joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10c42fc0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50]
test esi, esi
push edi
mov dword [esp + 0x10], 0
je 0x10c43101
mov edi, dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [esi]
cmp eax, 0x4074
je 0x10c43006
cmp eax, 0x40a7
je 0x10c43006
mov eax, dword [esi + 0x18]
push eax
call edi
push eax
call fcn.10c3ce00
mov esi, eax
add esp, 4
test esi, esi
jne 0x10c42fe1
test esi, esi
je 0x10c43101
cmp dword [esi], 0x4074
jne 0x10c43021
push esi
call fcn.10c43110
add esp, 4
mov esi, eax
test esi, esi
je 0x10c43101
cmp dword [esi], 0x40a7
jne 0x10c43101
mov ecx, dword [esi + 0x18]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x130b
push ecx
call ebp
mov edx, dword [esi + 0x18]
push 0
push 0
push 0x1304
push edx
mov ebx, eax
call ebp
mov edi, eax
cmp edi, 1
mov dword [esp + 0x54], edi
jle 0x10c43101
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x10c4307a
dec ebx
jmp 0x10c4307b
inc ebx
test ebx, ebx
jge 0x10c43082
lea ebx, [edi - 1]
cmp ebx, edi
jl 0x10c43088
xor ebx, ebx
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x600
mov ecx, dword [esi + 0x18]
push eax
push ebx
push 0x1305
push ecx
call ebp
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x10c430be
mov eax, dword [esp + 0x48]
test eax, eax
je 0x10c430d3
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x54]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jg 0x10c430f4
mov edi, ecx
jmp 0x10c4306a
mov edx, dword [esi + 0x18]
push ebx
push esi
push edx
call fcn.10c3ce50
add esp, 4
push eax
call sym.PBVM90.dll_FN_TabSetCurSel
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret
Function at 0x10c43e30
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push 0
push esi
push 0
push edi
call fcn.10c089e0
mov ebx, dword [esp + 0x28]
mov eax, dword [esi]
mov dword [esi + 8], ebx
add esp, 0x10
mov cx, word [eax + 8]
mov word [eax + 0xa], cx
mov edx, dword [esi]
mov word [edx + 8], 4
mov ax, word [esi + 0xc]
push eax
push edi
mov word [esi + 0x16], 0
call sym.PBVM90.dll_FN_ToolBarSizeFloat
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [edi + 0x10]
xor ecx, ecx
mov cx, word [esi + 0xc]
push ebx
or ecx, 0x6a0000
push ecx
push 0x111
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
test byte [edi + 0x24], 2
je 0x10c43ebb
mov eax, dword [edi + 0x10]
push 0x1f3
push 0
push 0
push eax
call fcn.10c402a0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x10c4f410
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov eax, dword [ebx + 0x1bc]
push edi
test eax, eax
je 0x10c4f426
mov esi, dword [eax]
jmp 0x10c4f428
xor esi, esi
mov ebp, dword [eax + 0xc]
mov edi, dword [sym.imp.MSVCRT.dll_putc]
inc ebp
push esi
mov dword [eax + 0xc], ebp
mov ebp, dword [esp + 0x1c]
push ebp
call edi
mov eax, dword [esp + 0x24]
add esp, 8
push esi
push eax
call edi
mov ecx, dword [ebx + 0x1bc]
mov ebx, dword [sym.imp.MSVCRT.dll_fwrite]
mov edi, 1
add esp, 8
cmp dword [ecx + 8], edi
je 0x10c4f46f
push esi
push edi
lea edx, [esp + 0x28]
push 8
push edx
call ebx
add esp, 0x10
cmp ebp, 7
je 0x10c4f4dd
cmp ebp, 8
je 0x10c4f4dd
cmp ebp, 9
jne 0x10c4f4a0
cmp dword [esp + 0x1c], edi
jne 0x10c4f529
mov eax, dword [esp + 0x28]
or ecx, 0xffffffff
mov ebp, dword [eax]
xor eax, eax
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ecx
jmp 0x10c4f50c
mov ebp, dword [ebp*4 + 0x10e06458]
test ebp, ebp
jbe 0x10c4f529
mov edi, dword [esp + 0x28]
mov eax, dword [edi]
add edi, 4
push esi
push 1
lea ecx, [esp + 0x30]
push 4
push ecx
mov dword [esp + 0x38], eax
call ebx
add esp, 0x10
dec ebp
jne 0x10c4f4af
mov eax, dword [esi + 0xc]
not al
movsx eax, al
and eax, 0x20
shr eax, 5
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x28]
or ecx, 0xffffffff
add eax, 4
push esi
push 1
push 4
mov ebp, dword [eax]
mov edx, dword [eax - 4]
mov edi, ebp
xor eax, eax
mov dword [esp + 0x34], edx
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x34]
dec ecx
push eax
mov dword [esp + 0x24], ecx
call ebx
add esp, 0x10
push esi
push 1
lea ecx, [esp + 0x1c]
push 4
push ecx
call ebx
mov edx, dword [esp + 0x24]
add esp, 0x10
push esi
push edx
push 1
push ebp
call ebx
add esp, 0x10
mov eax, dword [esi + 0xc]
pop edi
not al
movsx eax, al
and eax, 0x20
pop esi
pop ebp
pop ebx
shr eax, 5
ret
Function at 0x10c612d0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call sym.PBVM90.dll_ob_enter_critical_section
push esi
call sym.PBVM90.dll_ob_leave_critical_section
push esi
call sym.PBVM90.dll_ob_enter_critical_section
cmp dword [esi + 0x1f0], 0xffffffff
jne 0x10c6132b
lea eax, [esp + 0xc]
push eax
push 0
push esi
push 0x10c61190
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [esp + 0x24]
add esp, 0x18
mov dword [esi + 0x1f0], ecx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
xor edi, edi
call sym.PBVM90.dll_ob_leave_critical_section
mov eax, edi
pop edi
pop esi
ret 4
push esi
mov edi, 0x80004005
call sym.PBVM90.dll_ob_leave_critical_section
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x10c69b00
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
cmp word [ebp + 4], 1
jne 0x10c69b1b
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x18], ecx
jmp 0x10c69b22
mov edx, dword [ebp + 8]
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
xor ebx, ebx
test eax, eax
jbe 0x10c69b67
push ebx
push ebp
push edi
call sym.PBVM90.dll_ot_array_index
mov esi, eax
push esi
push edi
call sym.PBVM90.dll_ot_type_loc
cmp eax, 1
jne 0x10c69b4d
push esi
push edi
call sym.PBVM90.dll_ot_free_out_node
mov ax, word [esi + 4]
mov cx, word [esi + 6]
push eax
push ecx
push esi
push edi
call sym.PBVM90.dll_ot_init_data_node
mov eax, dword [esp + 0x18]
inc ebx
cmp ebx, eax
jb 0x10c69b30
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10c69b79
push ebp
push edi
call fcn.10c9ee70
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10c75730
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x10c7574b
call sym.PBVM90.dll_PBDevDbgTraceActive
test eax, eax
je 0x10c7575b
mov ecx, dword [ebp + 0xc]
push 0x10e0abb4
push 0x14
push ecx
call sym.PBVM90.dll_sh_dbg_enter
mov edi, dword [ebp + 0xca]
test edi, edi
je 0x10c758b1
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x23c]
test eax, eax
mov dword [esp + 0x18], eax
jne 0x10c757ab
lea edx, [esp + 0x14]
push edx
call fcn.10c9c780
add esp, 4
test eax, eax
jl 0x10c757ab
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push esi
call fcn.10c9c7f0
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x23c], ecx
mov bx, word [edi + 0x10]
mov edx, dword [ebp + 0x9a]
mov eax, ebx
push 0xffff
and eax, 0xffff
push 0
lea eax, [eax + eax*4]
shl eax, 4
add eax, edx
mov edx, dword [eax + 4]
mov eax, dword [eax + 0x14]
mov ecx, dword [edx + 0x12]
push ecx
mov ecx, dword [edx + 6]
mov edx, dword [edx + 0x1a]
push eax
push ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [edx]
push eax
push edi
push esi
call fcn.10c9b690
push edi
push esi
call fcn.10cb59d0
add esp, 8
mov dword [esi + 0xca], edi
mov cx, word [edi + 0x10]
mov dword [esi + 0x180], ebp
push ebx
push ebp
push esi
mov word [esi + 0x13a], cx
call fcn.10c758e0
mov eax, dword [ebp + 0x5e]
add esp, 0xc
test eax, eax
jne 0x10c758aa
mov edi, dword [ebp + 0xae]
mov eax, dword [esi + 0xae]
cmp eax, edi
mov dword [esp + 0x14], edi
jae 0x10c75849
push esi
call fcn.10c714a0
mov eax, dword [esi + 0xae]
add esp, 4
cmp eax, edi
jb 0x10c75836
mov eax, dword [ebp + 0x9a]
mov ecx, dword [esi + 0x9a]
xor ebx, ebx
test edi, edi
jbe 0x10c758aa
add eax, 4
lea edi, [ecx + 0x30]
mov dword [esp + 0x18], eax
mov eax, dword [eax]
test eax, eax
je 0x10c75882
mov eax, dword [eax + 6]
test eax, eax
je 0x10c75882
cmp byte [eax], 0x5f
je 0x10c75893
push ebx
push ebp
push esi
call fcn.10c758e0
add esp, 0xc
push 4
push 0x14
push edi
mov dword [edi - 0x1c], 2
call sym.PBVM90.dll_sh_grwblk_init
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
inc ebx
add edi, 0x50
add eax, 0x50
cmp ebx, ecx
mov dword [esp + 0x18], eax
jb 0x10c75865
mov esi, 1
jmp 0x10c758b3
xor esi, esi
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
test eax, eax
jne 0x10c758c6
call sym.PBVM90.dll_PBDevDbgTraceActive
test eax, eax
je 0x10c758d6
mov eax, dword [ebp + 0xc]
push str.ob_share_typedef_group
push 0x14
push eax
call sym.PBVM90.dll_sh_dbg_leave
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x10c99b00
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x10c99b5e
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 8]
push eax
push ecx
push esi
push edx
call fcn.10c66200
mov ecx, eax
add esp, 0x10
test ecx, ecx
je 0x10c99b45
mov edx, dword [esp + 0x18]
mov ax, word [ecx + 6]
mov word [edx], ax
mov edx, dword [esp + 0x14]
xor eax, eax
mov ax, word [ecx + 8]
mov cx, word [esi + 0x10]
mov word [edx], cx
pop esi
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov word [eax], 0xc000
mov word [ecx], 0xffff
mov eax, 0xffff
pop esi
ret
mov eax, dword [esp + 0x18]
pop esi
ret
Function at 0x10c9e910
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov eax, dword [eax + 8]
test eax, eax
je 0x10c9e9ce
mov ecx, dword [eax + 0x12]
xor ebx, ebx
test ecx, ecx
jbe 0x10c9e9ce
push edi
push esi
push ebp
mov ebp, dword [esp + 0x14]
xor edi, edi
mov ecx, dword [eax + 2]
lea esi, [ecx + edi + 0xc]
mov cx, word [ecx + edi + 0x10]
mov eax, ecx
and eax, 0xc0
cmp ax, 0x80
je 0x10c9e9b7
cmp ax, 0x40
je 0x10c9e9b7
cmp ax, 0xc0
jne 0x10c9e9a4
mov ax, word [esi + 6]
test ah, 0xc0
je 0x10c9e984
mov edx, ecx
and edx, 0x1c00
cmp edx, 0xc00
jne 0x10c9e984
mov edx, ecx
and edx, 0x2000
cmp edx, 0x2000
jne 0x10c9e9a4
cmp ax, 4
je 0x10c9e996
cmp ax, 5
je 0x10c9e996
cmp ax, 0x14
jne 0x10c9e9b7
and ecx, 0x2000
cmp ecx, 0x2000
je 0x10c9e9b7
push esi
push ebp
call sym.PBVM90.dll_ot_type_loc
cmp eax, 1
jne 0x10c9e9b7
push esi
push ebp
call sym.PBVM90.dll_ot_free_out_node
mov eax, dword [esp + 0x18]
inc ebx
add edi, 0x14
mov eax, dword [eax + 8]
cmp ebx, dword [eax + 0x12]
jb 0x10c9e936
pop ebp
pop esi
pop edi
pop ebx
ret
Function at 0x10c9ecc0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x10c9ecdb
call sym.PBVM90.dll_PBDevDbgTraceActive
test eax, eax
je 0x10c9eceb
mov ecx, dword [esi + 0xc]
push 0x10e0eb80
push 0x14
push ecx
call sym.PBVM90.dll_sh_dbg_enter
mov ebx, dword [esp + 0x1c]
xor eax, eax
mov ax, word [ebx + 4]
sub eax, 0
je 0x10c9ed63
dec eax
jne 0x10c9ee0c
movsx eax, word [ebx + 0x1c]
mov edx, dword [ebx + 0x10]
xor ecx, ecx
push edx
mov dx, word [ebx + 6]
push eax
mov eax, dword [ebx + 0x18]
test eax, eax
mov ax, word [ebx + 0xc]
setne cl
push ecx
mov ecx, dword [ebx]
push edx
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
push esi
call sym.PBVM90.dll_ob_narray_create_dynamic
mov ebp, eax
mov eax, dword [ebx + 0x14]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push esi
call fcn.10c91720
mov ebx, dword [ebx + 0x18]
add esp, 0xc
test ebx, ebx
je 0x10c9ed5a
mov edx, dword [ebp + 0x18]
push ebx
push edx
push esi
call fcn.10c91720
add esp, 0xc
jmp 0x10c9ede2
mov dword [ebp + 0x18], 0
jmp 0x10c9ede2
movsx eax, word [ebx + 0x1c]
mov dx, word [ebx + 6]
push 0
push eax
mov eax, dword [ebx + 0x18]
xor ecx, ecx
test eax, eax
setne cl
push ecx
mov cx, word [ebx + 0xe]
lea eax, [ebx + 0x20]
push edx
mov dx, word [ebx + 0xc]
push eax
mov eax, dword [ebx]
push ecx
mov ecx, dword [ebx + 8]
push edx
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
push esi
call sym.PBVM90.dll_ob_narray_create_static
mov ebp, eax
mov eax, dword [ebx + 0x10]
xor ecx, ecx
mov dword [ebp + 0x10], eax
mov cx, word [ebx + 0xc]
imul ecx, dword [ebx + 8]
mov esi, dword [ebx + 0x14]
mov edi, dword [ebp + 0x14]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x10c9edde
mov ecx, dword [ebx + 8]
mov edi, dword [ebp + 0x18]
shl ecx, 2
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x10c9edf5
call sym.PBVM90.dll_PBDevDbgTraceActive
test eax, eax
je 0x10c9ee05
mov edx, dword [esi + 0xc]
push str.ob_narray_duplicate
push 0x14
push edx
call sym.PBVM90.dll_sh_dbg_leave
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
mov ebp, dword [esp + 0x14]
jmp 0x10c9ede2
Function at 0x10cbbb50
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov eax, dword [ecx]
push edi
call dword [eax + 0x34]
mov ecx, dword [esp + 0x14]
mov edi, eax
mov edx, dword [ecx]
call dword [edx + 0x34]
mov ebp, dword [esp + 0x20]
mov ebx, eax
push ebp
push edi
call sym.PBVM90.dll_ot_free_val_ptr
mov esi, dword [esp + 0x18]
mov eax, dword [esi]
mov dword [ebp], eax
mov ecx, dword [esi + 4]
mov dword [ebp + 4], ecx
mov al, byte [esi + 4]
test al, 1
jne case.0x10cbbba9.10
xor eax, eax
mov ax, word [esi + 6]
add eax, 0xfffffffc
cmp eax, 0x10
ja case.0x10cbbba9.10
xor edx, edx
mov dl, byte [eax + 0x10cbbd18]
jmp dword [edx*4 + 0x10cbbcfc]
push 0
push esi
push ebx
call sym.PBVM90.dll_ot_get_valptr
push eax
push edi
call fcn.10c511d0
add esp, 0xc
mov dword [ebp], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov eax, dword [edi + 0x10]
push 0
push 8
push eax
call sym.PBVM90.dll_pbstg_alc
mov edi, eax
mov al, byte [esi + 4]
test al, 1
je 0x10cbbbf9
fld qword [0x10dc1bb0]
xor eax, eax
fstp qword [edi]
mov dword [ebp], edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
push esi
push ebx
call sym.PBVM90.dll_ot_get_valptr
fld qword [eax]
fstp qword [edi]
mov dword [ebp], edi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov ecx, dword [edi + 0x10]
push 0
push 8
push ecx
call sym.PBVM90.dll_pbstg_alc
mov edi, eax
mov al, byte [esi + 4]
test al, 1
je 0x10cbbc39
xor eax, eax
xor ecx, ecx
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [ebp], edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
push esi
push ebx
call sym.PBVM90.dll_ot_get_valptr
mov edx, eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [ebp], edi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov eax, dword [edi + 0x10]
push 0
push 0x10
push eax
call sym.PBVM90.dll_pbstg_alc
push esi
push ebx
mov edi, eax
call sym.PBVM90.dll_ot_get_valptr
mov edx, dword [eax]
mov ecx, edi
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov dword [ebp], edi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov esi, dword [esi]
mov edx, dword [edi + 0x10]
push 0
mov ecx, dword [esi]
add ecx, 5
push ecx
push edx
call sym.PBVM90.dll_pbstg_alc
mov edi, eax
mov eax, dword [esi]
add esi, 4
mov dword [edi], eax
mov ecx, dword [esi - 4]
push ecx
lea edx, [edi + 4]
push esi
push edx
call sym.PBVM90.dll_pbstg_huge_memcpy
mov dword [ebp], edi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
push esi
push ebx
call sym.PBVM90.dll_ot_get_valptr
mov esi, eax
mov eax, dword [edi + 0x10]
push 0
push 0xc
push eax
call sym.PBVM90.dll_pbstg_alc
mov edx, dword [esi]
mov ecx, eax
mov dword [ecx], edx
mov edx, dword [esi + 4]
mov dword [ecx + 4], edx
mov edx, dword [esi + 8]
mov dword [ecx + 8], edx
mov dword [ebp], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0x10cbc4a0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x34]
mov ecx, dword [esp + 0x10]
mov ax, word [ecx + 4]
mov dl, al
and dl, 0xc0
cmp dl, 0x80
jne 0x10cbc4da
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push edx
push ecx
push eax
mov ecx, esi
call fcn.10cbb360
pop edi
pop esi
ret 0x10
mov edx, eax
and edx, 0x2000
cmp edx, 0x2000
jne 0x10cbc506
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push edx
push ecx
push eax
mov ecx, esi
call fcn.10cbb530
pop edi
pop esi
ret 0x10
mov dx, word [ecx + 6]
and dx, 0xc000
je 0x10cbc53d
mov edi, eax
and edi, 0x1c00
cmp edi, 0xc00
je 0x10cbc53d
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.10cbb9c0
pop edi
pop esi
ret 0x10
test dx, dx
jne 0x10cbc55e
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.10cbbb50
pop edi
pop esi
ret 0x10
and eax, 0x1c00
cmp eax, 0xc00
jne 0x10cbc586
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, esi
call fcn.10cbc320
pop edi
pop esi
ret 0x10
pop edi
mov eax, 0x80004005
pop esi
ret 0x10
Function at 0x10cc8a80
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov cx, word [eax + 6]
mov eax, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x18]
test eax, eax
mov ebp, 1
mov dword [esp + 0x10], ecx
jne 0x10cc8ac0
test ebx, ebx
je 0x10cc8ac0
push ecx
push esi
push ebx
push edi
call fcn.10cc8c50
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov ebp, eax
xor edx, edx
cmp si, 0xffff
mov dword [edi + 0x132], edx
je 0x10cc8b0c
mov edx, dword [edi + 0xae]
mov eax, esi
and eax, 0xffff
cmp edx, eax
jbe 0x10cc8aff
lea edx, [eax + eax*4]
mov eax, dword [edi + 0x9a]
shl edx, 4
mov eax, dword [eax + edx + 4]
test eax, eax
je 0x10cc8aff
cmp dword [eax + 0x12], 1
je 0x10cc8aff
mov eax, dword [eax + 0xe]
jmp 0x10cc8b0a
push esi
push edi
call sym.PBVM90.dll_ob_group_data_srch
mov ecx, dword [esp + 0x10]
mov edx, eax
test ebx, ebx
mov dword [esp + 0x20], edx
je 0x10cc8c24
mov eax, ecx
and eax, 0xc000
cmp ax, 0x8000
je 0x10cc8b2f
cmp ax, 0x4000
jne 0x10cc8c24
push ecx
push edx
push edi
call sym.PBVM90.dll_ob_is_type_enum
test eax, eax
jne 0x10cc8c24
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push edx
push edi
call sym.PBVM90.dll_ob_class_indirect
mov eax, dword [esp + 0x10]
mov esi, 0x100
cmp ax, 0xc000
je 0x10cc8b9b
mov ecx, dword [esp + 0x20]
and eax, 0x3fff
mov edx, dword [ecx + 0x2a]
mov ecx, dword [edx + 8]
cmp eax, dword [ecx + 0x12]
jae 0x10cc8b9b
mov ecx, dword [ecx + 2]
lea eax, [eax + eax*4]
test word [ecx + eax*4 + 0x10], si
lea ecx, [ecx + eax*4]
je 0x10cc8b9b
mov edx, dword [edx + 0x2c]
xor eax, eax
mov ax, word [ecx + 0xc]
mov edx, dword [edx + 8]
lea ecx, [eax + eax*4]
shl ecx, 4
sub ecx, eax
lea eax, [edx + ecx*2]
jmp 0x10cc8b9d
xor eax, eax
test eax, eax
je 0x10cc8c15
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push ecx
push edi
call sym.PBVM90.dll_ob_class_indirect
mov eax, dword [esp + 0x10]
cmp ax, 0xc000
je 0x10cc8c05
mov edx, dword [esp + 0x20]
and eax, 0x3fff
mov edx, dword [edx + 0x2a]
mov ecx, dword [edx + 8]
cmp eax, dword [ecx + 0x12]
jae 0x10cc8c05
mov ecx, dword [ecx + 2]
lea eax, [eax + eax*4]
test word [ecx + eax*4 + 0x10], si
lea ecx, [ecx + eax*4]
je 0x10cc8c05
mov edx, dword [edx + 0x2c]
xor eax, eax
mov ax, word [ecx + 0xc]
mov edx, dword [edx + 8]
lea ecx, [eax + eax*4]
shl ecx, 4
sub ecx, eax
lea eax, [edx + ecx*2]
mov eax, dword [edx + ecx*2 + 8]
mov ax, word [eax]
shr eax, 8
and eax, 1
jmp 0x10cc8c17
xor eax, eax
mov eax, dword [eax + 8]
mov ax, word [eax]
shr eax, 8
and eax, 1
jmp 0x10cc8c17
xor eax, eax
test eax, eax
je 0x10cc8c24
push ebx
push edi
call sym.PBVM90.dll_ob_copy_rtinst
mov ebx, eax
cmp ebp, 1
jne 0x10cc8c3a
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
push ecx
push ebx
push edx
push edi
call sym.PBVM90.dll_ot_assign_lvalue_obinst
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10ce5d60
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
mov esi, ecx
push 0
push 0
push 0
mov dword [esi + 0xaa], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xb2], eax
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x10ce5db0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xae], eax
pop esi
pop ecx
ret

Function at 0x10ce7f91
Capabilities:
Clear file content

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
test dword [esi + 0xc], 0x10000
je 0x10ce7fa3
call fcn.10ba28a0
mov eax, dword [esi + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
je 0x10ce7fd6
push 0
push 0x80000080
push 2
push 0
push 0
push 0x40000000
push eax
call edi
cmp eax, 0xffffffff
mov dword [esi + 0x1c], eax
je 0x10ce7fd6
push eax
call ebx
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10ce7ffd
push 0
push 0x80000080
push 2
push 0
push 0
push 0x40000000
push eax
call edi
cmp eax, 0xffffffff
mov dword [esi + 0x20], eax
je 0x10ce7ffd
push eax
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x10ce8050
Capabilities:
Write file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, ecx
push ebp
call fcn.10ce80c0
mov eax, dword [ebx + 0xc]
add esp, 4
test eax, 0x10000
je 0x10ce8073
push ebp
call fcn.10ba2940
mov eax, dword [ebx + 0x1c]
or ecx, 0xffffffff
cmp eax, ecx
je 0x10ce80b4
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebx + 0x28]
dec ecx
push esi
mov dword [esp + 0x18], 0
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebx + 0x1c]
lea eax, [esp + 0x14]
push 0
push eax
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
ret 4