joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004f450
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b3948
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], 0
mov byte [esp + 0x50], 0
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
mov byte [esp + 0x78], 2
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0xbc]
mov edi, eax
lea ecx, [esp + 0x20]
lea eax, [edi + 0x3888]
cmp ecx, eax
je 0x1004f4f9
push 0xffffffffffffffff
push 0
push eax
call fcn.10003ea0
lea eax, [edi + 0x38a0]
lea ecx, [esp + 0x50]
cmp ecx, eax
je 0x1004f511
push 0xffffffffffffffff
push 0
push eax
call fcn.10003ea0
lea eax, [edi + 0x38b8]
lea ecx, [esp + 0x38]
cmp ecx, eax
je 0x1004f529
push 0xffffffffffffffff
push 0
push eax
call fcn.10003ea0
cmp dword [esp + 0x34], 0x10
lea eax, [esp + 0x20]
mov edi, dword [sym.imp.MSVCR120.dll__strnicmp]
cmovae eax, dword [esp + 0x20]
push 4
push str.ATI
push eax
call edi
add esp, 0xc
test eax, eax
je 0x1004f571
cmp dword [esp + 0x34], 0x10
lea eax, [esp + 0x20]
push 4
cmovae eax, dword [esp + 0x24]
push str.AMD
push eax
call edi
add esp, 0xc
test eax, eax
je 0x1004f571
xor eax, eax
jmp 0x1004f576
mov eax, 1
mov byte [esi + 0x1098], al
mov ecx, esi
mov eax, dword [esi]
mov dword [esi + 0x109c], 0
call dword [eax + 8]
lea eax, [esp + 0x10]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
cmp byte [esi + 0x1098], 0
push dword [esi + 0xec8]
mov edx, dword [ecx]
je 0x1004f5b8
inc eax
push eax
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
push eax
push 0
push 0
call dword [edx]
cmp dword [esp + 0x4c], 0x10
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x1004f5de
push dword [esp + 0x38]
call esi
add esp, 4
cmp dword [esp + 0x64], 0x10
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
jb 0x1004f603
push dword [esp + 0x50]
call esi
add esp, 4
cmp dword [esp + 0x34], 0x10
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], 0
mov byte [esp + 0x50], 0
jb 0x1004f628
push dword [esp + 0x20]
call esi
add esp, 4
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.100ad688
mov esp, ebp
pop ebp
ret

Function at 0x1004f660
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x10051400
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, ecx
mov eax, dword [edi + 0x9c]
mov byte [edi + 0xa8], 1
cmp eax, 0xffffffff
je 0x10051422
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push ebx
push esi
lea eax, [edi + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0xa0]
lea ebx, [edi + 0xa0]
mov esi, dword [eax]
cmp esi, eax
je 0x100514b6
push 4
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
push 0x80
push 0xffff
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_closesocket]
cmp byte [esi + 0xd], 0
jne 0x100514b2
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x10051491
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100514b2
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x10051485
jmp 0x100514b2
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100514b0
lea ebx, [ebx]
cmp esi, dword [eax + 8]
jne 0x100514b0
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100514a0
mov esi, eax
cmp esi, dword [ebx]
jne 0x10051443
lea esi, [edi + 0xac]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [edi + 8]
test eax, eax
je 0x100514d6
push 0xc8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebx]
mov ecx, ebx
push eax
push dword [eax]
lea eax, [ebp - 8]
push eax
call fcn.10052220
push dword [ebx]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
mov eax, dword [edi + 8]
add esp, 4
mov dword [edi], vtable.TThread_class_CTcpProxy_.0
pop esi
pop ebx
test eax, eax
je 0x1005150e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10051ce0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0
push 1
push 2
mov dword [ebp - 0x230], esi
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x10051e60
push dword [ebp + 0xc]
mov eax, 2
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x10051e59
test eax, eax
je 0x10051e59
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 1
push eax
push 0x8004667e
push edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 4
lea eax, [ebp - 0x234]
mov dword [ebp - 0x234], 1
push eax
push 1
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
push 0xfc
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x124], 1
push 0
push eax
mov dword [ebp - 0x120], edi
call sub.MSVCR120.dll_memset
push 0xfc
lea eax, [ebp - 0x224]
mov dword [ebp - 0x22c], 1
push 0
push eax
mov dword [ebp - 0x228], edi
call sub.MSVCR120.dll_memset
add esp, 0x18
xor esi, esi
cmp byte [ebx + 0xa8], 0
jne 0x10051e3e
cmp esi, 0xa
jge 0x10051e3e
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0
push eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x23c], 0x186a0
push eax
lea eax, [ebp - 0x124]
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x10051e3e
cmp dword [ebp - 0x124], 0
ja 0x10051e76
cmp dword [ebp - 0x22c], 0
ja 0x10051e3e
inc esi
cmp byte [ebx + 0xa8], 0
je 0x10051de5
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
push dword [ebp - 0x230]
push str.connnect__s:_d_failed_n
call dword [sym.imp.MSVCR120.dll_printf]
add esp, 0xc
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.100ad688
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x124]
push eax
push edi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
setne al
test al, al
je 0x10051e3e
mov eax, dword [ebp + 0xc]
movzx eax, ax
push eax
push dword [ebp - 0x230]
push str.connnect__s:_d_success_n
call dword [sym.imp.MSVCR120.dll_printf]
mov ecx, dword [ebp - 8]
add esp, 0xc
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100ad688
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100551e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.10055090
mov edi, dword [ebp + 8]
mov ebx, dword [sym.imp.MSVCR120.dll_fseek]
push 0
push 0
push edi
call ebx
push edi
call dword [sym.imp.MSVCR120.dll_fgetc]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10055233
push edi
call dword [sym.imp.MSVCR120.dll_ferror]
add esp, 4
test eax, eax
je 0x10055233
push 0
push 0
push 5
push esi
call fcn.100552b0
mov eax, dword [esi + 0x38]
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 2
push 0
push edi
call ebx
push edi
call dword [sym.imp.MSVCR120.dll_ftell]
push 0
push 0
push edi
mov ebx, eax
call dword [sym.imp.MSVCR120.dll_fseek]
add esp, 0x1c
cmp ebx, 0xffffffff
je 0x1005521a
cmp ebx, 0xffffffff
jae 0x1005521a
test ebx, ebx
jne 0x10055276
push ebx
push ebx
push 0xd
push esi
call fcn.100552b0
mov eax, dword [esi + 0x38]
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 4
lea eax, [ebx + 1]
push eax
call fcn.100ad5d6
push edi
push ebx
push 1
push eax
mov dword [esi + 0x50], eax
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x14
cmp eax, ebx
jne 0x1005521a
mov eax, dword [esi + 0x50]
mov ecx, esi
mov byte [ebx + eax], 0
call fcn.10055390
mov eax, dword [esi + 0x38]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10057fe0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov bl, cl
mov bh, dl
push 0
movzx esi, bl
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
add esi, 0xffffffdf
movzx edi, ax
cmp esi, 0x6f
ja case.0x1005800b.41
movzx eax, byte [esi + 0x1005806c]
jmp dword [eax*4 + 0x10058064]
or edi, 0x100
xorps xmm0, xmm0
movzx eax, bl
movdqu xmmword [ebp - 0x1c], xmm0
mov word [ebp - 0x18], ax
xor ecx, ecx
test bh, bh
movq qword [ebp - 0xc], xmm0
mov eax, 2
mov dword [ebp - 4], 0
cmovne eax, ecx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push 1
mov word [ebp - 0x16], di
call dword [sym.imp.USER32.dll_SendInput]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10078b40
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100aebc8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
lea eax, [eax*2 + 2]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [esi + 0x14], 8
mov edx, eax
mov eax, dword [esi + 0x10]
jb 0x10078ba7
mov ecx, dword [esi]
jmp 0x10078ba9
mov ecx, esi
test eax, eax
je 0x10078bba
add eax, eax
push eax
push ecx
push edx
call sub.MSVCR120.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [edi + 0x3e00]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [edi + 0x46c4]
cmp ecx, esi
je 0x10078bf9
push 0xffffffffffffffff
push 0
push esi
call fcn.10005a70
lea eax, [esp + 0x10]
push esi
push eax
call fcn.1009e0a0
add esp, 8
mov dword [esp + 0x38], 0
lea eax, [esp + 0x10]
cmp dword [esp + 0x24], 0x10
lea ecx, [edi - 4]
cmovae eax, dword [esp + 0x10]
push eax
push str.app_copy_clipboard
call fcn.1007ca40
cmp dword [esp + 0x24], 0x10
jb 0x10078c3f
push dword [esp + 0x10]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.100ad688
mov esp, ebp
pop ebp
ret 4
Function at 0x1007ac10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x100b5350
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
sub esp, 0x18
lea edi, [esi - 4]
mov eax, esp
mov dword [eax], vtable.._AV___Func_impl_U___Callable_obj_V_lambda_8bd808d2f6a05fe2d92a87ada12b34dc____0A__std__V__allocator_V___Func_class_X___V_std___2_X___V_std__.0
mov dword [eax + 4], edi
mov dword [eax + 0x10], eax
mov dword [esp + 0x78], 0xffffffff
call fcn.100066c0
mov eax, dword [esi + 0x3e14]
movdqu xmm0, xmmword [str.0900007306]
mov dword [esp + 0x28], eax
mov eax, dword [0x100bcd0c]
mov dword [esp + 0x4c], eax
mov ax, word [0x100bcd10]
mov word [esp + 0x50], ax
xor eax, eax
push 0xa
movdqu xmmword [esp + 0x40], xmm0
push eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x3c], 0x6e
call dword [sym.imp.MSVCR120.dll_wcstoul]
add esp, 0x24
cmp eax, 5
ja 0x1007acc2
xor eax, eax
jmp 0x1007acc5
sub eax, 4
shl eax, 0x18
or eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
lea eax, [esi + 0x429c]
push eax
mov dword [esp + 0x24], 2
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x60], 1
mov eax, dword [esi + 0x4294]
mov esi, dword [eax]
cmp esi, eax
je 0x1007ad63
lea ecx, [ecx]
push 0xc
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
push dword [esi + 0x10]
call fcn.1007fd00
cmp byte [esi + 0xd], 0
jne 0x1007ad57
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x1007ad3c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x1007ad57
lea ebx, [ebx]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x1007ad30
jmp 0x1007ad57
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x1007ad55
cmp esi, dword [eax + 8]
jne 0x1007ad55
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x1007ad45
mov esi, eax
mov eax, dword [esp + 0x14]
cmp esi, dword [eax + 0x4294]
jne 0x1007ad00
mov eax, dword [esp + 0x14]
add eax, 0x429c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.100ad688
mov esp, ebp
pop ebp
ret
Function at 0x1007afe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x100b5350
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
sub esp, 0x18
lea edi, [esi - 4]
mov eax, esp
mov dword [eax], vtable.._AV___Func_impl_U___Callable_obj_V_lambda_cd1742751e33b5627f28dfe6033ee00d____0A__std__V__allocator_V___Func_class_X___V_std___2_X___V_std__.0
mov dword [eax + 4], edi
mov dword [eax + 0x10], eax
mov dword [esp + 0x78], 0xffffffff
call fcn.100066c0
mov eax, dword [esi + 0x3e14]
movdqu xmm0, xmmword [str.0900007306]
mov dword [esp + 0x28], eax
mov eax, dword [0x100bcd0c]
mov dword [esp + 0x4c], eax
mov ax, word [0x100bcd10]
mov word [esp + 0x50], ax
xor eax, eax
push 0xa
movdqu xmmword [esp + 0x40], xmm0
push eax
mov word [esp + 0x48], ax
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x3c], 0x6e
call dword [sym.imp.MSVCR120.dll_wcstoul]
add esp, 0x24
cmp eax, 5
ja 0x1007b092
xor eax, eax
jmp 0x1007b095
sub eax, 4
shl eax, 0x18
or eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
lea eax, [esi + 0x429c]
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x60], 1
mov eax, dword [esi + 0x4294]
mov esi, dword [eax]
cmp esi, eax
je 0x1007b133
lea ecx, [ecx]
push 0xc
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
push dword [esi + 0x10]
call fcn.1007fd00
cmp byte [esi + 0xd], 0
jne 0x1007b127
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x1007b10c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x1007b127
lea ebx, [ebx]
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x1007b100
jmp 0x1007b127
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x1007b125
cmp esi, dword [eax + 8]
jne 0x1007b125
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x1007b115
mov esi, eax
mov eax, dword [esp + 0x14]
cmp esi, dword [eax + 0x4294]
jne 0x1007b0d0
mov eax, dword [esp + 0x14]
add eax, 0x429c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.100ad688
mov esp, ebp
pop ebp
ret
Function at 0x1007b530
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b5408
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x4344]
call fcn.10098bd0
xor eax, eax
mov byte [esi + 0x3e0c], 1
push eax
push 0x100bd348
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
call fcn.10005c80
mov dword [esp + 0x38], 0
lea edx, [esp + 0x10]
mov ecx, dword [esi + 0x3e08]
push edx
push 0x64
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x24], 8
jb 0x1007b5d9
push dword [esp + 0x10]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esi + 0x3e08]
mov eax, dword [ecx]
call dword [eax + 8]
push dword [esi + 0x3e14]
lea ecx, [esi + 0x4350]
push dword [esi + 0x3e10]
call fcn.10044690
push 0
push 0x100bd348
lea ecx, [esi + 0x46c8]
call fcn.10005c80
cmp dword [esi + 0x4330], 0
jne 0x1007b62a
lea ecx, [esi + 0x4320]
cmp ecx, edi
je 0x1007b62a
push 0xffffffffffffffff
push 0
push edi
call fcn.10003ea0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100ad688
mov esp, ebp
pop ebp
ret 4
Function at 0x1007c330
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push 0xffffffffffffffff
push 0x100b5268
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov dword [esp + 0x10], ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
lea eax, [edi + 0xc]
push eax
mov dword [esp + 0x24], eax
call fcn.100ad5d6
mov esi, eax
add esp, 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], esi
mov dword [esi], 0x6a
mov eax, dword [eax + 0x3e14]
movdqu xmm0, xmmword [str.0900007306]
mov ecx, dword [0x100bcd0c]
mov dword [esp + 0x14], eax
xor eax, eax
push 0xa
movdqu xmmword [esp + 0x28], xmm0
push eax
mov word [esp + 0x30], ax
lea eax, [esp + 0x2c]
mov dword [esp + 0x3c], ecx
mov cx, word [0x100bcd10]
push eax
mov word [esp + 0x44], cx
call dword [sym.imp.MSVCR120.dll_wcstoul]
add esp, 0xc
cmp eax, 5
ja 0x1007c3e3
xor eax, eax
jmp 0x1007c3e6
sub eax, 4
shl eax, 0x18
or eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
push edi
push dword [esp + 0x1c]
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
push eax
call sub.MSVCR120.dll_memcpy
mov edi, dword [esp + 0x1c]
add esp, 0xc
add edi, 0x427c
mov dword [esp + 0x14], edi
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x60], 0
mov eax, dword [ecx + 0x4274]
mov esi, dword [eax]
cmp esi, eax
je 0x1007c4a6
mov edi, dword [esp + 0x1c]
lea eax, [ecx - 4]
mov dword [esp + 0x18], eax
nop
push dword [esp + 0x20]
mov ecx, eax
push edi
push dword [esi + 0x10]
call fcn.1007fd00
cmp byte [esi + 0xd], 0
jne 0x1007c492
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x1007c474
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x1007c492
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x1007c468
jmp 0x1007c492
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x1007c490
lea ecx, [ecx]
cmp esi, dword [eax + 8]
jne 0x1007c490
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x1007c480
mov esi, eax
mov eax, dword [esp + 0x10]
cmp esi, dword [eax + 0x4274]
mov eax, dword [esp + 0x18]
jne 0x1007c440
mov edi, dword [esp + 0x14]
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.100ad688
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1007d500
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push ecx
lea eax, [ebp - 0x1c]
mov ecx, 0x100ef1a0
push eax
call fcn.100a8f00
cmp dword [eax + 0x14], 8
jb 0x1007d528
mov eax, dword [eax]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
cmp dword [ebp - 8], 8
mov esi, eax
jb 0x1007d547
push dword [ebp - 0x1c]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
test esi, esi
jne 0x1007d567
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1007d567
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ad688
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100ad688
mov esp, ebp
pop ebp
ret