joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100018f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080d38
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
mov eax, dword [0x100a2078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov cl, 9
mov dword [ebp - 0x20], 0x7d6c4e09
mov dword [ebp - 0x1c], 0x626a605d
xor eax, eax
mov dword [ebp - 0x18], 0x677c664a
mov word [ebp - 0x14], 0x7d
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x10001944
mov cl, byte [ebp - 0x20]
jmp 0x10001935
mov byte [ebp - 0x13], 0
mov cl, 0x65
mov dword [ebp - 0x30], 0x17000e65
xor eax, eax
mov dword [ebp - 0x2c], 0x5609000b
mov dword [ebp - 0x28], 0x9014b57
mov word [ebp - 0x24], 9
xor byte [ebp + eax - 0x2f], cl
inc eax
cmp eax, 0xc
jae 0x10001976
mov cl, byte [ebp - 0x30]
jmp 0x10001967
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x23], 0
push eax
lea eax, [ebp - 0x2f]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.10017cc0
cmp al, 0xe9
jne 0x10001a5a
mov bh, 0x1e
mov byte [ebp - 0xd], 0x3e
mov byte [ebp - 0xe], bh
mov al, 3
mov bh, byte [ebp - 0xd]
mov cl, 9
mov byte [ebp - 0x20], 0x6a
mov dl, 1
xor bh, byte [ebp - 0x20]
mov bl, 0x29
xor al, byte [ebp - 0x20]
mov ah, 5
mov byte [ebp - 0xd], bh
mov ch, 0x1f
mov byte [ebp - 0x1f], bh
mov dh, 4
mov bh, byte [ebp - 0xe]
mov byte [ebp - 0x1e], al
mov al, byte [ebp - 0x20]
xor cl, al
mov byte [ebp - 0x16], 0
xor dl, al
mov byte [ebp - 0x1d], cl
xor bl, al
mov byte [ebp - 0x1c], dl
xor ah, al
mov byte [ebp - 0x1b], bl
xor ch, al
mov byte [ebp - 0x1a], ah
xor dh, al
mov byte [ebp - 0x19], ch
xor bh, al
mov byte [ebp - 0x18], dh
cmp byte [ebp - 0xd], 0
mov byte [ebp - 0x17], bh
mov byte [ebp - 0x16], 0
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
jne 0x10001a18
xor ecx, ecx
jmp 0x10001a29
lea ecx, [ebp - 0x1f]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001a20
sub ecx, edx
push ecx
lea eax, [ebp - 0x1f]
push eax
lea ecx, [ebp - 0x38]
call fcn.10002710
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.1001b780
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x10001a5a
inc eax
lea ecx, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
call fcn.100025f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100a2078]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x10098a60]
xor eax, eax
movups xmmword [ebp - 0x28], xmm0
nop dword [eax]
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xe
jb 0x10001cb0
mov byte [ebp - 0x19], 0
mov cl, 0x69
mov dword [ebp - 0x18], 0x3b2c2269
xor eax, eax
mov dword [ebp - 0x14], 0x5a252c27
mov dword [ebp - 0x10], 0x50d475b
mov word [ebp - 0xc], 5
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 0xc
jae 0x10001cef
mov cl, byte [ebp - 0x18]
jmp 0x10001ce0
lea eax, [ebp - 0x27]
mov byte [ebp - 0xb], 0
push eax
lea eax, [ebp - 0x17]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 1
lea ecx, [ebp - 5]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [ebp - 5], 0xe9
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
call fcn.10066135
mov esp, ebp
pop ebp
ret

Function at 0x10001e00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
ret

Function at 0x10001e10
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1009bb08
push 0x1006ade0
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc0
mov eax, dword [0x100a2078]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x48], 0
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x40
push 0x3000
mov edx, dword [ebp - 0x44]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10001ea9
xor al, al
jmp 0x10001f32
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov byte [ecx], 0xc3
lea edx, [ebp - 0x20]
push edx
push 0x140
mov eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001ed4
xor al, al
jmp 0x10001f32
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
push 0x10001f1f
jmp eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10066135
mov esp, ebp
pop ebp
ret
Function at 0x10002b70
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100a2078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov byte [ebp - 0x18], 0x5e
mov al, 0x30
xor al, byte [ebp - 0x18]
mov bl, 0x32
mov ah, bl
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x18]
mov dl, 0x3a
mov bh, ah
mov byte [ebp - 9], ah
mov dh, dl
mov byte [ebp - 0xe], 0
xor dl, al
mov byte [ebp - 0xe], 0
xor bl, al
mov byte [ebp - 0x15], dl
xor ah, al
mov byte [ebp - 0x14], bl
xor dh, al
mov byte [ebp - 0x13], ah
xor bh, al
mov byte [ebp - 0x11], dh
mov cl, 0x2a
mov byte [ebp - 0x10], bh
xor cl, al
mov ch, 0x70
xor ch, al
mov byte [ebp - 0x16], cl
mov al, byte [ebp - 9]
xor al, byte [ebp - 0x18]
mov byte [ebp - 0xf], al
lea eax, [ebp - 0x17]
push eax
mov byte [ebp - 0x12], ch
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movaps xmm0, xmmword [0x10099110]
mov edx, eax
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x20], 0x3a000804
xor eax, eax
mov word [ebp - 0x1c], 0x30
pop ebx
nop dword [eax]
mov cl, byte [ebp - 0x30]
xor byte [ebp + eax - 0x2f], cl
inc eax
cmp eax, 0x14
jb 0x10002c00
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x1b], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ecx
mov edx, 0x10002870
mov ecx, eax
call fcn.10062040
add esp, 4
mov dword [0x100a55e8], eax
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 0x40
push 5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066135
mov esp, ebp
pop ebp
ret

Function at 0x10002d20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movaps xmm0, xmmword [0x100996a0]
xor ecx, ecx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], 0x69635a61
mov dword [ebp - 8], 0x7e6c614e
mov word [ebp - 4], 0x7e
mov al, byte [ebp - 0x1c]
xor byte [ebp + ecx - 0x1b], al
inc ecx
cmp ecx, 0x18
jb 0x10002d47
push 0
lea eax, [ebp - 0x1b]
mov byte [ebp - 3], 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10002d7f
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10002d90
Capabilities:
Encode data using xor
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100a2078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1000
push 0x40
mov dword [ebp - 8], 0x1000
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
push 0x250000
call dword [sym.imp.MPR.dll_WNetGetProviderNameA]
test eax, eax
jne 0x10002e27
movaps xmm0, xmmword [0x10099150]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x1b7d3938
mov dword [ebp - 0x10], 0x38393132
mov word [ebp - 0xc], 0x2e2f
mov byte [ebp - 0xa], al
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x19
jb 0x10002df0
lea eax, [ebp - 0x23]
mov byte [ebp - 0xa], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10002e27
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10066135
mov esp, ebp
pop ebp
ret
Function at 0x10005c90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100811a6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100a2078]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10066146
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10062592
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10007520
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100813ba
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100a2078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.100627e1
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x100075e0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.100686cd
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x100a0838
push eax
call fcn.10068c5a
push edi
push esi
call fcn.10062695
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066135
mov esp, ebp
pop ebp
ret 4
Function at 0x1000acb0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100a2078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push esi
push edi
test eax, eax
jne 0x1000acce
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000ad71
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x28
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000ad71
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
push str.SeSecurityPrivilege
push 0
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1000ad71
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1000ad71
push ecx
mov ecx, dword [ebp - 0x18]
mov edx, str.SeDebugPrivilege
call fcn.1000ac40
add esp, 4
test al, al
je 0x1000ad71
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call esi
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066135
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.10066135
mov esp, ebp
pop ebp
ret

Function at 0x1000ad90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100a2078]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000adfe
movaps xmm0, xmmword [0x10099780]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
mov word [ebp - 0x24], 0x68
nop dword [eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x10
jb 0x1000add0
lea eax, [ebp - 0xc]
mov byte [ebp - 0x23], 0
push eax
lea eax, [ebp - 0x33]
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x1000ae0e
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10066135
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
push 0
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x20]
test eax, eax
je 0x1000adf8
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10066135
mov esp, ebp
pop ebp
ret
Function at 0x1000ae60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ecx + 0x14]
sub edx, dword [ecx + 0x10]
push esi
mov esi, dword [ecx + 8]
lea eax, [esi + 1]
cmp eax, edx
jbe 0x1000ae75
xor dl, dl
jmp 0x1000ae7b
mov eax, dword [ecx + 0x10]
mov dl, byte [esi + eax]
lea eax, [esi + 1]
mov dword [ecx + 8], eax
movzx eax, dl
cmp eax, 0x13
ja case.0x1000ae8d.2
jmp dword [eax*4 + 0x1000aff8]
pop esi
jmp fcn.1000b050
mov eax, dword [0x100a55ec]
test eax, eax
je case.0x1000ae8d.2
mov eax, dword [eax + 0x3c]
test eax, eax
je case.0x1000ae8d.2
push ecx
mov ecx, eax
call fcn.1002d610
pop esi
ret
mov eax, dword [0x100a55ec]
test eax, eax
je case.0x1000ae8d.2
mov eax, dword [eax + 0x70]
test eax, eax
je case.0x1000ae8d.2
push ecx
mov ecx, eax
call fcn.1003b500
pop esi
ret
mov eax, dword [0x100a55ec]
test eax, eax
je case.0x1000ae8d.2
mov eax, dword [eax + 0x74]
test eax, eax
je case.0x1000ae8d.2
push ecx
mov ecx, eax
call fcn.10040490
pop esi
ret
pop esi
jmp 0x1004e600
mov eax, dword [0x100a55ec]
test eax, eax
je case.0x1000ae8d.2
mov eax, dword [eax + 0x78]
test eax, eax
je case.0x1000ae8d.2
push ecx
mov ecx, eax
call fcn.10045110
pop esi
ret
mov eax, dword [0x100a55ec]
test eax, eax
je case.0x1000ae8d.2
mov eax, dword [eax + 0x7c]
test eax, eax
je case.0x1000ae8d.2
push ecx
mov ecx, eax
call fcn.10047410
pop esi
ret
mov eax, dword [0x100a55ec]
test eax, eax
je case.0x1000ae8d.2
mov eax, dword [eax + 0x80]
test eax, eax
je case.0x1000ae8d.2
push ecx
mov ecx, eax
call fcn.1004b080
pop esi
ret
mov eax, dword [0x100a55ec]
test eax, eax
je case.0x1000ae8d.2
mov eax, dword [eax + 0x94]
test eax, eax
je case.0x1000ae8d.2
push ecx
mov ecx, eax
call fcn.1005b260
pop esi
ret
mov eax, dword [0x100a55ec]
test eax, eax
je case.0x1000ae8d.2
mov eax, dword [eax + 0xa0]
test eax, eax
je case.0x1000ae8d.2
push ecx
mov ecx, eax
call fcn.100608a0
pop esi
ret
pop esi
jmp fcn.1000b3b0
pop esi
jmp fcn.1000b570
pop esi
jmp fcn.1000b730
pop esi
jmp fcn.1000b820
cmp dword [0x100a55f0], 0
je case.0x1000ae8d.2
push ecx
call fcn.1001e220
pop esi
ret
pop esi
jmp fcn.1000bb20
mov eax, dword [0x100a55ec]
test eax, eax
je case.0x1000ae8d.2
mov eax, dword [eax + 0x84]
test eax, eax
je case.0x1000ae8d.2
push ecx
mov ecx, eax
call fcn.1004c7f0
pop esi
ret
push ecx
push esi
mov esi, dword [0x100a55ec]
mov edx, ecx
push edi
test esi, esi
je 0x1004e693
mov edi, dword [edx + 8]
mov ecx, dword [edx + 0x14]
sub ecx, dword [edx + 0x10]
lea eax, [edi + 1]
cmp eax, ecx
jbe 0x1004e627
xor cl, cl
jmp 0x1004e62d
mov eax, dword [edx + 0x10]
mov cl, byte [edi + eax]
lea eax, [edi + 1]
mov dword [edx + 8], eax
cmp cl, 1
jne 0x1004e64c
mov ecx, dword [esi + 0x90]
test ecx, ecx
je 0x1004e693
push edx
call fcn.10052660
pop edi
pop esi
pop ecx
ret
cmp cl, 2
jne 0x1004e665
mov ecx, dword [esi + 0x88]
test ecx, ecx
je 0x1004e693
push edx
call fcn.1004e6a0
pop edi
pop esi
pop ecx
ret
cmp cl, 3
jne 0x1004e67e
mov ecx, dword [esi + 0x8c]
test ecx, ecx
je 0x1004e693
push edx
call fcn.10050250
pop edi
pop esi
pop ecx
ret
cmp cl, 4
jne 0x1004e693
mov ecx, dword [esi + 0x90]
test ecx, ecx
je 0x1004e693
push edx
call fcn.10052810
pop edi
pop esi
pop ecx
ret
Function at 0x10010100
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x100a2078]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
dec eax
push edi
mov edi, dword [ebp + 8]
cmp eax, 8
ja case.default.0x10010129
jmp dword [eax*4 + 0x100102ac]
push 0
lea eax, [esp + 0x10]
push eax
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10066135
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
push eax
push 2
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10066135
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10066135
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
push 4
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x10092b1c
mov ecx, esi
call fcn.1000be20
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x1001021e
push 0x20
push eax
mov ecx, esi
call fcn.100071f0
cmp dword [esi + 0x14], 0x10
jb 0x100101e5
mov esi, dword [esi]
push 0
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10066135
mov esp, ebp
pop ebp
ret 0xc
push 0
lea eax, [esp + 0x10]
push eax
push 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.10066135
mov esp, ebp
pop ebp
ret 0xc
push 0x90
push str.c:usersmonsterdesktopdreamsoft_v1924dreamsoftN3Base_N3TableBase.hpp
push 0x10092b1c
sub esp, 0x18
mov ecx, esp
push str.ERROR____s_n_s:__d_n_n
call fcn.10002810
lea eax, [esp + 0x38]
push eax
call fcn.1000bf20
add esp, 0x28
lea eax, [esp + 0x14]
cmp dword [esp + 0x28], 0x10
cmovae eax, dword [esp + 0x14]
push 0
push str._ASSERTT_n
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x28]
cmp eax, 0x10
jb 0x10010294
inc eax
lea ecx, [esp + 0x14]
push eax
push dword [esp + 0x18]
call fcn.100025f0
mov ecx, dword [esp + 0x2c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.10066135
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011b40
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
push 0
push 0
push 0
push 0x1000dd30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.10016910
call fcn.10064d80
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.10065250
push 0x10011390
push 0x100a5614
call fcn.10064a90
call fcn.10064de0
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push 0x919fd0
call edi
test eax, eax
jne 0x10011bc2
mov dword [0x100a5614], 0x919fd0
call fcn.10064d80
call esi
push eax
call fcn.10065250
push 0x10011390
push 0x100a5614
call fcn.10064600
call fcn.10064de0
call fcn.10064d80
call esi
push eax
call fcn.10065250
push 0x100113c0
push 0x100a5610
call fcn.10064a90
call fcn.10064de0
mov eax, dword [sym.imp.WS2_32.dll_connect]
push 4
push eax
mov dword [0x100a5610], eax
call edi
test eax, eax
jne 0x10011c17
call fcn.10064d80
call esi
push eax
call fcn.10065250
push 0x100113c0
push 0x100a5610
call fcn.10064600
call fcn.10064de0
call fcn.10064d80
call esi
push eax
call fcn.10065250
push 0x100116a0
push 0x100a560c
call fcn.10064a90
call fcn.10064de0
mov eax, dword [sym.imp.WS2_32.dll_WSAConnect]
push 4
push eax
mov dword [0x100a560c], eax
call edi
test eax, eax
jne 0x10011c6c
call fcn.10064d80
call esi
push eax
call fcn.10065250
push 0x100116a0
push 0x100a560c
call fcn.10064600
call fcn.10064de0
call fcn.10064d80
call esi
push eax
call fcn.10065250
push 0x100119b0
push 0x100a5608
call fcn.10064a90
call fcn.10064de0
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
push 4
push eax
mov dword [0x100a5608], eax
call edi
test eax, eax
jne 0x10011cc1
call fcn.10064d80
call esi
push eax
call fcn.10065250
push 0x100119b0
push 0x100a5608
call fcn.10064600
call fcn.10064de0
call fcn.10064d80
call esi
push eax
call fcn.10065250
push 0x100119e0
push 0x100a5604
call fcn.10064a90
call fcn.10064de0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 4
push eax
mov dword [0x100a5604], eax
call edi
test eax, eax
jne 0x10011d16
call fcn.10064d80
call esi
push eax
call fcn.10065250
push 0x100119e0
push 0x100a5604
call fcn.10064600
call fcn.10064de0
pop edi
pop esi
pop ecx
ret
Function at 0x10013ed0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082318
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x100a2078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [ebp - 4], 0
push 2
mov dword [ebp - 0x150], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10013ff1
sub esp, 0x18
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
cmp byte [ebp - 0x12c], 0
jne 0x10013f54
xor eax, eax
jmp 0x10013f69
lea eax, [ebp - 0x12c]
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10013f60
sub eax, esi
push eax
lea eax, [ebp - 0x12c]
mov ecx, edx
push eax
call fcn.10002710
lea ecx, [ebp - 0x28]
call fcn.10013cf0
mov esi, dword [ebp - 0x14]
lea ecx, [ebp + 8]
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x28]
add esp, 0x18
cmp dword [ebp + 0x1c], 0x10
cmovae ecx, dword [ebp + 8]
cmp esi, 0x10
cmovae eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10013fc0
test dl, dl
je 0x10013fbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10013fc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10013fa0
xor eax, eax
jmp 0x10013fc5
sbb eax, eax
or eax, 1
test eax, eax
je 0x1001402d
cmp esi, 0x10
jb 0x10013fdb
lea eax, [esi + 1]
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.100025f0
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10013f31
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x1001400f
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.100025f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066135
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x148]
cmp eax, 0x10
jb 0x10013ffa
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.100025f0
jmp 0x10013ffa