joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10066790
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10093df3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.100877c9
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.1008ce7b
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.1008e397
test eax, eax
je 0x100668ac
mov ecx, dword [esp + 0x3c]
call fcn.1008cea8
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x10066870
push edi
mov ecx, esi
call fcn.1008a4fe
mov ecx, esi
call fcn.10066a10
cmp dword [esp + 0x38], 1
jne 0x100668a5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.1008a639
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x100692d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x10069303
push esi
call fcn.1006c3d0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x100692fc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x10069389
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10069372
mov eax, dword [esi + 8]
test eax, eax
je 0x10069327
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x1006936e
cmp eax, 2
je 0x10069372
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1006931a
cmp eax, 3
je 0x1006934d
cmp eax, 1
jne 0x1006931a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x1006931a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x1006931a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.100693b0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x10069398
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.100693b0
add esp, 4
pop esi
ret

Function at 0x100885be
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100885f6
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.10086675
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1008664d
jmp 0x10088602
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10089cb8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10089cfa
call fcn.1008f77d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10089cfa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10089cf1
xor eax, eax
jmp 0x10089d02
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10089d08
pop edi
pop esi
pop ebx
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x101944be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101b1680]
jne 0x101944c8
repz ret
jmp fcn.101953dc

Function at 0x101965db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10193874
and dword [ebp - 4], 0
cmp dword [0x101b31bc], 0
mov ebx, eax
jne 0x1019668c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1019673d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1019673d
push eax
call fcn.10193802
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101b31bc], eax
call esi
push eax
call fcn.10193802
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101b31c0], eax
call esi
push eax
call fcn.10193802
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101b31c4], eax
call esi
push eax
call fcn.10193802
pop ecx
mov dword [0x101b31cc], eax
test eax, eax
je 0x1019668c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10193802
pop ecx
mov dword [0x101b31c8], eax
mov eax, dword [0x101b31c8]
cmp eax, ebx
je 0x101966e4
cmp dword [0x101b31cc], ebx
je 0x101966e4
push eax
call fcn.1019387d
push dword [0x101b31cc]
mov esi, eax
call fcn.1019387d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x101966e4
test edi, edi
je 0x101966e4
call esi
test eax, eax
je 0x101966db
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x101966db
test byte [ebp - 0xc], 1
jne 0x101966e4
or dword [ebp + 0x10], 0x200000
jmp 0x1019671d
mov eax, dword [0x101b31c0]
cmp eax, ebx
je 0x1019671d
push eax
call fcn.1019387d
pop ecx
test eax, eax
je 0x1019671d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1019671d
mov eax, dword [0x101b31c4]
cmp eax, ebx
je 0x1019671d
push eax
call fcn.1019387d
pop ecx
test eax, eax
je 0x1019671d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101b31bc]
call fcn.1019387d
pop ecx
test eax, eax
je 0x1019673d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1019673f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10197a94
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, 0x11f9
xor edi, edi
mov dword [0x101b0ed0], 0
mov byte [0x101b0ed4], 0
mov dword [0x101b0ec4], 0x1887
mov dword [0x101b0ecc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x41f
mov ebx, eax
mov dword [0x101b0ec8], ecx
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], bl
mov dword [0x101b0ec4], 0xaad
mov eax, dword [0x101b0ecc]
add eax, 1
mov dword [0x101b0ecc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
jl 0x10197ae1
xor eax, eax
mov dword [0x101b0ec4], 0xfffff035
mov dword [0x101b0ecc], 0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, 0x100
mov dword [ebp - 0x28], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x101b0ed8], 0
mov edi, dword [0x101b0ec8]
mov ebx, edi
add ebx, 0x1f68
mov dword [0x101b0ec4], ebx
mov ebx, dword [0x101b0ed0]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [esi + ecx]
add ecx, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add ecx, edx
mov dword [0x101b0ed8], ecx
add edi, 0xfffffb7b
mov dword [0x101b0ec8], edi
mov eax, ecx
cdq
mov ecx, dword [ebp - 0x2c]
idiv ecx
mov dword [0x101b0ed0], edx
mov dword [0x101b0ec4], 0xb5f
mov edi, dword [ebp - 0x28]
mov cl, byte [esi + edi]
mov byte [0x101b0ed4], cl
mov dword [0x101b0ec8], 0x148d
mov cl, byte [esi + edx]
mov byte [esi + edi], cl
mov edx, dword [0x101b0ec4]
add edx, 0xfffffb13
mov dword [0x101b0ec8], edx
mov cl, byte [0x101b0ed4]
mov edx, dword [0x101b0ed0]
mov byte [esi + edx], cl
mov dword [0x101b0ec4], 0x106c
mov edx, dword [0x101b0ecc]
add edx, 1
mov dword [0x101b0ecc], edx
cmp edx, 0x100
mov dword [ebp - 0x24], edx
jl 0x10197b39
mov dword [0x101b0ec4], 0x3b1
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10197d15
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 1
lea esi, [ebp - 0x24]
mov dword [0x101b0ec4], 0x15fa
mov dword [0x101b0ec8], 0xfffffb3e
mov byte [ebp - 0x24], 0x56
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x1019a1dc]
mov dh, byte [eax + 0x1019a1ad]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x34], ecx
jne 0x10197d4e
mov dword [0x101b0ec8], 0x10bc
mov dword [0x101b0ec4], 0x1c28
call fcn.10198364
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.101975ea
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
je 0x10197e5f
mov eax, dword [ebp - 0x38]
mov dword [0x101b0ec8], 0x6ae
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x101b0ec4], 0x1d1e
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.1019876d
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x58], ecx
mov dword [0x101b0ec8], 0x1af1
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0x4c], ecx
mov dword [0x101b0ec4], 0x1860
cmp ecx, 0
mov dword [ebp - 0x3c], eax
je 0x10197e5f
mov eax, dword [ebp - 0x40]
add eax, 0x1613
mov dword [0x101b0ec8], 0xb20
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add esp, 0x4c
pop esi
pop ebp
ret
Function at 0x101984a2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [0x101b0ec8], 0x968
mov dword [ebp - 0x10], eax
call fcn.101989b7
xor ecx, ecx
mov edx, eax
mov dword [0x101b0ec8], 0x15f9
mov esi, dword [eax + 0x3c]
mov dword [0x101b0ec4], 0xfffff591
mov dword [0x101b0ec8], 0x58
mov esi, dword [eax + esi + 0x78]
mov dword [0x101b0ec8], 0xfffffbf7
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x101b0ec4], 0x38ca
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x10198543
jmp 0x1019854e
xor eax, eax
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov edx, dword [ebp - 0x2c]
add edx, 2
mov esi, dword [ebp - 0x18]
cmp ecx, esi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], ecx
jb 0x10198560
mov eax, dword [ebp - 0x24]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
je 0x101985cb
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x1019857a
mov al, byte [ebp - 0x42]
test al, 1
jne 0x101985d7
jmp 0x1019851f
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax]
mov dword [0x101b0ec4], 0x2457
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101b0ec8], 0x163f
mov dword [ebp - 0x24], edi
jmp 0x10198543
Function at 0x10198609
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [ebp - 8], 0
mov dword [0x101b0ec4], 0x24f2
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov ecx, 0x13da
xor edx, edx
mov esi, dword [ebp - 8]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + 0x3c]
mov dword [0x101b0ec4], 0x13da
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], esi
je 0x101986db
jmp 0x101986ae
mov dword [0x101b0ec8], 0x519
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x10198734
jmp 0x10198755
mov dword [0x101b0ec4], 0xfffffa1e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1019866e
jmp 0x10198755
mov eax, dword [ebp - 0x1c]
add eax, 1
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffe00
mov dword [0x101b0ec4], ecx
cmp eax, 0x104
mov edx, eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], eax
jl 0x10198650
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], eax
jne 0x10198755
mov dword [0x101b0ec4], 0x5bf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x10198755
mov dword [0x101b0ec8], 0x47
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10198755
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10198690
jmp 0x10198755
mov eax, 1
mov dword [0x101b0ec4], 0x24bd
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x2c], eax
je 0x10198764
xor eax, eax
mov dword [0x101b0ec4], 0x1321
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x10198b50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x93e
xor ebx, ebx
mov dword [0x101b0ecc], 0
mov dword [0x101b0ed0], 0
mov dword [0x101b0edc], 0
mov dword [0x101b0ec4], 0x1b7a
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x10198cdb
jmp 0x10198bd4
mov eax, dword [0x101b0ed0]
mov ecx, dword [0x101b0ecc]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, 0x109d
mov edi, 0x100
add eax, 1
mov ebx, ecx
add ebx, 1
mov dword [0x101b0ec4], 0xcd7
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x101b0ecc], edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ecx + edx]
mov dword [ebp - 0x3c], edx
mov edx, dword [ebp - 0x34]
add ecx, edx
mov eax, ecx
cdq
idiv edi
mov dword [0x101b0ed0], edx
mov dword [0x101b0ec4], 0x1a1e
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x3c]
mov cl, byte [ecx + edi]
mov byte [0x101b0ed4], cl
mov dword [0x101b0ec8], 0xfffff974
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x24]
mov byte [edx + edi], cl
mov cl, byte [0x101b0ed4]
mov edx, dword [0x101b0ed0]
mov edi, dword [ebp - 0x24]
mov byte [edi + edx], cl
mov dword [0x101b0ec4], 0x6cf
mov edx, dword [0x101b0ecc]
movzx edx, byte [edi + edx]
mov ecx, dword [0x101b0ed0]
movzx ecx, byte [edi + ecx]
add ecx, edx
mov dword [0x101b0ec4], 0x257e
and ecx, 0xff
mov dword [0x101b0edc], ecx
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x38]
xor cl, byte [edx + edi]
mov byte [0x101b0ee0], cl
mov dword [0x101b0ec8], 0x16d0
mov edx, dword [ebp - 0x20]
mov byte [edx + edi], cl
mov dword [0x101b0ec4], 0x22d9
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x10198bbd
mov eax, dword [ebp - 0x2c]
mov dword [0x101b0ec4], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10198ceb
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x101b0ec4], 0x1742
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.10197f0b
lea ecx, [0x10197a43]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x84], edx
mov dword [esp + 0x58], 0x139200
mov edx, dword [0x101b0eb0]
mov dword [esp + 0x68], edx
mov edx, dword [0x101b0eb4]
mov dword [esp + 0x70], edx
mov dword [0x101b0ec8], 0x848
mov edx, dword [0x101b0eb8]
mov dword [esp + 0x40], edx
mov edx, dword [0x101b0ebc]
mov dword [esp + 0x5c], edx
mov edx, dword [0x101b0ec0]
mov dword [esp + 0x80], edx
mov dword [0x101b0ec4], 0x96b
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x10198dc0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x78], eax
mov dword [0x101b0ec8], 0x58
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x34], edx
mov dword [0x101b0ec4], 0xc36
call fcn.10198609
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x10198df7
jmp 0x10198e47
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x10198de3
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x10198d81
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10198dc0
lea eax, [esp + 0x30]
mov dword [0x101b0ec4], 0x996
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10197d15
mov dword [0x101b0ec4], 0x26f7
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x101b0ec8]
add ecx, 0xfffff46a
mov dword [0x101b0ec4], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x10003ebd
Capabilities:
Resume thread
Terminate thread

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov esi, ecx
mov eax, dword [esi + 0x24]
xor ebx, ebx
cmp eax, ebx
je 0x10003fbd
cmp dword [eax + 8], ebx
je 0x10003fbd
lea eax, [esi + 0x30]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb edi, edi
neg edi
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.1000994e
test eax, eax
jne 0x10003f1b
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003ee7
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003ee7
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x10003f62
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x10003f62
cmp dword [esi + 0x2c], ebx
jne 0x10003f62
push ebx
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x20], 1
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [esi + 0x24]
or dword [ebp - 4], 0xffffffff
mov dword [eax + 8], ebx
cmp edi, ebx
je 0x10003fbd
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10003fbd
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x10003f73
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x24]
mov dword [esi + 0x2c], ebx
push dword [eax + 0x1c]
call dword [sym.imp.kernel32.dll_SetEvent]
mov eax, dword [esi + 0x24]
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [esi + 0x24]
mov edi, dword [eax + 8]
push 0x3e8
push edi
mov dword [eax + 8], ebx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x10003faf
mov dword [esi + 0x20], ebx
jmp 0x10003fbd
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [esi + 0x20], 1
call fcn.10023451
ret

Function at 0x10004070
Capabilities:
Hide graphical window

Disassembly:
push 8
mov eax, 0x1002431e
call fcn.10023379
mov ebx, ecx
lea edi, [ebx + 0x30]
mov dword [ebp - 0x14], edi
push edi
call dword [sym.imp.kernel32.dll_TryEnterCriticalSection]
neg eax
sbb esi, esi
neg esi
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.1000994e
test eax, eax
jne 0x100040b5
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004084
push edi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
jmp 0x10004084
mov ecx, dword [ebx + 0x24]
xor eax, eax
cmp dword [ebp + 8], eax
sete al
inc eax
mov dword [ecx + 0x18], eax
mov edi, dword [ebx + 0x2c]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100040f1
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
push eax
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
jne 0x100040f1
mov ecx, ebx
call fcn.10003ebd
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10004102
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call fcn.10023451
ret 4