joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001ec0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0x20006
push 0
mov esi, ecx
mov dword [ebp - 8], 0
push esi
push 0x80000001
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001f2a
lea eax, ds:[ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10001f4b
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002c362
mov esp, ebp
pop ebp
ret

Function at 0x10001f60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x118]
movss dword [ebp - 0x11c], xmm2
push eax
push 0x20006
push 0
push 0x10067788
push 0x80000001
mov esi, edx
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001fe8
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x10067788
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
nop
test eax, eax
jne 0x10002068
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.1002de40
movss xmm0, dword [ebp - 0x11c]
lea eax, [ebp - 0x110]
cvtps2pd xmm0, xmm0
add esp, 4
movsd qword [esp], xmm0
push 0x100513b0
push 0xffffffffffffffff
push 0x104
push eax
call fcn.100013e0
lea ecx, [ebp - 0x110]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002032
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x110]
push eax
push 1
push 0
push esi
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword ds:[ebp - 0x118]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1002c362
mov esp, ebp
pop ebp
ret

Function at 0x10002080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, dword [ebp + 0xc]
push 0x104
push 0
push eax
call fcn.1002de40
add esp, 0xc
mov dword [ebp - 0x110], 1
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 2
push esi
push 0x10067788
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov esi, eax
lea eax, [ebp - 0x108]
push eax
call fcn.1003a342
mov ecx, dword [ebp - 4]
add esp, 4
fstp dword [edi]
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.1002c362
mov esp, ebp
pop ebp
ret
Function at 0x10002c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push edi
push eax
push 0
push dword [ebp + 0xc]
push 0
push 0
call fcn.10001280
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.10034fb3
mov edi, eax
add esp, 0x1c
or eax, 0xffffffff
mov ecx, 2
test edi, edi
cmovs edi, eax
xor ebx, ebx
add edi, 2
mov eax, edi
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.1002c8cf
add esp, 4
mov dword [esp + 0xc], eax
push ebx
push 0
push eax
call fcn.1002de40
add esp, 0xc
lea eax, [ebp + 0x10]
mov edx, edi
push eax
push dword [ebp + 0xc]
push ecx
mov ecx, dword [esp + 0x18]
call fcn.100012e0
add esp, 0xc
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10002cec
nop
test edi, edi
je 0x10002ce5
mov esi, dword [esp + 0xc]
cmp word [esi], 0
je 0x10002cdc
push 0
push 0
push 1
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, 2
sub edi, 1
jne 0x10002cc8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0xc]
call fcn.1002c375
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100079c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100664bd], 1
push ebx
push esi
push edi
mov edi, ecx
jne 0x10007a30
cmp dword [0x10072da0], 0
je 0x10007a30
push dword [0x10067eb4]
call dword [0x10067eb8]
add esp, 4
cmp dword [0x10067eb4], 2
jne 0x10007a09
mov dword [0x10067eb4], 3
cmp eax, 0x4d2
jne 0x10007a18
cmp edx, 0x1100001
je 0x10007a30
mov dword [edi], eax
mov eax, edi
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002c362
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10067dac]
test ecx, ecx
jne 0x10007ba3
push ecx
push 0x80
push 3
push ecx
push 1
push 0x80000000
push 0x10066ae8
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10007aa6
push str.ISteamUser::GetSteamID_____Reading_SteamID_from_ticket_file__r_n
call fcn.10002120
add esp, 4
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10007ad3
push str.ISteamUser::GetSteamID_____Unable_to_get_ticket_size__r_n
call fcn.10002120
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0x4d2
mov ecx, dword [ebp - 4]
mov byte [ebp - 9], 1
xor ecx, ebp
mov eax, dword [ebp - 0xc]
and eax, 0xff100001
or eax, 0x100001
mov dword [edi + 4], eax
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.1002c362
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x10]
push esi
call fcn.1002c8cf
add esp, 4
mov dword [ebp - 0x18], eax
push esi
mov esi, eax
push 0
push esi
call fcn.1002de40
add esp, 0xc
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push dword [ebp - 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10007b34
push str.ISteamUser::GetSteamID_____Unable_to_read_ticket_file__r_n
call fcn.10002120
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.1002c375
add esp, 4
jmp 0x10007aa6
cmp dword [ebp - 0x14], 0x30
jae 0x10007b42
push str.ISteamUser::GetSteamID_____Ticket_struct_is_too_big__r_n
nop
jmp 0x10007b11
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
jne 0x10007b6d
push str.ISteamUser::GetSteamID_____Ticket_length_is_0__r_n
call fcn.10002120
add esp, 4
push esi
call fcn.1002c375
add esp, 4
jmp 0x10007aa6
mov eax, dword [esi + 8]
test eax, eax
jne 0x10007b8f
push str.ISteamUser::GetSteamID_____SteamID_is_0__r_n
call fcn.10002120
add esp, 4
push esi
call fcn.1002c375
add esp, 4
jmp 0x10007aa6
push esi
mov dword [0x10067dac], eax
call fcn.1002c375
mov ecx, dword [0x10067dac]
add esp, 4
mov dword [edi], ecx
jmp 0x10007aac
Function at 0x100082e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x10063040]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0x10063d20], 1
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x1000832b
mov eax, dword [0x10063ad0]
test eax, eax
je 0x1000832b
cmp eax, 0x3e7
je 0x1000831a
dec eax
mov dword [0x10063ad0], eax
test ebx, ebx
jne 0x1000833f
push str.GetStat_int32_Failed_____pchName_is_nullptr__r_n
call fcn.10002120
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002c362
mov esp, ebp
pop ebp
ret
nop
test edi, edi
jne 0x1000834b
push str.GetStat_int32_Failed_____pData_is_nullptr__r_n
jmp 0x10008323
cmp dword [edi], 0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push 0x10067788
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x24], 4
push 0x80000001
jne 0x10008401
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100083c8
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [eax + eax]
test esi, esi
je 0x1000844c
push dword [edi]
mov edx, ebx
mov ecx, 0x10067788
call fcn.10001ec0
add esp, 4
test eax, eax
je 0x10008452
push dword [edi]
push ebx
push str.GetStat_int32_Failed______s______d_r_n
call fcn.10002120
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002c362
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008437
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1000844c
push 0
mov edx, ebx
mov ecx, 0x10067788
call fcn.10001ec0
add esp, 4
test eax, eax
jne 0x100083dd
mov eax, dword [esp + 0x10]
mov dword [edi], eax
mov ecx, dword ds:[esp + 0x1c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002c362
mov esp, ebp
pop ebp
ret
Function at 0x10008580
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x10063040]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0x10063d20], 1
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x100085d1
cmp byte [ebp + 8], 0
jne 0x100085c0
mov eax, dword [0x10063ad4]
test eax, eax
je 0x100085d1
cmp eax, 0x3e7
je 0x100085c0
dec eax
mov dword [0x10063ad4], eax
test ebx, ebx
jne 0x100085e9
push str.GetAchievement_Failed_____pchName_is_nullptr__r_n
call fcn.10002120
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002c362
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x100085f4
push str.GetAchievement_Failed_____pbAchieved_is_nullptr__r_n
jmp 0x100085c9
cmp byte [edi], 0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push 0x10067a98
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x24], 4
push 0x80000001
jne 0x100086ab
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000866e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword ds:[esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x100086f9
movzx eax, byte [edi]
mov edx, ebx
push eax
mov ecx, 0x10067a98
call fcn.10001ec0
add esp, 4
test eax, eax
je 0x10008703
movzx eax, byte [edi]
push eax
push ebx
push str.GetAchievement_Failed______s______d_r_n
call fcn.10002120
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002c362
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100086e4
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [eax]
test esi, esi
je 0x100086f9
push 0
mov edx, ebx
mov ecx, 0x10067a98
call fcn.10001ec0
add esp, 4
test eax, eax
jne 0x10008685
cmp dword [esp + 0x10], 0
setne al
mov byte [edi], al
mov ecx, dword [esp + 0x1c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002c362
mov esp, ebp
pop ebp
ret
Function at 0x10008940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x10063040]
xor eax, esp
mov dword [esp + 0x120], eax
cmp dword [0x10063d20], 1
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
je 0x10008994
mov eax, dword [0x10063ad4]
test eax, eax
je 0x10008994
cmp eax, 0x3e7
je 0x10008983
dec eax
mov dword [0x10063ad4], eax
test esi, esi
jne 0x100089ab
push str.GetAchievementAndUnlockTime_Failed_____pchName_is_nullptr__r_n
call fcn.10002120
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.1002c362
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x100089b6
push str.GetAchievementAndUnlockTime_Failed_____pbAchieved_is_nullptr__r_n
jmp 0x1000898c
test edi, edi
jne 0x100089c2
push str.GetAchievementAndUnlockTime_Failed_____prtTime_is_nullptr__r_n
nop
jmp 0x1000898c
push esi
push str.GetAchievementAndUnlockTime______s_r_n
call fcn.10002120
push 0x104
lea eax, [esp + 0x2c]
mov byte [ebx], 0
push 0
push eax
mov dword [edi], 0
call fcn.1002de40
add esp, 0x14
lea eax, [esp + 0x20]
push esi
push str._s_Time
push 0xffffffffffffffff
push 0x104
push eax
call fcn.100013e0
add esp, 0x14
mov byte [esp + 0xf], 0
lea edx, [esp + 0xf]
mov ecx, esi
push 1
call fcn.10008580
add esp, 4
cmp byte [esp + 0xf], 1
jne 0x10008ab0
push esi
push str.GetAchievementAndUnlockTime______s_r_n
call fcn.10002120
add esp, 8
mov byte [ebx], 1
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], 4
push eax
push 0x20019
push 0
push 0x10067a98
push 0x80000001
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008ab0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
push 0
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword ds:[esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10008ab0
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov ecx, dword ds:[esp + 0x12c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002c362
mov esp, ebp
pop ebp
ret
Function at 0x10024f00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
cmp eax, 1
jne 0x100250c7
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.ntdll.dll
call esi
push str.RtlImageNtHeader
push eax
mov dword [0x100680cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.steamclient.dll
mov dword [0x100666c8], eax
call esi
mov esi, eax
test esi, esi
je 0x10024f98
push esi
call dword [0x100666c8]
push str.xxx____x____x____
push 0x1005bbec
mov ecx, esi
mov edx, dword [eax + 0x50]
call fcn.10001d80
add esp, 8
mov dword [0x10072db0], eax
test eax, eax
je 0x10024f98
push ecx
lea edx, [ebp - 0xc]
mov word [ebp - 0xc], 0x18eb
call fcn.10001e00
add esp, 4
lea eax, [ebp - 8]
mov dword [0x10066ae0], edi
push eax
push 0
push 2
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x10024fd2
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_exe_path___1_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
push 0x10067ba0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10025006
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_exe_path___2_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x7a
jne 0x1002502f
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_exe_path___3_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
push 0x100662b0
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10025066
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_dll_path___1_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call esi
cmp eax, 0x7a
jne 0x1002508e
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_dll_path___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10067ba0
push 0x104
push 0x100684f0
call fcn.1003661d
push 0x100662b0
push 0x104
push 0x10072b98
call fcn.1003661d
add esp, 0x18
xor ecx, ecx
call fcn.10023100
jmp 0x1002510f
test eax, eax
jne 0x1002510f
cmp byte [0x10065e8d], al
jne 0x1002510f
xor edx, edx
xor ecx, ecx
call fcn.10027740
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateUserProcess
push dword [0x100680cc]
call esi
mov ecx, eax
call fcn.10027600
push str.NtResumeThread
push dword [0x100680cc]
call esi
mov ecx, eax
call fcn.10027600
call fcn.10027200
mov ecx, dword ds:[ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1002c362
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10026d00
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
je 0x10026e78
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
xorps xmm0, xmm0
push eax
push edi
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_Thread32First]
nop dword [eax + eax]
test eax, eax
je 0x10026e71
mov ebx, 1
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x10026dff
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x10026dff
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10026dff
mov edx, dword [esi]
test edx, edx
jne 0x10026dc3
push 0x200
push 8
push dword [0x100731dc]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10026e25
lea edi, [esi + 8]
jmp 0x10026df2
mov eax, dword [esi + 4]
lea edi, [esi + 8]
cmp dword [edi], eax
jb 0x10026df2
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 8
push dword [0x100731dc]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10026e8b
mov dword [esi], edx
mov ecx, dword [edi]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [edi]
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10026d70
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop
cmp eax, 0x12
je 0x10026e71
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x10026e71
push eax
push ebx
push dword [0x100731dc]
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x10026e5b
test ecx, ecx
je 0x10026e5b
mov eax, dword [esi]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10026e50
push dword [esi]
push 0
push dword [0x100731dc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002c362
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x24]
jmp 0x10026e25
Function at 0x10026ea0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10026d00
test eax, eax
jne 0x10026ed3
mov eax, 9
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [edi], 0
je 0x10026f2e
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x10026f26
push ebx
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10026f1d
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.10026b60
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x10026ee6
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10026f40
Capabilities:
Resume thread

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x10026fc6
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x10026f86
push ebx
mov eax, dword ds:[edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10026f7a
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x10026f51
pop ebx
push dword [edi]
push 0
push dword [0x100731dc]
call dword [sym.imp.KERNEL32.dll_HeapSize]
pop esi
cmp eax, 0xffffffff
je 0x10026fb1
nop dword [eax]
test eax, eax
je 0x10026fb1
mov ecx, dword [edi]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x10026fa6
push dword ds:[edi]
push 0
push dword [0x100731dc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
ret
Function at 0x10026fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
mov dword [ebp - 8], 0
push edi
add esi, dword [0x10073210]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10027049
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002c362
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x1002706b
mov byte ds:[edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1002708c
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1002708c
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10027086
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1002708c
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.1002c362
mov esp, ebp
pop ebp
ret