joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100157b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c119b
call fcn.1011c410
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jg 0x100157ea
jmp 0x100158cb
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x10015800
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jge 0x10015812
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [ebp - 0x14], eax
jmp 0x10015800
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011bf20
add esp, 4
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10015856
mov esi, esp
push 0
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.1011c3e0
jmp 0x100158cb
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], 0
jmp 0x10015886
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [eax]
jge 0x100158a7
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ecx + esi*4]
mov dword [eax + edx*4], ecx
jmp 0x1001587d
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
call fcn.1011bf40
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x100158f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c119b
call fcn.1011c410
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jg 0x1001592a
jmp 0x10015a0b
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x10015940
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jge 0x10015952
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [ebp - 0x14], eax
jmp 0x10015940
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011bf20
add esp, 4
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10015996
mov esi, esp
push 0
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.1011c3e0
jmp 0x10015a0b
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], 0
jmp 0x100159c6
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [eax]
jge 0x100159e7
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ecx + esi*4]
mov dword [eax + edx*4], ecx
jmp 0x100159bd
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
call fcn.1011bf40
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x10015a30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c119b
call fcn.1011c410
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jg 0x10015a6a
jmp 0x10015b4b
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x10015a80
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jge 0x10015a92
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [ebp - 0x14], eax
jmp 0x10015a80
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011bf20
add esp, 4
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10015ad6
mov esi, esp
push 0
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.1011c3e0
jmp 0x10015b4b
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], 0
jmp 0x10015b06
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [eax]
jge 0x10015b27
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ecx + esi*4]
mov dword [eax + edx*4], ecx
jmp 0x10015afd
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
call fcn.1011bf40
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x10015b70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c119b
call fcn.1011c410
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jg 0x10015baa
jmp 0x10015c8b
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x10015bc0
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jge 0x10015bd2
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [ebp - 0x14], eax
jmp 0x10015bc0
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011bf20
add esp, 4
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10015c16
mov esi, esp
push 0
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.1011c3e0
jmp 0x10015c8b
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], 0
jmp 0x10015c46
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [eax]
jge 0x10015c67
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ecx + esi*4]
mov dword [eax + edx*4], ecx
jmp 0x10015c3d
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
call fcn.1011bf40
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x10015cb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c119b
call fcn.1011c410
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jg 0x10015cea
jmp 0x10015dcb
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x10015d00
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jge 0x10015d12
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [ebp - 0x14], eax
jmp 0x10015d00
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011bf20
add esp, 4
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10015d56
mov esi, esp
push 0
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.1011c3e0
jmp 0x10015dcb
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], 0
jmp 0x10015d86
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [eax]
jge 0x10015da7
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ecx + esi*4]
mov dword [eax + edx*4], ecx
jmp 0x10015d7d
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
call fcn.1011bf40
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x10015df0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c119b
call fcn.1011c410
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jg 0x10015e2a
jmp 0x10015f0b
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x10015e40
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jge 0x10015e52
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [ebp - 0x14], eax
jmp 0x10015e40
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011bf20
add esp, 4
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10015e96
mov esi, esp
push 0
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.1011c3e0
jmp 0x10015f0b
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], 0
jmp 0x10015ec6
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [eax]
jge 0x10015ee7
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ecx + esi*4]
mov dword [eax + edx*4], ecx
jmp 0x10015ebd
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
call fcn.1011bf40
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x10015f30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c119b
call fcn.1011c410
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jg 0x10015f6a
jmp 0x1001604b
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x10015f80
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jge 0x10015f92
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [ebp - 0x14], eax
jmp 0x10015f80
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011bf20
add esp, 4
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10015fd6
mov esi, esp
push 0
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.1011c3e0
jmp 0x1001604b
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], 0
jmp 0x10016006
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [eax]
jge 0x10016027
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ecx + esi*4]
mov dword [eax + edx*4], ecx
jmp 0x10015ffd
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
call fcn.1011bf40
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x10016070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c119b
call fcn.1011c410
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jg 0x100160aa
jmp 0x1001618b
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x100160c0
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jge 0x100160d2
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [ebp - 0x14], eax
jmp 0x100160c0
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011bf20
add esp, 4
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10016116
mov esi, esp
push 0
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.1011c3e0
jmp 0x1001618b
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], 0
jmp 0x10016146
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [eax]
jge 0x10016167
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ecx + esi*4]
mov dword [eax + edx*4], ecx
jmp 0x1001613d
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
call fcn.1011bf40
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x100161b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c119b
call fcn.1011c410
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jg 0x100161ea
jmp 0x100162cb
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x10016200
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jge 0x10016212
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [ebp - 0x14], eax
jmp 0x10016200
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011bf20
add esp, 4
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10016256
mov esi, esp
push 0
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.1011c3e0
jmp 0x100162cb
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], 0
jmp 0x10016286
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [eax]
jge 0x100162a7
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ecx + esi*4]
mov dword [eax + edx*4], ecx
jmp 0x1001627d
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
call fcn.1011bf40
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x100162f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c119b
call fcn.1011c410
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jg 0x1001632a
jmp 0x1001640b
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x10016340
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jge 0x10016352
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [ebp - 0x14], eax
jmp 0x10016340
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011bf20
add esp, 4
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10016396
mov esi, esp
push 0
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.1011c3e0
jmp 0x1001640b
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], 0
jmp 0x100163c6
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [eax]
jge 0x100163e7
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ecx + esi*4]
mov dword [eax + edx*4], ecx
jmp 0x100163bd
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
call fcn.1011bf40
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x10016430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov ecx, 0x101c119b
call fcn.1011c410
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jg 0x1001646a
jmp 0x1001654b
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x10016480
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jge 0x10016492
mov eax, dword [ebp - 0x14]
shl eax, 1
mov dword [ebp - 0x14], eax
jmp 0x10016480
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1011bf20
add esp, 4
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100164d6
mov esi, esp
push 0
call dword [sym.imp.ucrtbased.dll_exit]
cmp esi, esp
call fcn.1011c3e0
jmp 0x1001654b
mov eax, dword [ebp - 0x14]
shl eax, 2
push eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov dword [ebp - 0x2c], 0
jmp 0x10016506
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [eax]
jge 0x10016527
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ecx + esi*4]
mov dword [eax + edx*4], ecx
jmp 0x100164fd
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x104]
push edx
call fcn.1011bf40
add esp, 4
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 8], ecx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 4
Function at 0x1002a560
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push ebx
push esi
push edi
lea edi, [ebp - 0x14]
mov ecx, 5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1014f440]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x101c18e7
call fcn.1011c410
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov esi, esp
lea eax, [ebp - 0x10]
push eax
push 0x1002a490
call dword [sym.imp.USER32.dll_EnumWindows]
cmp esi, esp
call fcn.1011c3e0
cmp dword [ebp - 0xc], 0
jne 0x1002a5d0
mov eax, dword [ebp + 8]
push eax
push str.FindWindowById
push str._s:_handle_window_by_process_id__lu_not_found._n
call fcn.100fa670
add esp, 0xc
mov eax, dword [ebp - 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x1002a604]
call fcn.1011c380
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011c450
add esp, 0xd4
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret

Function at 0x1002a620
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push ebx
push esi
push edi
lea edi, [ebp - 0x1c]
mov ecx, 7
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1014f440]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x101c18e7
call fcn.1011c410
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov esi, esp
push str.appdata
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.ucrtbased.dll__dupenv_s]
add esp, 0xc
cmp esi, esp
call fcn.1011c3e0
test eax, eax
jne 0x1002a6dc
cmp dword [ebp - 0xc], 0
je 0x1002a6dc
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x1015185c
call fcn.1002a3c0
push str.Hpp_Hack_Reload_
mov ecx, 0x1015185c
call fcn.10014780
mov esi, esp
push 0
mov ecx, 0x1015185c
call fcn.10014900
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, esp
call fcn.1011c3e0
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ucrtbased.dll_free]
add esp, 4
cmp esi, esp
call fcn.1011c3e0
mov eax, 1
jmp 0x1002a6f0
push str.GetSettingsPath
push str.___s:_failed_to_get_settings_path._n
call fcn.100fa670
add esp, 8
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x1002a720]
call fcn.1011c380
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011c450
add esp, 0xdc
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret