joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59fec0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.005d6920
mov eax, dword [0x6a8c7c]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0xa0]
mov dword [esp + 4], edx
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xa8]
mov eax, dword [esi]
test ebx, ebx
je 0x59ff28
cmp ebx, eax
je 0x59ff1f
test ebp, ebp
je 0x5a00a9
test edi, edi
js 0x5a00a9
mov ecx, 1
mov dword [esi], ebx
jmp 0x59ff32
test eax, eax
je 0x5a00a9
mov ebx, eax
test ebp, ebp
je 0x5a00a0
push ebx
call fcn.0054aa30
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x59ff66
push 0x28
push str.cryptohmachmac.c
push str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.0054bcb0
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, edi
jge 0x59ffb7
push dword [esp + 0x10]
push ebx
push dword [esi + 4]
call fcn.0056b6b0
add esp, 0xc
test eax, eax
je 0x5a00a9
push edi
push ebp
push dword [esi + 4]
call fcn.0056b850
add esp, 0xc
test eax, eax
je 0x5a00a9
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.0056b630
add esp, 0xc
test eax, eax
je 0x5a00a9
mov edi, dword [esi + 0x10]
jmp 0x59ffd4
cmp edi, 0x80
ja 0x5a00a9
push edi
lea eax, [esi + 0x14]
push ebp
push eax
call fcn.005ed5a0
add esp, 0xc
mov dword [esi + 0x10], edi
cmp edi, 0x80
je 0x59fff4
mov eax, 0x80
sub eax, edi
push eax
lea eax, [esi + 0x14]
add eax, edi
push 0
push eax
call fcn.005ed310
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
nop word [eax + eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x5a0000
push edx
push ebx
push dword [esi + 8]
call fcn.0056b6b0
add esp, 0xc
test eax, eax
je 0x5a00a9
push ebx
call fcn.0054aa30
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.0056b850
add esp, 0x10
test eax, eax
je 0x5a00a9
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x5a0045
push dword [esp + 0x10]
push ebx
push dword [esi + 0xc]
call fcn.0056b6b0
add esp, 0xc
test eax, eax
je 0x5a00a9
push ebx
call fcn.0054aa30
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.0056b850
add esp, 0x10
test eax, eax
je 0x5a00a9
push dword [esi + 8]
push dword [esi + 4]
call fcn.0056b860
add esp, 8
test eax, eax
je 0x5a00a9
mov eax, 1
jmp 0x5a00ab
test ecx, ecx
je 0x5a0087
jmp 0x59fff8
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005d584c
add esp, 0x8c
ret
Function at 0x5a54f0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
cmp ebx, 2
je 0x5a554c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x5a553d
push eax
push 0
lea eax, [esp + 0x24]
push eax
push 0
call fcn.00594ce0
add esp, 0x10
cmp dword [esp + 0x1c], 0xffffffff
je 0x5a553d
push 0x2f
push str.cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.005474b0
add esp, 0x14
xor eax, eax
pop edi
pop ebx
ret
test edi, edi
je 0x5a5548
cmp dword [esp + 0x18], 0x20
je 0x5a554c
push 0x35
jmp 0x5a5522
push esi
push 0x3a
push str.cryptoececx_meth.c
push 0x24
call fcn.00548ac0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x5a5582
push 0x3c
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.005474b0
add esp, 0x14
xor eax, eax
pop esi
pop edi
pop ebx
ret
test ebx, ebx
jne 0x5a5599
push dword [esp + 0x1c]
push edi
push esi
call fcn.005ed5a0
add esp, 0xc
jmp 0x5a5643
push 0x43
push str.cryptoececx_meth.c
push 0x20
call fcn.00591710
add esp, 0xc
mov dword [esi + 0x20], eax
test eax, eax
jne 0x5a55dc
push 0x45
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.005474b0
push 0x46
push str.cryptoececx_meth.c
push esi
call fcn.00548860
add esp, 0x20
xor eax, eax
pop esi
pop edi
pop ebx
ret
cmp ebx, 2
jne 0x5a5629
push 0x20
push eax
call fcn.0054c9b0
mov ecx, dword [esi + 0x20]
add esp, 8
test eax, eax
jg 0x5a5616
push 0x4b
push str.cryptoececx_meth.c
push ecx
call fcn.00591700
push 0x4c
push str.cryptoececx_meth.c
push esi
call fcn.00548860
add esp, 0x18
xor eax, eax
pop esi
pop edi
pop ebx
ret
and byte [ecx], 0xf8
mov eax, dword [esi + 0x20]
and byte [eax + 0x1f], 0x7f
mov eax, dword [esi + 0x20]
or byte [eax + 0x1f], 0x40
jmp 0x5a5637
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
push dword [esi + 0x20]
push esi
call fcn.005b8cf0
add esp, 8
push esi
push 0x40a
push dword [esp + 0x18]
call fcn.00565fd0
add esp, 0xc
mov eax, 1
pop esi
pop edi
pop ebx
ret
Function at 0x5a7350
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.005d6920
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
call fcn.004ee550
add esp, 4
cmp eax, 0x72
jne 0x5a74e4
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebx, eax
push esi
push ebp
push dword [esp + 0x30]
and eax, 1
shr ebx, 1
push dword [esp + 0x30]
add eax, ebx
push eax
push dword [esp + 0x30]
mov dword [esp + 0x28], eax
call fcn.0055f400
push eax
call fcn.005a70e0
add esp, 0x1c
test eax, eax
je 0x5a7402
push 0xf8
push str.cryptokdf_tls1_prf.c
push esi
call fcn.00548830
mov edi, eax
add esp, 0xc
test edi, edi
je 0x5a7402
mov ecx, dword [esp + 0x1c]
push esi
push edi
push dword [esp + 0x30]
add ecx, ebx
push dword [esp + 0x30]
push dword [esp + 0x20]
push ecx
call fcn.0055fa50
push eax
call fcn.005a70e0
add esp, 0x1c
test eax, eax
jne 0x5a740a
push 0xfd
push str.cryptokdf_tls1_prf.c
push esi
push edi
call fcn.00548920
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
xor ebx, ebx
test esi, esi
je 0x5a74c5
cmp esi, 0x40
jb 0x5a74aa
lea eax, [esi - 1]
lea ecx, [ebp - 1]
add eax, edi
add ecx, esi
cmp ebp, eax
ja 0x5a742f
cmp ecx, edi
jae 0x5a74aa
mov edx, esi
lea eax, [ebp + 0x10]
mov esi, edi
lea ecx, [edi + 0x30]
and edx, 0xffffffc0
sub esi, ebp
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x30]
mov ebp, dword [esp + 0x10]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
add ebx, 0x40
lea ecx, [ecx + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx - 0x70]
pxor xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [eax + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebx, edx
jb 0x5a7450
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x10], ebx
cmp ebx, esi
jae 0x5a74c5
lea ecx, [ebx + ebp]
mov edx, esi
mov ebp, edi
sub ebp, dword [esp + 0x2c]
sub edx, ebx
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x5a74b7
push 0x102
push str.cryptokdf_tls1_prf.c
push esi
push edi
call fcn.00548920
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push esi
call fcn.005a70e0
add esp, 0x1c
test eax, eax
je 0x5a7402
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x5b0bc0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 4
call fcn.005d6920
push esi
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 4], ecx
test esi, esi
jle 0x5b0cc3
mov edx, dword [esp + 0xc]
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
inc edi
nop dword [eax]
movzx eax, byte [edi - 1]
cmp esi, 3
jb 0x5b0c48
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + 0x662d68]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x662d68]
mov byte [edx + 1], cl
mov ecx, eax
and ecx, 0x3f
shr eax, 6
add edx, 2
and eax, 0x3f
mov bl, byte [ecx + 0x662d68]
mov ecx, edx
mov al, byte [eax + 0x662d68]
jmp 0x5b0c94
shl eax, 0x10
cmp esi, 2
jne 0x5b0c58
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + 0x662d68]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x662d68]
mov byte [edx + 1], cl
add edx, 2
mov ecx, edx
cmp esi, 1
jne 0x5b0c86
mov al, 0x3d
jmp 0x5b0c92
shr eax, 6
and eax, 0x3f
mov al, byte [eax + 0x662d68]
mov bl, 0x3d
lea ebp, [ecx + 2]
mov byte [edx], al
mov byte [ecx + 1], bl
sub esi, 3
mov ecx, dword [esp + 0x10]
add edi, 3
add ecx, 4
mov edx, ebp
mov dword [esp + 0x10], ecx
test esi, esi
jg 0x5b0bf0
pop edi
mov byte [ebp], 0
mov eax, ecx
pop ebp
pop ebx
pop esi
pop ecx
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax], cl
mov eax, ecx
pop ecx
ret
Function at 0x5d8dfe
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x60d88c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0060d70b

Function at 0x611ae4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006117a4
Function at 0x10003f10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push esi
push ebx
mov dword [ebp - 4], 0
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push esi
mov esi, dword [ebp + 8]
push esi
call edi
push dword [ebp + 0x10]
push ebx
push esi
call fcn.1004beb0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0x10]
push esi
call edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push ebx
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10004540
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
push 0x104
sete cl
mov dword [ebp - 0x23c], ecx
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.D2HackIt.dll_GetIniFileName
add esp, 0xc
test eax, eax
je 0x100045c5
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.10078e07
add esp, 8
test eax, eax
je 0x100045d7
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x208]
push str.Unable_to_find_ini_file:
push eax
call fcn.10002080
lea eax, [ebp - 0x208]
push eax
call sym.D2HackIt.dll_GamePrintError
add esp, 0x10
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret
push esi
test edi, edi
jne 0x100045f5
mov ebx, dword [ebp - 0x224]
push ebx
call fcn.10049c3b
mov edi, eax
add esp, 4
test edi, edi
je 0x1000469d
lea eax, [ebp - 0x108]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
cmp dword [ebp - 0x23c], 0
mov esi, eax
jne 0x1000467b
test esi, esi
je 0x1000465f
cmp byte [edi + esi - 1], 0
lea ecx, [edi + esi]
je 0x10004628
cmp esi, 1
jbe 0x10004634
cmp byte [ecx - 2], 0
jne 0x10004634
mov dword [ebp - 0x23c], 1
jmp 0x100045dc
cmp esi, ebx
jae 0x10004684
lea eax, [esi + 1]
mov byte [ecx], 0
cmp eax, ebx
jae 0x10004684
test esi, esi
mov byte [ecx + 1], 0
lea eax, [esi + 1]
cmove eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret
test esi, esi
mov byte [edi], 0
lea eax, [esi + 1]
cmove eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret
push edi
call fcn.10049c44
add esp, 4
test esi, esi
lea eax, [esi + 1]
cmove eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret
push 0x100b7570
call sym.D2HackIt.dll_GamePrintError
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
pop edi
pop ebx
call fcn.10049f5b
mov esp, ebp
pop ebp
ret
Function at 0x100046c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x18]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
mov dword [ebp - 0x114], ecx
mov ecx, dword [ebp + 0x10]
sete bl
mov dword [ebp - 0x110], ecx
lea ecx, [ebp - 0x108]
push 0x104
push ecx
push eax
mov dword [ebp - 0x10c], esi
call sym.D2HackIt.dll_GetIniFileName
add esp, 0xc
test eax, eax
je 0x100047f5
nop dword [eax + eax]
test edi, edi
jne 0x10004742
mov esi, 0x1000
push esi
mov dword [ebp - 0x10c], esi
call fcn.10049c3b
mov edi, eax
add esp, 4
test edi, edi
je 0x100047e8
lea eax, [ebp - 0x108]
push eax
push esi
push edi
push 0x100b6360
push dword [ebp - 0x110]
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test ebx, ebx
jne 0x100047c6
test esi, esi
je 0x100047aa
cmp byte [edi + esi - 1], bl
lea eax, [edi + esi]
je 0x1000477f
cmp esi, 1
jbe 0x10004786
cmp byte [eax - 2], bl
jne 0x10004786
mov ebx, 1
jmp 0x10004724
cmp esi, dword [ebp - 0x10c]
jae 0x100047cf
mov byte [eax], 0
test esi, esi
lea eax, [esi + 1]
pop edi
cmove eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret
test esi, esi
mov byte [edi], 0
lea eax, [esi + 1]
pop edi
cmove eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret
push edi
call fcn.10049c44
add esp, 4
test esi, esi
lea eax, [esi + 1]
pop edi
cmove eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret
push 0x100b7570
call sym.D2HackIt.dll_GamePrintError
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049f5b
mov esp, ebp
pop ebp
ret

Function at 0x10005fe0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x48]
test esi, esi
jne 0x10006013
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x10006027
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov ecx, eax
mov dword [ebp - 0x50], ecx
jne 0x1000605d
push 0x1f4
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x50]
test eax, eax
jne 0x1000606b
cmp dword [esi + 0xc], 0
jle 0x1000606b
mov eax, dword [esi + 4]
mov esi, dword [eax + 0xc]
jmp 0x1000606d
xor esi, esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10049f5b
mov esp, ebp
pop ebp
ret
Function at 0x100060a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x4c], 0
test edi, edi
jne 0x100060d8
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x100060ec
push edi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], eax
jne 0x1000611a
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x50]
mov esi, dword [ebx]
xor edx, edx
push eax
mov ecx, dword [esi + 0xc]
cmp ecx, dword [edi + 8]
cmove ecx, edx
mov dword [ebx], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 4

Function at 0x100064b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b110d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], 0
test ebx, ebx
jne 0x10006503
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x10006517
push ebx
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x54]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 4], 0
jne 0x10006553
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x58], ecx
test eax, eax
je 0x10006553
xor edi, edi
jmp 0x1000658a
xor edi, edi
cmp dword [ebp + 0xc], edi
jle 0x1000658a
nop word [eax + eax]
push esi
mov ecx, ebx
call fcn.10007270
mov ecx, dword [ebx + 8]
mov esi, eax
push ecx
push esi
push dword [ecx + 8]
mov ecx, ebx
call fcn.10007290
inc dword [ebx + 0xc]
test edi, edi
cmove edi, esi
sub dword [ebp + 0xc], 1
mov esi, dword [ebp - 0x60]
jne 0x10006560
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x5c]
mov dword [ebp - 0x58], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 8
Function at 0x10006c70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100d1580]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x48]
push edi
test esi, esi
jne 0x10006ca4
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push 0x41
push eax
call fcn.100793d1
add esp, 0xc
jmp 0x10006cb8
push esi
push str.3FBB26D9_D352_409A_9352_7BDD78A1EBA1
push str._s_08X
push eax
call fcn.10005620
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], eax
jne 0x10006ced
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x4c], ecx
test eax, eax
je 0x10006ced
xor edi, edi
jmp 0x10006d1a
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, dword [esi + 0xc]
cmovge ebx, dword [esi + 0xc]
xor edi, edi
test ebx, ebx
jle 0x10006d19
nop
mov eax, dword [esi + 4]
mov ecx, esi
push dword [eax + 0xc]
call fcn.100072b0
test eax, eax
je 0x10006d19
dec dword [esi + 0xc]
inc edi
cmp edi, ebx
jl 0x10006d00
pop ebx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10049f5b
mov esp, ebp
pop ebp
ret 4

Function at 0x10007a80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x10007ab1
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x10007ab1
push edi
push 0
push esi
call fcn.1004bae0
add esp, 0xc
push edi
push esi
call sym.D2HackIt.dll_FindMyD2WndHandle
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10007d70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001ad60
Function at 0x10019170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b23bd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x100d1580]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.10049bfd
mov edi, eax
add esp, 4
test edi, edi
je 0x1001920d
push 1
mov dword [ebp - 4], 0
call fcn.10026884
add esp, 4
mov dword [edi + 4], eax
jmp 0x1001920f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.1000e1f0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x1001926a
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x1001926a
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x10019286
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x100192a9
cmp byte [ebp + 0xc], 0
je 0x10019295
push esi
call fcn.10026dc0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x100192b5
mov esi, str.ios_base::badbit_set
jmp 0x100192c5
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10019310
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.1000ee30
push 0x100c9f98
lea eax, [ebp - 0x28]
push eax
call fcn.1004c4fb
int3