cmp dword [esi + 0x2d60], 0
lea edi, [esi + 0x2d64]
je 0x100143f1
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x100143a9
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10015a00
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.10003230
mov edx, dword [edi]
mov ecx, 0x1004b85c
push dword [esi + 0x2d60]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2d6c]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.10003230
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10014ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [0x1004b860]
mov eax, ecx
mov dword [ebp - 8], eax
push edi
mov dword [esi + 0x2d30], 0
test eax, eax
je 0x10014bef
lea edi, [esi + 0x2d34]
mov dword [esi + 0x2d30], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10014b35
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10015a00
mov dword [edi], 0
cmp dword [edi + 4], 0
jne 0x10014b4a
push 8
mov ecx, edi
call fcn.10015a00
mov eax, dword [edi]
xor ebx, ebx
mov ecx, dword [edi + 8]
mov byte [ecx + eax], 0
inc dword [edi]
mov eax, dword [esi + 0x2d40]
test eax, eax
jle 0x10014bac
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x10014b85
push 0x4f8
push str.C:UsersCheekOneDriveDesktopBo2_ProjImGui_DirectX_11_Kiero_Hookimguiimgui.h
push str.i___Size
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [esi + 0x2d48]
add eax, ecx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 4]
inc ebx
mov eax, dword [esi + 0x2d40]
add ecx, 0x18
add esp, 0xc
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x10014b85
mov edi, dword [edi]
mov ebx, 0x1004b85c
mov ecx, dword [ebp - 8]
mov edx, 0x10040cc0
lea eax, [edi - 1]
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esi + 0x2d3c]
test eax, eax
cmovne ebx, eax
call fcn.10002960
mov esi, eax
test esi, esi
je 0x10014bef
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100317b0
Capabilities:
Hash data with crc32

Disassembly:
test dword [ecx + 0x54], 0x100000
push ebx
push esi
push edi
mov ebx, edx
je 0x10031821
mov cl, byte [ebx]
lea esi, [ebx + 1]
or eax, 0xffffffff
test cl, cl
je 0x100317f8
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x100317df
cmp byte [esi], cl
jne 0x100317df
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10040f58]
test cl, cl
jne 0x100317d0
mov ecx, dword [0x1004b860]
not eax
cmp dword [ecx + 0x19e4], eax
jne 0x1003180e
mov dword [ecx + 0x19e8], eax
cmp dword [ecx + 0x1a18], eax
jne 0x1003188d
pop edi
pop esi
mov byte [ecx + 0x1a1c], 1
pop ebx
ret
mov esi, dword [0x1004b860]
mov edi, dword [esi + 0x19b0]
cmp dword [edi + 0xbc], 0
jg 0x10031854
push 0x502
push str.C:UsersCheekOneDriveDesktopBo2_ProjImGui_DirectX_11_Kiero_Hookimguiimgui.h
push str.Size___0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov esi, dword [0x1004b860]
add esp, 0xc
mov ecx, dword [edi + 0xbc]
xor edx, edx
mov eax, dword [edi + 0xc4]
push dword [eax + ecx*4 - 4]
mov ecx, ebx
call fcn.100028c0
add esp, 4
cmp dword [esi + 0x19e4], eax
jne 0x1003187e
mov dword [esi + 0x19e8], eax
cmp dword [esi + 0x1a18], eax
jne 0x1003188d
mov byte [esi + 0x1a1c], 1
pop edi
pop esi
pop ebx
ret
Function at 0x10038560
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003865a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10038653
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x10038639
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10038639
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10038639
mov edx, dword [esi]
test edx, edx
jne 0x10038602
push 0x200
push edx
push dword [0x1004b868]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10038653
jmp 0x1003862d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1003862d
shl eax, 3
push eax
push edx
push 0
push dword [0x1004b868]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10038653
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100385c1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1003869f
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1003869f
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10038699
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.100383f0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10038666
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bb04
mov esp, ebp
pop ebp
ret
Function at 0x100386b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1004b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x1004b9e0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10038711
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bb04
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10038732
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10038753
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10038753
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1003874d
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10038753
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.1003bb04
mov esp, ebp
pop ebp
ret
Function at 0x100387b0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [0x1004b9e8]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 4], edi
mov ebx, ecx
test edx, edx
je 0x100388a1
mov eax, dword [0x1004b9e0]
add eax, 0x14
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x100387f5
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x100387d8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x100388a1
xor eax, eax
lea ecx, [ebp - 0x10]
test ebx, ebx
setne al
or edx, 0xffffffff
push eax
call fcn.10038560
mov ecx, dword [0x1004b9e8]
add esp, 4
cmp esi, ecx
jae 0x10038855
imul edi, esi, 0x2c
mov eax, dword [0x1004b9e0]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x1003884a
mov edx, ebx
mov ecx, esi
call fcn.100386b0
mov dword [ebp - 4], eax
test eax, eax
jne 0x10038852
mov ecx, dword [0x1004b9e8]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10038821
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100388a1
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x10038892
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10038886
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10038865
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1004b868]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038bf0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov edi, edx
mov dword [ebp - 4], ebx
mov edx, 1
mov ecx, 0x1004b864
xor eax, eax
lock cmpxchg dword [ecx], edx
test eax, eax
je 0x10038c45
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
cmp esi, 0x20
jae 0x10038c29
push 0
jmp 0x10038c2b
push 1
call ebx
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x1004b864
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10038c20
mov ebx, dword [ebp - 4]
cmp dword [0x1004b868], 0
je 0x10038d18
test ebx, ebx
jne 0x10038c64
mov ecx, edi
call fcn.100387b0
mov edi, eax
jmp 0x10038d1d
mov ecx, dword [0x1004b9e8]
xor esi, esi
test ecx, ecx
je 0x10038c84
mov edx, dword [0x1004b9e0]
mov eax, edx
cmp ebx, dword [eax]
je 0x10038c8e
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x10038c78
mov edi, 4
jmp 0x10038d1d
cmp esi, 0xffffffff
je 0x10038c84
imul eax, esi, 0x2c
movzx eax, byte [eax + edx + 0x14]
shr eax, 1
and eax, 1
cmp eax, edi
je 0x10038d0f
push 1
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.10038560
add esp, 4
mov edx, edi
mov ecx, esi
call fcn.100386b0
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], edi
test eax, eax
je 0x10038d1d
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x10038cfe
mov edi, eax
push dword [edi + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10038cf2
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10038cd1
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
push 0
push dword [0x1004b868]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10038d1d
neg edi
sbb edi, edi
add edi, 6
jmp 0x10038d1d
mov edi, 2
xor eax, eax
mov ecx, 0x1004b864
xchg dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b3c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
sub eax, 0
je 0x1003b403
sub eax, 1
jne 0x1003b48b
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push esi
push 0x1003b320
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor al, al
mov ecx, 0x1004b89d
xchg byte [ecx], al
cmp dword [0x1004b8bc], 0
je 0x1003b456
call dword [sym.imp.MSVCP140.dll__Thrd_id]
mov ecx, dword [0x1004b8bc]
cmp ecx, eax
jne 0x1003b42d
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 0
push ecx
push dword [0x1004b8b8]
call dword [sym.imp.MSVCP140.dll__Thrd_join]
add esp, 0xc
test eax, eax
je 0x1003b44b
push 2
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
xorps xmm0, xmm0
movlpd qword [0x1004b8b8], xmm0
cmp dword [0x1004b938], 0
je 0x1003b48b
xor edx, edx
xor ecx, ecx
call fcn.10038bf0
push dword [0x1004b924]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [0x1004b924], 0
mov dword [0x1004b938], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1003b7b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003d2ed
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1004b040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.1003c116
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x1003bab0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x1003b832
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003bb04
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3