joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e9961
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100e98dd
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100e9ad0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100e9ad0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100e9a85
jg 0x100e99bd
test eax, eax
je 0x100e9a7b
push 1
push 0x1000
call fcn.100d7384
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100e99e0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100e9a72
push 0x8000
push ebx
call fcn.100e980e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100e9a09
jg 0x100e9a04
cmp ecx, 0x1000
jb 0x100e9a09
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100d9d17
add esp, 0x10
cmp eax, 0xffffffff
je 0x100e9a4e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100e9a04
jl 0x100e9a35
test ecx, ecx
jne 0x100e99f6
push dword [ebp - 0xc]
push ebx
call fcn.100e980e
push esi
call fcn.100d7317
add esp, 0xc
xor ebx, ebx
jmp 0x100e9ade
cmp byte [edi + 0x24], 0
je 0x100e9a65
cmp dword [edi + 0x20], 5
jne 0x100e9a65
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100e9a70
mov ebx, dword [edi + 0x18]
jmp 0x100e9a72
xor ebx, ebx
push esi
call fcn.100d7317
pop ecx
jmp 0x100e9ade
test ecx, ecx
jg 0x100e9a47
jl 0x100e9a85
test eax, eax
jae 0x100e9a47
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100db415
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100e9aa5
cmp byte [edi + 0x1c], 0
je 0x100e9a47
jmp 0x100e9ad6
push ebx
call fcn.100e4508
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100e9a47
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100e9ade
cmp byte [edi + 0x1c], 0
je 0x100e9adb
mov ebx, dword [edi + 0x18]
jmp 0x100e9ade
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100db415
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100ea230
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100ea25d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100ea25d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x16dd948
Capabilities:
Decompress data using aplib

Disassembly:
call 0x16dda98
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x16dd96e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16dd95a
add dl, dl
jne 0x16dd979
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16dd9cc
xor eax, eax
add dl, dl
jne 0x16dd986
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x16dda6d
add dl, dl
jne 0x16dd995
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16dd9a0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16dd9ab
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16dd9b6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x16dd9c2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x16dd965
mov eax, 1
add dl, dl
jne 0x16dd9da
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x16dd9e5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x16dd9d1
sub eax, ebx
mov ebx, 1
jne 0x16dda18
mov ecx, 1
add dl, dl
jne 0x16dd9fe
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x16dda09
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x16dd9f5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x16dd965
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x16dda2f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x16dda3a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x16dda26
cmp eax, 0x7d00
jae 0x16dda5d
cmp eax, 0x500
jb 0x16dda58
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x16dd965
cmp eax, 0x7f
ja 0x16dda60
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x16dd965
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x16dda8e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x16dd965
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10002e50
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
mov eax, dword [0x1006d004]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [edx]
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
test eax, eax
jne 0x10002e7f
pop edi
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1000dfef
add esp, 8
ret
push esi
lea esi, [eax + ecx]
push ebx
push dword [edx + 8]
mov edx, dword [edx + 4]
mov ecx, esi
call fcn.10005be0
add esp, 8
cmp eax, 1
jne 0x10002ef3
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10002ecc
pop esi
pop edi
mov eax, 4
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1000dfef
add esp, 8
ret
mov eax, dword [esp + 0x18]
lea ecx, [esi + 1]
push 0
push dword [esp + 0x10]
sub eax, ecx
mov byte [esi], 0xe9
push 5
sub eax, 4
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 1
mov dword [edi], esi
mov ecx, dword [esp + 0x10]
pop esi
pop edi
pop ebx
xor ecx, esp
call fcn.1000dfef
add esp, 8
ret

Function at 0x10002f10
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
mov eax, dword [0x1006d004]
xor eax, esp
mov dword [esp + 4], eax
push ebx
mov ebx, edx
push esi
mov esi, dword [ebx]
test esi, esi
je 0x10002fa0
push ebp
mov ebp, dword [ecx + 4]
lea eax, [esp + 0xc]
push edi
mov edi, dword [ecx + 8]
push eax
push 0x40
push edi
push esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10002f69
pop edi
pop ebp
pop esi
mov dword [ebx], 0
mov eax, 4
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1000dfef
add esp, 8
ret
push edi
push ebp
push esi
call fcn.10017430
add esp, 0xc
push 0
push dword [esp + 0x14]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebp
pop esi
mov dword [ebx], 0
mov eax, 1
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1000dfef
add esp, 8
ret
mov ecx, dword [esp + 0xc]
xor eax, eax
pop esi
pop ebx
xor ecx, esp
call fcn.1000dfef
add esp, 8
ret
Function at 0x100036f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x824
mov eax, dword [0x1006d004]
xor eax, esp
mov dword [esp + 0x820], eax
mov eax, dword [0x1006f000]
or eax, dword [0x1006f004]
push ebx
push esi
push edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
je 0x1000393f
xorps xmm0, xmm0
push str.DirectX9::UnhookD3D9__
push 0xc8
movlpd qword [0x1006f000], xmm0
call fcn.10009530
add esp, 8
lea edx, [esp + 0x10]
lea ecx, [esp + 0x28]
call fcn.1000a100
cmp dword [0x1006f048], 0
je 0x100037b6
mov edx, 0x1006f04c
mov ecx, 0x1006f008
call fcn.10002f10
mov ecx, dword [0x1006f048]
mov dword [esp + 0x24], eax
test ecx, ecx
je 0x100037b6
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x1006f048], 0
cmp dword [0x1006f050], 0
je 0x100037f4
mov edx, 0x1006f054
mov ecx, 0x1006f014
call fcn.10002f10
mov ecx, dword [0x1006f050]
mov dword [esp + 0x20], eax
test ecx, ecx
je 0x100037f4
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x1006f050], 0
cmp dword [0x1006f058], 0
je 0x10003832
mov edx, 0x1006f05c
mov ecx, 0x1006f020
call fcn.10002f10
mov ecx, dword [0x1006f058]
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x10003832
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x1006f058], 0
cmp dword [0x1006f060], 0
je 0x10003870
mov edx, 0x1006f064
mov ecx, 0x1006f02c
call fcn.10002f10
mov ecx, dword [0x1006f060]
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10003870
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x1006f060], 0
cmp dword [0x1006f068], 0
je 0x100038ae
mov edx, 0x1006f06c
mov ecx, 0x1006f038
call fcn.10002f10
mov ecx, dword [0x1006f068]
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x100038ae
push 0x8000
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x1006f068], 0
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x10003917
xor edi, edi
xor esi, esi
test ebx, ebx
je 0x100038e1
nop
mov ebx, dword [esp + esi*4 + 0x28]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x100038d1
inc edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x10]
inc esi
cmp esi, ebx
jb 0x100038c0
cmp edi, ebx
je 0x10003903
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x23c
push str._assertion_failed:_resumed__suspendedThreadCount__line__i__err__i
push 0xc8
call fcn.10009530
add esp, 0x10
push ebx
push edi
push str.ResumeAllThreads:_resumed__i_threads__max_count__i
push 0xc8
call fcn.10009530
add esp, 0x10
push dword [esp + 0x14]
push dword [esp + 0x1c]
push dword [esp + 0x24]
push dword [esp + 0x2c]
push dword [esp + 0x34]
push str.HookD3D9:_unhook_DevicePresent_d__DeviceReset_d__DeviceExPresentEx_d__DeviceExResetEx_d__SwapChainPresent_d
push 0x64
call fcn.10009530
add esp, 0x1c
call fcn.10001bc0
mov ecx, dword [esp + 0x82c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000dfef
mov esp, ebp
pop ebp
ret
Function at 0x10003d20
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x24
mov eax, dword [0x1006d004]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x20]
mov esi, edx
mov ebx, ecx
mov dword [esp + 0x10], esi
xorps xmm0, xmm0
mov dword [esp + 0x14], ebx
push eax
movq qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.10056210
mulsd xmm0, qword [0x1006a3c0]
mov ecx, dword [esi]
divsd xmm0, qword [0x1006f440]
lea ebp, [ecx*4]
movsd qword [esp + 0x18], xmm0
cmp dword [ebx + 4], ebp
jne 0x10003d9f
mov eax, dword [esi + 4]
imul eax, ecx
shl eax, 2
push eax
push dword [ebx]
push dword [0x1006f4c0]
call fcn.10017430
add esp, 0xc
jmp 0x10003dd0
mov eax, dword [esp + 0x10]
mov edi, dword [ebx]
xor ebx, ebx
mov esi, dword [0x1006f4c0]
cmp dword [eax + 4], ebx
jbe 0x10003dd0
push ebp
push edi
push esi
call fcn.10017430
mov eax, dword [esp + 0x20]
inc ebx
add esp, 0xc
add esi, ebp
add edi, dword [eax + 4]
mov eax, dword [esp + 0x10]
cmp ebx, dword [eax + 4]
jb 0x10003db2
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
movq qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.10056210
mulsd xmm0, qword [0x1006a3c0]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
divsd xmm0, qword [0x1006f440]
pop ebx
xor ecx, esp
subsd xmm0, qword [esp + 8]
call fcn.1000dfef
add esp, 0x24
ret
Function at 0x10005620
Capabilities:
Allocate or change rwx memory
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x814
mov eax, dword [0x1006d004]
xor eax, esp
mov dword [esp + 0x810], eax
cmp dword [0x1006f094], 0
push ebx
push esi
push edi
je 0x1000578a
push str.DirectX10::UnhookD3D10__
push 0xc8
mov dword [esp + 0x18], 0
call fcn.10009530
add esp, 8
lea edx, [esp + 0x10]
lea ecx, [esp + 0x18]
call fcn.1000a100
cmp dword [0x1006f090], 0
mov edi, 0x1006630c
mov esi, dword [0x1006f098]
mov eax, 0x10065bd0
cmove edi, eax
mov dword [esp + 0x14], 0
test esi, esi
je 0x100056e8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100056bd
mov dword [esp + 0x14], 4
jmp 0x100056de
mov eax, dword [edi]
push 0
push dword [esp + 0x18]
mov dword [esi], eax
mov al, byte [edi + 4]
push 5
push esi
mov byte [esi + 4], al
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0x14], 1
mov dword [0x1006f098], 0
mov eax, dword [0x1006f094]
test eax, eax
je 0x10005709
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x1006f094], 0
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x10005777
xor edi, edi
xor esi, esi
test ebx, ebx
je 0x10005741
nop dword [eax]
mov ebx, dword [esp + esi*4 + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x10005731
inc edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x10]
inc esi
cmp esi, ebx
jb 0x10005720
cmp edi, ebx
je 0x10005763
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x23c
push str._assertion_failed:_resumed__suspendedThreadCount__line__i__err__i
push 0xc8
call fcn.10009530
add esp, 0x10
push ebx
push edi
push str.ResumeAllThreads:_resumed__i_threads__max_count__i
push 0xc8
call fcn.10009530
add esp, 0x10
push dword [esp + 0x14]
push str.DirectX10::UnhookD3D10:_restore_swapchain_present_d
push 0x64
call fcn.10009530
add esp, 0xc
call fcn.10003980
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [0x1006f0b4], 0
call fcn.1000dfef
mov esp, ebp
pop ebp
ret
Function at 0x10005be0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov eax, edx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov ecx, ebx
mov esi, ebp
push edi
mov edi, eax
sub ecx, 4
jb 0x10005c11
nop dword [eax]
mov eax, dword [esi]
cmp eax, dword [edi]
jne 0x10005c16
add esi, 4
add edi, 4
sub ecx, 4
jae 0x10005c00
cmp ecx, 0xfffffffc
je 0x10005c4e
mov al, byte [esi]
cmp al, byte [edi]
jne 0x10005c43
cmp ecx, 0xfffffffd
je 0x10005c4e
mov al, byte [esi + 1]
cmp al, byte [edi + 1]
jne 0x10005c43
cmp ecx, 0xfffffffe
je 0x10005c4e
mov al, byte [esi + 2]
cmp al, byte [edi + 2]
jne 0x10005c43
cmp ecx, 0xffffffff
je 0x10005c4e
mov al, byte [esi + 3]
cmp al, byte [edi + 3]
je 0x10005c4e
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
pop ecx
ret
push 0x40
push 0x3000
lea eax, [ebx + 0xd]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, dword [esp + 0x1c]
mov dword [esi], eax
test eax, eax
jne 0x10005c76
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
pop ecx
ret
push ebx
push dword [esp + 0x14]
push eax
call fcn.10017430
mov ecx, dword [esi]
lea eax, [ebx - 4]
add ecx, ebx
add esp, 0xc
mov byte [ecx], 0xe9
inc ecx
pop edi
sub ebp, ecx
add eax, ebp
pop esi
pop ebp
mov dword [ecx], eax
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x10006930
Capabilities:
Get file version info

Disassembly:
sub esp, 0x24
mov eax, dword [0x1006d004]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov dword [esp + 0x1c], edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [esp + 0x20], ebx
test ebx, ebx
je 0x10006a3e
push 0
xorps xmm0, xmm0
push ebp
movlpd qword [esp + 0x18], xmm0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x100069eb
push edi
push 8
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x100069eb
push esi
push edi
push 0
push ebp
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x100069d1
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
push 0x10066b20
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x100069d1
cmp dword [esp + 0x28], 0x34
jb 0x100069d1
mov eax, dword [esp + 0x24]
xor ebx, ebx
mov edi, dword [eax + 8]
or ebx, dword [eax + 0xc]
jmp 0x100069d9
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100069f3
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov esi, edi
movzx edx, di
shr esi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
mov eax, ebx
shrd eax, edi, 0x10
movzx ecx, ax
movzx eax, bx
push eax
push ecx
push edx
push esi
push ebp
push str.DirectXHook::FindModule__:_module__S_version__d._d._d._d
push 0xc8
call fcn.10009530
mov eax, dword [esp + 0x3c]
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1000dfef
add esp, 0x24
ret
push ebp
push str.DirectXHook::FindModule__:_module__S_not_loaded
push 0xc8
call fcn.10009530
mov ecx, dword [esp + 0x38]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000dfef
add esp, 0x24
ret
Function at 0x10009360
Capabilities:
Get common file path

Disassembly:
push 0x1006f39c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1006f290]
inc eax
mov dword [0x1006f290], eax
cmp eax, 1
jne 0x10009479
push 0x4c
push 0
push 0x1006f3b4
call fcn.1000f990
add esp, 0xc
push 0x104
push 0x1006f294
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100093bb
push 0x1006921c
push 0x105
push 0x1006f294
call fcn.10019647
add esp, 0xc
mov dword [0x1006f3b4], 0x10009300
mov dword [0x1006f3b8], 0x10008cf0
mov dword [0x1006f3bc], 0x10008ca0
mov dword [0x1006f3c0], 0x10008e00
mov dword [0x1006f3c4], 0x10009140
mov dword [0x1006f3c8], 0x10008e60
mov dword [0x1006f3cc], 0x10009190
mov dword [0x1006f3d0], 0x10008eb0
mov dword [0x1006f3d4], 0x10008f10
mov dword [0x1006f3d8], 0x10008f60
mov dword [0x1006f3dc], 0x10008fc0
mov dword [0x1006f3e0], 0x10009030
mov dword [0x1006f3e4], 0x10009090
mov dword [0x1006f3e8], 0x100090f0
mov dword [0x1006f3ec], 0x10008d50
mov dword [0x1006f3f0], 0x10008db0
mov dword [0x1006f3f4], 0x100091e0
mov dword [0x1006f3f8], 0x10009250
mov dword [0x1006f3fc], 0x100092a0
push 0x1006f39c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x1006f3b4
ret
Function at 0x1000a100
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x30
mov eax, dword [0x1006d004]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
mov ebx, edx
push edi
mov dword [esp + 0x18], ebx
mov edi, ecx
call fcn.10009360
mov dword [ebx], 0
xor ebx, ebx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push ebx
push 4
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebp, eax
test ebp, ebp
je 0x1000a22e
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x1c
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1000a227
cmp dword [esp + 0x20], 0xc
jb 0x1000a227
cmp dword [esp + 0x2c], esi
jne 0x1000a1bd
mov eax, dword [esp + 0x28]
test eax, eax
je 0x1000a1bd
push eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x1000a1b9
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], eax
je 0x1000a1b9
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1000a1b9
mov dword [edi], esi
mov ebx, 1
add edi, 4
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
je 0x1000a227
nop dword [eax]
cmp ebx, 0x1ff
jae 0x1000a227
cmp dword [esp + 0x2c], esi
jne 0x1000a217
mov eax, dword [esp + 0x28]
test eax, eax
je 0x1000a217
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x1000a213
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], eax
je 0x1000a213
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1000a213
mov dword [edi], esi
add edi, 4
inc ebx
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1000a1d0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov dword [eax], ebx
mov esi, dword [esi]
mov ecx, esi
call dword [0x100572e4]
call esi
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000dfef
add esp, 0x30
ret
Function at 0x1000a5c0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x1000a5e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x7f
push str._assertion_failed:_su__line__i__err__i
push 0xc8
call fcn.10009530
add esp, 0x10
push 0x1006f274
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [0x1006f28c], 1
jne 0x1000a75a
push str.TeamViewerHooks_Loader_x64
push 0
push 0x10000000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
push str.TeamViewerHooks_Loader_w32
push 0
push 0x10000000
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov edi, eax
test ebx, ebx
je 0x1000a62f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x1000a6a7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x1000a649
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x6a
jmp 0x1000a6b4
push 0x1006f274
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.releasing_library
push 0x64
call fcn.10009530
add esp, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x1000a68a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x72
push str._assertion_failed:_freel__line__i__err__i
push 0xc8
call fcn.10009530
add esp, 0x10
push str.dll_can_unload_now
push 0xc8
mov dword [esi], 0
call fcn.10009530
add esp, 8
jmp 0x1000a74f
test esi, esi
jne 0x1000a6d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x22
push str._assertion_failed:_su__line__i__err__i
push 0xc8
call fcn.10009530
add esp, 0x10
push 0x1006f274
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret
push 0x1006f274
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi], 0
je 0x1000a74f
cmp dword [0x1006ec50], 0
jle 0x1000a701
mov eax, dword [0x1006ec58]
test eax, eax
je 0x1000a701
mov dword [eax + 0x291c2], 0
push str.Starting_Unload_Thread
push 0xc8
call fcn.10009530
add esp, 8
push 0
push 4
push esi
push 0x1000a3d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x1000a748
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2e
push str._assertion_failed:_th__line__i__err__i
push 0xc8
call fcn.10009530
add esp, 0x10
jmp 0x1000a74f
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x1006f274
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x1006f274
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret