joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x4d0008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str.system.dat
push 0x4d3288
lea eax, [ebp - 0x108]
mov esi, ecx
push str._s_s
push eax
mov dword [ebp - 0x114], esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4659f2
push 0x4c1840
call dword [sym.imp.PAL.dll_PalErrorLogPrintf]
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d061
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.PAL.dll_PalCheckWindowMode]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
mov dword [esi + 8], eax
lea eax, [ebp - 0x110]
push eax
push 2
push 0x4ba27c
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
push eax
push 0x330
push esi
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x26548]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x2654c]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x26554]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x26550]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xc
lea eax, [esi + 0x26558]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x26564]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x26568]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x26570]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 4
lea eax, [esi + 0x2656c]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xc
lea eax, [esi + 0x26574]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xc
lea eax, [esi + 0x266e0]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0xb34
lea eax, [esi + 0x266ec]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 8
lea eax, [esi + 0x27220]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x1000
lea eax, [esi + 0x448e8]
push eax
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
add esi, 0x877e68
push eax
push 4
push esi
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
push eax
push dword [esi]
mov esi, dword [ebp - 0x114]
push dword [esi + 0x877e60]
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
add esi, 0x877e64
push eax
push 4
push esi
push ebx
call edi
push 0
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x114]
push dword [esi]
push dword [eax + 0x877e5c]
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046d061
mov esp, ebp
pop ebp
ret
Function at 0x469090
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [edi + 4], eax
mov eax, dword [ebp + 0xc]
push 0
push eax
mov eax, dword [ebp + 8]
add eax, ebx
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4690eb
test eax, eax
je 0x4690d9
mov esi, dword [edi + 8]
add ebx, eax
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [edi + 4]
cmp eax, esi
jae 0x4690e2
mov eax, dword [ebp + 0xc]
cmp ebx, eax
jb 0x4690a6
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push 0x18
push str.HTTP:_recv_timeout_error
jmp 0x4690f2
push 0x10
push str.HTTP:_recv_error
lea ecx, [edi + 0x18]
call fcn.0042d8f0
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
pop esi
mov eax, 0x80004005
pop ebx
pop ebp
ret 8

Function at 0x4691c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a8
mov eax, dword [0x4d0008]
xor eax, esp
mov dword [esp + 0x1a4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x14]
push edi
mov edi, dword [0x6cb658]
push eax
push 0x101
mov dword [edi], 0xffffffff
mov dword [edi + 8], 0x2710
call dword [sym.imp.WS2_32.dll_WSAStartup]
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
jne 0x469247
push 0x19
push str.HTTP:_gethostbyname_error
lea ecx, [edi + 0x18]
call fcn.0042d8f0
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0x80004005
pop edi
pop esi
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.0046d061
mov esp, ebp
pop ebp
ret 8
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x469263
push 0x12
push str.HTTP:_socket_error
jmp 0x469216
mov eax, 2
mov word [esp + 8], ax
mov eax, dword [esi + 0xc]
push 0x50
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea eax, [esp + 8]
push 0x10
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4692a4
push 0x13
push str.HTTP:_connect_error
jmp 0x469216
mov ecx, dword [esp + 0x1ac]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0046d061
mov esp, ebp
pop ebp
ret 8
Function at 0x46b640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 4], 4
mov dword [ebp - 0x10], 0x84df873
mov dword [ebp - 0x14], 0xff987dee
and eax, 3
je 0x46b66a
sub edx, eax
mov dword [ebp - 8], edx
push edi
mov edi, dword [ebp - 0xc]
mov cl, byte [ebp - 4]
mov edx, dword [ebp - 8]
rol byte [edi], cl
add cl, 1
and cl, 0xff
mov eax, dword [ebp - 0x10]
xor dword [edi], eax
mov eax, dword [ebp - 0x14]
xor dword [edi], eax
add edi, 4
sub edx, 4
jne 0x46b674
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x499d7f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00499559

Function at 0x499d8a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00499794

Function at 0x49aa2f
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049a7b6
Function at 0x1000d890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10105f50
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
test eax, eax
je 0x1000d994
cmp byte [eax + 0x54], 0
je 0x1000d994
add eax, 0x1c
lea ecx, [ebp - 0x34]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x34], xmm0
call fcn.10006e20
mov dword [ebp - 4], 0
mov eax, dword [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x1000d8fa
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000d985
push 0
mov edx, edi
lea ecx, [ebp - 0x2c]
call fcn.100240c0
add esp, 4
mov byte [ebp - 4], 1
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x38]
push 0
push ecx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
cmp dword [ebp - 0x18], 0x10
jb 0x1000d973
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10006e70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10103694
mov esp, ebp
pop ebp
ret 4
Function at 0x1001d020
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
mov eax, edx
mov dword [ebp - 0x10], eax
movsx eax, al
push esi
push edi
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmmword [ebp - 0x30], xmm0
test ecx, ecx
je 0x1001d14d
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x1001d14d
mov esi, dword [ebx + 0x10]
test esi, esi
jle 0x1001d14d
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x1001d14d
cmp dword [ebx + 0x18], 0
je 0x1001d14d
cmp dword [eax], 0
jne 0x1001d14d
lea eax, [esi + 0x50]
mov dword [ebp - 0x14], eax
push eax
mov eax, dword [ecx + 8]
call eax
mov ecx, eax
add esp, 4
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x1001d14d
xor eax, eax
cmp esi, 0x20
jb 0x1001d115
lea edx, [ecx + 0x50]
add ecx, 0x4f
add ecx, esi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
lea ecx, [edi - 1]
add ecx, esi
cmp edx, ecx
ja 0x1001d0d4
cmp dword [ebp - 8], edi
jae 0x1001d115
mov ecx, esi
and ecx, 0x8000001f
jns 0x1001d0e3
dec ecx
or ecx, 0xffffffe0
inc ecx
movdqa xmm1, xmmword [ebp - 0x30]
mov edx, esi
sub edx, ecx
mov ecx, dword [ebp - 0xc]
nop
movdqu xmm0, xmmword [edi + eax]
pxor xmm0, xmm1
movdqu xmmword [ecx + eax], xmm0
movdqu xmm0, xmmword [edi + eax + 0x10]
pxor xmm0, xmm1
movdqu xmmword [ecx + eax + 0x10], xmm0
add eax, 0x20
cmp eax, edx
jl 0x1001d0f0
cmp eax, esi
jge 0x1001d132
mov edx, dword [ebp - 0x10]
lea esp, [esp]
mov cl, byte [eax + edi]
mov esi, dword [ebp - 4]
xor cl, dl
mov byte [esi + eax + 0x50], cl
inc eax
cmp eax, dword [ebx + 0x10]
jl 0x1001d120
mov ecx, dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1001d160
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
mov eax, edx
mov dword [ebp - 0x10], eax
movsx eax, al
push esi
push edi
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
movdqa xmmword [ebp - 0x20], xmm0
test ecx, ecx
je 0x1001d299
mov edi, dword [ebx + 8]
test edi, edi
je 0x1001d299
mov esi, dword [ebx + 0xc]
test esi, esi
jle 0x1001d299
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x1001d299
cmp dword [ebx + 0x14], 0
je 0x1001d299
cmp dword [eax], 0
jne 0x1001d299
mov eax, dword [ecx + 8]
push esi
call eax
mov ecx, eax
add esp, 4
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x1001d299
xor edx, edx
cmp esi, 0x20
jb 0x1001d25b
lea eax, [edi - 1]
add eax, esi
cmp ecx, eax
ja 0x1001d204
lea eax, [esi - 1]
add eax, ecx
cmp eax, edi
jae 0x1001d25b
mov eax, esi
and eax, 0x8000001f
jns 0x1001d212
dec eax
or eax, 0xffffffe0
inc eax
movdqa xmm1, xmmword [ebp - 0x20]
mov dword [ebp - 4], esi
mov esi, ecx
sub dword [ebp - 4], eax
sub esi, edi
mov dword [ebp - 0xc], esi
mov eax, edi
mov esi, dword [ebx + 0xc]
mov edi, dword [ebp - 0xc]
lea esp, [esp]
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
pxor xmm0, xmm1
movdqu xmmword [edi + eax - 0x20], xmm0
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm0, xmm1
movdqu xmmword [ecx + edx + 0x10], xmm0
add edx, 0x20
cmp edx, dword [ebp - 4]
jl 0x1001d230
mov edi, dword [ebx + 8]
cmp edx, esi
jge 0x1001d284
sub edi, dword [ebp - 8]
add ecx, edx
sub esi, edx
mov edx, dword [ebp - 0x10]
lea esp, [esp]
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor al, dl
mov byte [ecx - 1], al
dec esi
jne 0x1001d270
mov esi, dword [ebx + 0xc]
mov ecx, dword [ebp - 8]
mov eax, dword [ebx + 0x10]
mov dword [eax], ecx
mov eax, dword [ebx + 0x14]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1002d8a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1010ad48
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x10], ebx
cmp dword [ebx + 0x40], 0
je 0x1002da41
cmp byte [ebx + 0x45], 0
je 0x1002da41
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x1002d904
xor al, al
jmp 0x1002da43
mov ecx, 0xf
mov dword [esp + 0x2c], 0
mov dword [esp + 0x2c], ecx
lea eax, [esp + 0x18]
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
cmp ecx, 0x10
movq qword [esp + 0x18], xmm0
mov dword [esp + 0x28], 0
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x28], 0
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
mov dword [esp + 0x40], 0
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x2c]
jmp 0x1002d960
cmp esi, 0x10
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1c]
cmovae edx, edi
lea ecx, [esp + 0x1c]
cmovae ecx, edi
add eax, edx
push eax
push ecx
mov ecx, dword [ebx + 0x40]
lea eax, [ebx + 0x48]
push eax
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x1002d99c
dec eax
je 0x1002d9a0
sub eax, 2
je 0x1002da0a
xor bl, bl
jmp 0x1002da0c
mov byte [ebx + 0x45], 0
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov edi, dword [esp + 0x18]
cmp esi, 0x10
mov ebx, dword [esp + 0x14]
cmovae eax, edi
sub ebx, eax
je 0x1002d9e4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
cmp esi, 0x10
cmovae eax, edi
push dword [ecx + 0x50]
push ebx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x1002d998
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp byte [eax + 0x45], 0
je 0x1002da0a
test ebx, ebx
mov ebx, eax
jne 0x1002d960
push 0
push 8
lea ecx, [esp + 0x20]
call fcn.10028c20
jmp 0x1002d953
mov bl, 1
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x2c], 0x10
jb 0x1002da28
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esp + 0x2c], 0xf
mov al, bl
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
jmp 0x1002da43
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10103694
mov esp, ebp
pop ebp
ret
Function at 0x1002e5e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010aed9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
push 0
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::_Lockit::constructor_int_]
mov dword [esp + 0x30], 0
mov eax, dword [0x101623e4]
mov ecx, dword [sym.imp.MSVCP120.dll_class_std::locale::id_std::codecvt_char__char__int_::id]
mov dword [esp + 0x1c], eax
call dword [sym.imp.MSVCP120.dll_public:_unsigned_int___thiscall_std::locale::id::operator_unsigned_int_void_]
mov edi, eax
mov eax, dword [ebx]
cmp edi, dword [eax + 0xc]
jae 0x1002e651
mov ecx, dword [eax + 8]
mov esi, dword [ecx + edi*4]
test esi, esi
jne 0x1002e6c2
jmp 0x1002e653
xor esi, esi
cmp byte [eax + 0x14], 0
je 0x1002e66a
call dword [sym.imp.MSVCP120.dll_private:_static_class_std::locale::_Locimp____cdecl_std::locale::_Getgloballocale_void_]
cmp edi, dword [eax + 0xc]
jae 0x1002e66e
mov eax, dword [eax + 8]
mov esi, dword [eax + edi*4]
test esi, esi
jne 0x1002e6c2
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x1002e6c2
lea eax, [esp + 0x1c]
push ebx
push eax
call dword [sym.imp.MSVCP120.dll_public:_static_unsigned_int___cdecl_std::codecvt_char__char__int_::_Getcat_class_std::locale::facet_const____class_std::locale_const__]
add esp, 8
cmp eax, 0xffffffff
jne 0x1002e6a8
push str.bad_cast
lea ecx, [esp + 0x14]
call dword [sym.imp.MSVCR120.dll_public:_void___thiscall_std::bad_cast::constructor_char_const__]
push 0x1015dc9c
lea eax, [esp + 0x14]
push eax
call sub.MSVCR120.dll__CxxThrowException
mov esi, dword [esp + 0x1c]
mov ecx, esi
mov dword [0x101623e4], esi
mov edx, dword [esi]
call dword [edx + 4]
push esi
call fcn.101034c7
add esp, 4
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP120.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10103694
add esp, 0x24
ret
Function at 0x10031ca0
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x10031cb6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov eax, dword [esp + 8]
mov word [esi + 4], 0
cmp dword [eax + 0x10], 0
je 0x10031cd0
cmp dword [eax + 0x14], 8
jb 0x10031cd2
mov eax, dword [eax]
jmp 0x10031cd2
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x10031cf4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10031cf4
mov byte [esi + 5], 1
cmp dword [esi], 0
pop esi
setne al
ret 4

Function at 0x10031d00
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x1010b208
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [esp + 0x2c]
test eax, eax
je 0x10031d4a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [esp + 0x14]
mov word [edi + 4], 0
mov dword [esp + 0x14], 0
call fcn.100599e0
mov dword [esp + 0x24], 0
mov esi, dword [esp + 0x14]
cmp dword [esi], 0
je 0x10031d77
lea eax, [esi + 8]
jmp 0x10031d79
xor eax, eax
cmp dword [ebx + 0x10], 0
je 0x10031d89
cmp dword [ebx + 0x14], 8
jb 0x10031d8b
mov ebx, dword [ebx]
jmp 0x10031d8b
xor ebx, ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x10031dac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10031dac
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x10031dd6
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10031deb
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esp + 0x14], 0
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.10103694
add esp, 0x18
ret 4
Function at 0x10031e30
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x1010b238
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [esp + 0x2c]
test eax, eax
je 0x10031e7b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
lea ecx, [esp + 0x18]
mov word [edi + 4], 0
mov dword [esp + 0x18], 0
call fcn.10059b20
mov dword [esp + 0x24], 0
mov esi, dword [esp + 0x14]
cmp dword [esi], 0
je 0x10031ea9
lea ebp, [esi + 8]
jmp 0x10031eab
xor ebp, ebp
cmp dword [ebx + 0x10], 0
je 0x10031ebf
cmp dword [ebx + 0x14], 8
jb 0x10031ebb
mov eax, dword [ebx]
jmp 0x10031ec1
mov eax, ebx
jmp 0x10031ec1
xor eax, eax
push eax
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x10031f0d
call eax
cmp eax, 5
jne 0x10031f03
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebx + 0x10], 0
je 0x10031ef5
cmp dword [ebx + 0x14], 8
jb 0x10031ef7
mov ebx, dword [ebx]
jmp 0x10031ef7
xor ebx, ebx
push ebx
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
cmp dword [edi], 0
je 0x10031f24
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0xb7
jne 0x10031f1a
mov byte [edi + 5], 1
mov ecx, dword [edi]
call fcn.10056940
cmp dword [edi], 0
setne bl
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x10031f4b
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10031f60
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esp + 0x14], 0
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10103694
add esp, 0x14
ret 4
Function at 0x1003a260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1010c2d1
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x38], 0
xor eax, eax
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], esi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], 1
cmp dword [edi + 0x10], eax
je 0x1003a373
push 0x26
push str.47FF0D24_E0A5_4163_8546_DE7217D2F141
mov ecx, esi
call fcn.10004390
xor eax, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov dword [esp + 0x38], 1
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.10043210
lea ecx, [esp + 0x14]
call fcn.10021410
push 1
push 0x1012e670
mov ecx, esi
call fcn.1000dcb0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
call fcn.1000dbf0
mov byte [esp + 0x38], 0
cmp dword [esp + 0x28], 8
jb 0x1003a35c
push dword [esp + 0x14]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10103694
add esp, 0x30
ret 8