joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031f80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004bac3
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1005d040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea edx, [edi + 0x40]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], ecx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x1003206b
test cl, 0x10
jne 0x1003206b
mov al, 1
jmp 0x1003206d
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [edx + 4]
mov ecx, ebx
mov esi, dword [esi + 0x18]
sar ecx, 3
cmp esi, ecx
jae 0x10032091
lea ecx, [esi*8]
mov dword [edx + 4], ecx
jmp 0x100320c3
jbe 0x100320c3
mov eax, dword [edx + 8]
sar eax, 3
cmp esi, eax
jbe 0x100320a8
push ecx
push esi
mov ecx, edx
call fcn.10033a10
jmp 0x100320c3
sub esi, ecx
je 0x100320c0
shl esi, 3
push esi
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [edi + 0x40]
add ebx, esi
mov dword [edx + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x1003ab60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x240
mov eax, dword [0x1005d040]
xor eax, esp
mov dword [esp + 0x23c], eax
push 0x100
lea eax, [esp + 0x3c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x1003ad5b
xorps xmm0, xmm0
mov dword [esp + 0x20], 0
lea ecx, [esp + 0x38]
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x24], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003abb2
sub ecx, edx
lea eax, [esp + 0x38]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.10045c40
push 0
push str.___
lea ecx, [esp + 0x18]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003ad02
push 0
push 0x100545c0
lea ecx, [esp + 0x18]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003ad02
push 0
push 0x100545cc
lea ecx, [esp + 0x18]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003ad02
push 0
push 0x100545d8
lea ecx, [esp + 0x18]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003ad02
push 0
push 0x100545e4
lea ecx, [esp + 0x18]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003ad02
push 0
push str.GZ_1stScan
lea ecx, [esp + 0x18]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003ad02
push 0
push str.GZ_NxtScan
lea ecx, [esp + 0x18]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003ad02
push 0
push str.FIRST
lea ecx, [esp + 0x18]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003ad02
push 0
push str.NEXT
lea ecx, [esp + 0x18]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003ad02
push 0
push str.Next_Scan
lea ecx, [esp + 0x18]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003ad02
push 0
push str.First_Scan
lea ecx, [esp + 0x18]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003ad02
push 0
push str.bossb_View
lea ecx, [esp + 0x18]
call fcn.10044980
cmp eax, 0xffffffff
jne 0x1003ad02
push 0
push str.Memory_View
lea ecx, [esp + 0x18]
call fcn.10044980
mov byte [esp + 0xf], 0
cmp eax, 0xffffffff
je 0x1003ad07
mov byte [esp + 0xf], 1
mov ecx, dword [esp + 0x24]
cmp ecx, 7
jbe 0x1003ad45
mov edx, dword [esp + 0x10]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1003ad3b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1003ad3b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10049f8a
add esp, 8
mov al, byte [esp + 0xf]
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.10049b4d
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x23c]
xor al, al
xor ecx, esp
call fcn.10049b4d
mov esp, ebp
pop ebp
ret
Function at 0x1003eb20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.xxxxxxxxxxx
mov edx, 0x100552dc
call fcn.10037db0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
lea ecx, [esi + 6]
push esi
mov dword [0x1005eae4], ecx
call edi
mov eax, 0x1003eaa0
mov byte [esi + 5], 0x90
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 6
push esi
call edi
push str.xxxxxxxxx
mov edx, 0x10055300
call fcn.10037db0
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 7
lea ecx, [esi + 7]
push esi
mov dword [0x1005eadc], ecx
call edi
mov eax, 0x9090
mov word [esi + 5], ax
mov eax, 0x1003eac0
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 7
push esi
call edi
push str.xxxxxx
mov edx, 0x10055314
call fcn.10037db0
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
lea ecx, [esi + 6]
push esi
mov dword [0x1005eac0], ecx
call edi
mov eax, 0x1003eae0
mov byte [esi + 5], 0x90
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 6
push esi
call edi
push str.xxxxxxxxxx
mov edx, 0x10055328
call fcn.10037db0
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
lea ecx, [esi + 6]
push esi
mov dword [0x1005eacc], ecx
call edi
mov eax, 0x1003eb00
mov byte [esi + 5], 0x90
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 6
push esi
call edi
push str.xxxxxx
mov edx, 0x10055334
call fcn.10037db0
push str.xxxxxx
mov edx, 0x1005533c
mov dword [0x1005eaec], eax
call fcn.10037db0
push str.xxxxxx
mov edx, 0x10055344
mov dword [0x1005eac8], eax
call fcn.10037db0
push str.xxxxxx
mov edx, 0x1005534c
call fcn.10037db0
push str.xxxxxx
mov edx, 0x10055354
call fcn.10037db0
push str.xxxxxx
mov edx, 0x1005535c
call fcn.10037db0
push str.xxxxxx
mov edx, 0x10055364
call fcn.10037db0
push str.xxxxxxxx
mov edx, 0x10055378
mov dword [0x1005ead4], eax
call fcn.10037db0
push str.xxxxxx
mov edx, 0x10055384
mov dword [0x1005eae0], eax
call fcn.10037db0
push str.xxxxxxx
mov edx, 0x10055394
mov dword [0x1005eae8], eax
call fcn.10037db0
push str.xxxx
mov edx, 0x100553a4
mov dword [0x1005ead8], eax
call fcn.10037db0
push str.xxxxxxx
mov edx, 0x100553ac
mov dword [0x1005eac4], eax
call fcn.10037db0
mov ecx, dword [ebp - 4]
add esp, 0x30
xor ecx, ebp
mov dword [0x1005eaf4], eax
pop edi
pop esi
call fcn.10049b4d
mov esp, ebp
pop ebp
ret
Function at 0x1003ed50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1005eb2e], 0
lea eax, [ebp - 8]
push esi
mov esi, dword [0x1005eaec]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 1
push esi
je 0x1003ed87
call edi
mov byte [esi], 0xeb
jmp 0x1003ed8c
call edi
mov byte [esi], 0x7a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
cmp byte [0x1005eb35], 0
lea eax, [ebp - 8]
mov esi, dword [0x1005eac8]
push eax
push 0x40
push 1
push esi
je 0x1003edb7
call edi
mov byte [esi], 0xeb
jmp 0x1003edbc
call edi
mov byte [esi], 0x74
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
cmp byte [0x1005eb68], 0
lea eax, [ebp - 8]
mov esi, dword [0x1005ead4]
push eax
push 0x40
push 1
push esi
je 0x1003ede7
call edi
mov byte [esi], 0xeb
jmp 0x1003edec
call edi
mov byte [esi], 0x74
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
cmp byte [0x1005eb2f], 0
lea eax, [ebp - 8]
mov esi, dword [0x1005ead8]
push eax
push 0x40
push 1
push esi
je 0x1003ee17
call edi
mov byte [esi], 0
jmp 0x1003ee1c
call edi
mov byte [esi], 6
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
cmp byte [0x1005eb36], 0
lea eax, [ebp - 8]
mov esi, dword [0x1005eae0]
push eax
push 0x40
push 4
push esi
je 0x1003ee4a
call edi
mov dword [esi], 0x43960000
jmp 0x1003ee52
call edi
mov dword [esi], 0x42a00000
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call edi
cmp byte [0x1005eb34], 0
lea eax, [ebp - 8]
mov esi, dword [0x1005eae8]
push eax
push 0x40
push 4
push esi
je 0x1003ee80
call edi
mov dword [esi], 0x49742400
jmp 0x1003ee88
call edi
mov dword [esi], 0x442f0000
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call edi
cmp byte [0x1005eb2d], 0
lea eax, [ebp - 8]
mov esi, dword [0x1005eac4]
push eax
push 0x40
push 1
push esi
je 0x1003eeb3
call edi
mov byte [esi], 0
jmp 0x1003eeb8
call edi
mov byte [esi], 2
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call edi
cmp byte [0x1005eb37], 0
lea eax, [ebp - 8]
mov esi, dword [0x1005eaf4]
push eax
push 0x40
push 4
push esi
je 0x1003eee6
call edi
mov dword [esi], 0
jmp 0x1003eeee
call edi
mov dword [esi], 0x41200000
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10049b4d
mov esp, ebp
pop ebp
ret
Function at 0x10043ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10043b0c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10043b34
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10043b3a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10043bc4
jg 0x10043b51
test esi, esi
je 0x10043bc4
test ecx, ecx
jl 0x10043ba7
jg 0x10043b5b
test eax, eax
je 0x10043ba7
cmp edi, ecx
jg 0x10043b6f
jl 0x10043b65
cmp esi, eax
jae 0x10043b6f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 8]
add edx, ecx
sub esi, ecx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x10043bc4
jg 0x10043baa
test esi, esi
je 0x10043bc4
jmp 0x10043baa
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10043bc4
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10043be0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x10043c0c
jl 0x10043c00
test ecx, ecx
jne 0x10043c0c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10043c25
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x10043c6d
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x10043c73
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x10043c73
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x10043ce6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10043c9c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10043cd4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10043ce6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10043cb0
test edi, edi
je 0x10043ce6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10044060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10044090
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b4d
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x100440cc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x100440cc
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b4d
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x100441a3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100440f4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10044100
movsx eax, bl
jmp 0x10044138
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10044162
sub eax, 1
je 0x10044162
sub eax, 2
jne 0x100441a3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b4d
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10044180
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100441a3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b4d
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049b4d
mov esp, ebp
pop ebp
ret 4
Function at 0x10044f80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1004503c
cmp byte [esi + 0x3d], 0
je 0x1004503c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1004502a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10044ff1
sub eax, 1
je 0x10044ff5
sub eax, 2
jne 0x1004502a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b4d
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10045013
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1004502a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b4d
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b4d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10049b4d
mov esp, ebp
pop ebp
ret
Function at 0x100486c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004cfe5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
mov esi, dword [ebp + 8]
jne 0x10048762
push 0
mov dword [0x1005eaf8], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 1
call fcn.10049c3b
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100487c0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x10048753
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 1
call fcn.10037b70
cmp dword [ebp - 0x18], 0
je 0x10048762
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 6
mov dword [ebp - 0x18], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049b4d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10049150
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x28], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1004924a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10049243
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x10049229
call ebx
cmp dword [ebp - 0x14], eax
jne 0x10049229
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10049229
mov edx, dword [esi]
test edx, edx
jne 0x100491f2
push 0x200
push edx
push dword [0x1005eb00]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10049243
jmp 0x1004921d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1004921d
shl eax, 3
push eax
push edx
push 0
push dword [0x1005eb00]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10049243
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100491b1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x100492a2
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x100492a2
xor ecx, ecx
mov dword [ebp - 0x24], ecx
nop dword [eax + eax]
mov eax, dword [esi]
push dword [eax + ecx]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10049293
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x28]
mov ecx, edi
call fcn.10048fe0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x24]
inc ebx
add ecx, 4
mov dword [ebp - 0x24], ecx
cmp ebx, dword [esi + 8]
jb 0x10049260
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049b4d
mov esp, ebp
pop ebp
ret

Function at 0x100492c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x10049324
push ebx
xor ebx, ebx
cmp dword [edi + 8], ebx
jbe 0x10049313
xor ecx, ecx
mov dword [ebp - 4], ecx
push esi
nop word [eax + eax]
mov eax, dword [edi]
push dword [eax + ecx]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x10049303
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
inc ebx
add ecx, 4
mov dword [ebp - 4], ecx
cmp ebx, dword [edi + 8]
jb 0x100492e0
pop esi
push dword [edi]
push 0
push dword [0x1005eb00]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10049330
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1005d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x1005edd0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10049391
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049b4d
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x100493b2
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x100493d3
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x100493d3
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x100493cd
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x100493d3
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.10049b4d
mov esp, ebp
pop ebp
ret