joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c8b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x71c6d4]
xor edx, edx
cmp eax, edx
jne 0x48c8d6
xor eax, eax
mov byte [eax + 0x71c5d4], al
inc eax
cmp eax, 0x100
jl 0x48c8be
mov dword [0x71c6d4], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x71c5d4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x48c967
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x48c93a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x48c908
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x48c970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x48c9c3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x48c9aa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x493340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c358e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00493c60
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x68b8bc
call fcn.004b4f5d
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4933d3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004b4f5d
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4933cc
push 0
mov ecx, eax
call fcn.0048a4e0
mov dword [esi + 0xc], eax
jmp 0x4933d5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4933d5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4a3d7f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4a3d9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004a2d7a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4a3dc2
test byte [esp + 8], 2
je 0x4a3dc2
call fcn.004a2ded
mov dword [eax], 0xd
call fcn.004a2df6
mov dword [eax], 5
jmp 0x4a3d9b
xor eax, eax
ret

Function at 0x4b75ea
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b7622
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b5677
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b564f
jmp 0x4b762e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b8cdc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b8d1e
call fcn.004be799
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b8d1e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b8d15
xor eax, eax
jmp 0x4b8d26
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b8d2c
pop edi
pop esi
pop ebx
ret 4

Function at 0x4becc9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4becf7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4bed15
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004bec2f
jmp 0x4bed15
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4bed15
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004bec2f
test edi, edi
mov eax, edi
jne 0x4becff
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x100089b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx + 0x1c]
test eax, eax
jne 0x100089ba
ret 8
mov ecx, dword [esp + 4]
push eax
mov eax, dword [esp + 0xc]
push eax
push 1
push ecx
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
ret 8

Function at 0x10008f40
Capabilities:
Delete file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x100850f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push esi
xor esi, esi
xor eax, eax
push edi
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], esi
mov word [esp + 0xc], ax
mov edi, dword [esp + 0x48]
mov eax, edi
mov dword [esp + 0x40], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], esi
lea edx, [eax + 2]
jmp 0x10008f90
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x10008f90
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x14]
call fcn.10002ec0
push 7
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 1
call fcn.10008e70
test al, al
jne 0x10008fff
mov dword [esp + 0x40], 2
cmp dword [esp + 0x28], esi
je 0x10008fd8
lea ecx, [esp + 0xc]
call fcn.10008a40
cmp dword [esp + 0x20], 8
jb 0x10008fec
mov ecx, dword [esp + 0xc]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
mov eax, dword [esp + 0x28]
push ebx
mov dword [esp + 0xc], 0xfeff
cmp eax, esi
jne 0x10009014
xor bl, bl
jmp 0x1000903f
push eax
push 2
lea edx, [esp + 0x14]
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, 2
sete bl
test bl, bl
je 0x1000903f
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.MSVCR100.dll_fflush]
add esp, 4
lea ecx, [esp + 0x10]
call fcn.10008a40
test bl, bl
jne 0x10009053
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x44], 3
cmp dword [esp + 0x2c], esi
je 0x1000906a
lea ecx, [esp + 0x10]
call fcn.10008a40
cmp dword [esp + 0x24], 8
jb 0x1000907e
mov ecx, dword [esp + 0x10]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x3c]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x1000a7c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov eax, ebx
push edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000a7d0
mov ebp, dword [esp + 0x14]
sub eax, edx
xor edx, edx
xor ecx, ecx
mov edi, eax
test ebp, ebp
je 0x1000a802
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
mov al, byte [edx + ebx]
xor byte [ecx + esi], al
lea eax, [edx + 1]
cdq
inc ecx
idiv edi
cmp ecx, ebp
jb 0x1000a7f0
pop esi
pop edi
pop ebp
pop ebx
ret

Function at 0x1000a960
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x100852eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x848
push ebx
lea ebx, [ecx + 4]
push ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
test ebx, ebx
je 0x1000a994
mov eax, dword [ebx]
mov edx, dword [eax]
mov ecx, ebx
call edx
mov ebp, dword [esp + 0x860]
push ebp
mov dword [esp + 0x85c], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000a9d0
mov dword [esp + 0x858], 0xffffffff
test ebx, ebx
je 0x1000a9c9
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
xor al, al
jmp 0x1000aa63
push ebp
push 0x420
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
test eax, eax
jne 0x1000aa01
mov dword [esp + 0x858], 0xffffffff
test ebx, ebx
je 0x1000a9fd
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
xor al, al
jmp 0x1000aa63
push esi
lea esi, [esp + 0x14]
push edi
lea edi, [esp + eax*2 + 0x18]
mov ecx, esi
cmp ecx, edi
jae 0x1000aa47
cmp word [esi], 0
je 0x1000aa47
mov ecx, dword [esp + 0x10]
push esi
push ebp
call fcn.1000e330
test al, al
je 0x1000aa7c
mov eax, esi
lea edx, [eax + 2]
jmp 0x1000aa30
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000aa30
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
cmp esi, edi
jb 0x1000aa11
mov dword [esp + 0x860], 0xffffffff
test ebx, ebx
je 0x1000aa5f
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x850]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x854
ret 4
mov dword [esp + 0x860], 0xffffffff
test ebx, ebx
je 0x1000aa94
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
xor al, al
jmp 0x1000aa61
Function at 0x1000b830
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1008532b
push eax
mov eax, 0x1024
mov dword fs:[0], esp
call fcn.10083c70
push ebx
push edi
xor edi, edi
test byte [0x100bbcf8], 1
mov dword [esp + 8], edi
lea ebx, [edi + 7]
jne 0x1000b88b
or dword [0x100bbcf8], 1
xor eax, eax
push 0x100875f0
mov dword [0x100bbcf0], ebx
mov dword [0x100bbcec], edi
mov word [0x100bbcdc], ax
call fcn.10083c4f
add esp, 4
cmp dword [0x100bbcec], edi
jne 0x1000b957
push edi
push 0x23
lea edx, [esp + 0x30]
push edx
xor ecx, ecx
push edi
mov word [esp + 0x38], cx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x1000b8c8
mov eax, dword [esp + 0x103c]
xor ecx, ecx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], edi
mov word [eax], cx
jmp 0x1000b97c
lea eax, [esp + 0x28]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000b8d0
sub eax, edx
sar eax, 1
cmp eax, edi
jne 0x1000b8fa
mov eax, dword [esp + 0x103c]
xor edx, edx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], edi
mov word [eax], dx
jmp 0x1000b97c
cmp word [esp + eax*2 + 0x26], 0x5c
je 0x1000b90a
mov dword [esp + eax*2 + 0x28], 0x5c
lea eax, [esp + 0x28]
push eax
push str._sOriginOrigin_Activation.ini
lea ecx, [esp + 0x14]
push 0x802
push ecx
call fcn.100101c0
add esp, 0x10
push eax
mov ecx, 0x100bbcdc
mov dword [esp + 0x1038], edi
call fcn.10003a10
cmp dword [esp + 0x20], 8
mov dword [esp + 0x1034], 0xffffffff
jb 0x1000b957
mov edx, dword [esp + 0xc]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
push esi
mov esi, dword [esp + 0x1040]
push 0xffffffffffffffff
push edi
xor eax, eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], edi
push 0x100bbcdc
mov ecx, esi
mov word [esi], ax
call fcn.10002ba0
mov eax, esi
pop esi
mov ecx, dword [esp + 0x102c]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1030
ret 4
Function at 0x1000e5b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10085616
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
lea ecx, [esi + 4]
mov dword [esp + 0xc], esi
mov byte [esi], 0
call fcn.100096d0
xor edi, edi
xor eax, eax
mov dword [esi + 0x34], 7
mov dword [esi + 0x30], edi
mov dword [esp + 0x24], edi
mov word [esi + 0x20], ax
push 0x3c
mov byte [esp + 0x28], 1
mov dword [esi + 0x44], edi
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, edi
je 0x1000e639
mov dword [esi + 0x40], eax
mov dword [eax], eax
mov eax, dword [esi + 0x40]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x40]
mov dword [eax + 8], eax
mov ecx, dword [esi + 0x40]
mov byte [ecx + 0x38], 1
mov edx, dword [esi + 0x40]
mov ecx, dword [esp + 0x1c]
pop edi
mov byte [edx + 0x39], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], edi
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x100af670
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x10088718
call sub.MSVCR100.dll__CxxThrowException
int3

Function at 0x1000e6f0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x1000e71b
push esi
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000e71a
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x1000eb70
Capabilities:
Enumerate gui resources
Log keystrokes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
push ebp
push esi
push edi
test eax, eax
je 0x1000ec3f
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 0x1000e8f0
mov dword [esp + 0x1c], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [esp + 0x14]
mov ebp, esi
test esi, esi
je 0x1000ec3f
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
jne 0x1000ebc1
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push eax
call ebx
push 0
push esi
mov edi, eax
call ebx
mov esi, eax
test edi, edi
je 0x1000ec3f
test esi, esi
je 0x1000ec3f
push 1
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
test bl, bl
je 0x1000ec35
push ebp
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp eax, 1
sete bl
test bl, bl
je 0x1000ec2b
push ebp
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1000ec10
push 9
jmp 0x1000ec12
push 5
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push ebp
call dword [sym.imp.USER32.dll_BringWindowToTop]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, ebp
sete bl
push 0
push esi
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
Function at 0x1000eea0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, dword [esp + 0x10]
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], cx
mov ecx, eax
lea edi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x1000eed0
sub ecx, edi
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10002ec0
pop edi
mov eax, esi
pop esi
pop ecx
ret

Function at 0x1000fbb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100856e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
xor edi, edi
xor eax, eax
mov dword [esp + 8], edi
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], edi
mov word [esp + 0xc], ax
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x30], edi
cmp eax, edi
jge 0x1000fc0f
cmp esi, edi
je 0x1000fc30
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000fc00
sub eax, edx
sar eax, 1
cmp esi, edi
je 0x1000fc30
cmp eax, edi
je 0x1000fc30
mov ecx, dword [esp + 0x40]
cmp ecx, edi
jl 0x1000fc25
cmp ecx, eax
jge 0x1000fc25
mov eax, ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.10002ec0
mov esi, dword [esp + 0x38]
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
lea edx, [esp + 0xc]
mov word [esi], cx
push edx
mov ecx, esi
call fcn.10003a10
cmp dword [esp + 0x20], 8
jb 0x1000fc63
mov eax, dword [esp + 0xc]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x1000fc80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100856e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
xor edi, edi
xor eax, eax
mov dword [esp + 8], edi
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], edi
mov word [esp + 0xc], ax
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x30], edi
cmp eax, edi
jge 0x1000fcdf
cmp edx, edi
je 0x1000fd0d
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000fcd0
sub eax, esi
sar eax, 1
cmp edx, edi
je 0x1000fd0d
cmp eax, edi
je 0x1000fd0d
mov ecx, dword [esp + 0x40]
cmp ecx, eax
jge 0x1000fd0d
sub eax, ecx
lea edx, [edx + ecx*2]
mov ecx, dword [esp + 0x44]
cmp ecx, edi
jl 0x1000fd02
cmp ecx, eax
jge 0x1000fd02
mov eax, ecx
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.10002ec0
mov esi, dword [esp + 0x38]
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
lea edx, [esp + 0xc]
mov word [esi], cx
push edx
mov ecx, esi
call fcn.10003a10
cmp dword [esp + 0x20], 8
jb 0x1000fd40
mov eax, dword [esp + 0xc]
push eax
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x10010470
Capabilities:
Resume thread

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea esi, [edi + 4]
test esi, esi
je 0x1001048d
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
mov dword [edi + 0x40], 2
test esi, esi
je 0x100104a1
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
pop edi
mov al, 1
pop esi
ret

Function at 0x100104b0
Capabilities:
Resume thread
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x40]
xor ebx, ebx
cmp eax, ebx
je 0x100105db
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
cmp eax, 3
jne 0x100104f7
mov eax, dword [esi + 0x4c]
push eax
call ebp
lea edi, [esi + 4]
cmp edi, ebx
je 0x100104e3
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
mov dword [esi + 0x40], 2
cmp edi, ebx
je 0x100104f7
mov edx, dword [edi]
mov eax, dword [edx + 8]
mov ecx, edi
call eax
cmp dword [esi + 0x40], ebx
je 0x100105d9
lea edi, [esi + 4]
cmp edi, ebx
je 0x1001050f
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
mov dword [esi + 0x40], 4
cmp edi, ebx
je 0x10010523
mov edx, dword [edi]
mov eax, dword [edx + 8]
mov ecx, edi
call eax
mov ecx, dword [esi + 0x4c]
push ecx
call ebp
cmp edi, ebx
je 0x10010535
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
mov dword [esi + 0x40], 2
cmp edi, ebx
je 0x10010549
mov edx, dword [edi]
mov eax, dword [edx + 8]
mov ecx, edi
call eax
mov ebp, dword [esp + 0x18]
cmp ebp, ebx
je 0x10010563
call fcn.100109c0
mov ebx, eax
mov edi, edx
mov eax, ebp
cdq
add ebx, eax
adc edi, edx
jmp 0x10010565
xor edi, edi
cmp dword [esi + 0x40], 0
je 0x10010590
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
or ecx, edi
je 0x10010586
call fcn.100109c0
cmp edx, edi
jg 0x10010590
jl 0x10010586
cmp eax, ebx
jae 0x10010590
push 0xa
call ebp
cmp dword [esi + 0x40], 0
jne 0x10010571
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x100105d9
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x4c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x4c]
cmp eax, ebx
je 0x100105b7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x4c], ebx
lea edi, [esi + 4]
mov dword [esi + 0x50], ebx
cmp edi, ebx
je 0x100105c9
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
mov dword [esi + 0x40], ebx
cmp edi, ebx
je 0x100105d9
mov edx, dword [edi]
mov eax, dword [edx + 8]
mov ecx, edi
call eax
pop edi
pop ebp
pop esi
pop ebx
ret 8
Function at 0x100107e0
Capabilities:
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100850be
push eax
mov dword fs:[0], esp
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x40], 0
push edi
jne 0x10010910
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x48], eax
mov dword [esi + 0x20], ecx
test edx, edx
jne 0x1001081f
mov edx, 0x100897d8
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10010824
sub eax, edi
push eax
push edx
lea ecx, [esi + 0x24]
call fcn.10003910
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x54], eax
test eax, eax
jne 0x100108ae
test byte [0x100bbcc4], 1
jne 0x1001087f
or dword [0x100bbcc4], 1
mov ecx, 0x100bbca0
mov dword [esp + 0x14], eax
call fcn.10009750
push 0x100875d0
call fcn.10083c4f
add esp, 4
mov dword [esp + 0x14], 0xffffffff
push str._CoreThread::Start_____CreateEvent_failed
push str.Core::CoreThread::Start
push 1
push 0x100bbca0
call fcn.10009820
add esp, 0x10
xor al, al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0x18
lea edi, [esi + 0x50]
push edi
push 4
push esi
push 0x100107c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x4c], eax
test eax, eax
je 0x10010898
cmp dword [edi], 0
je 0x10010898
mov edx, dword [esp + 0x28]
push edx
mov ecx, esi
call fcn.10010390
mov bl, byte [esp + 0x2c]
test bl, bl
jne 0x100108eb
mov ecx, esi
call fcn.10010470
xor eax, eax
test bl, bl
setne al
mov ecx, esi
add eax, 2
push eax
call fcn.10010440
cmp byte [esp + 0x30], 0
je 0x10010910
mov ecx, dword [esi + 0x54]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x18
Function at 0x10014240
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0xb676c5d3
mov dword [esp + 0x10], 0x669924b5
mov dword [esp + 0x14], 0xa048bce6
mov byte [esp + 0x18], 0x60
mov edx, 0x249e9b64
mov ecx, 0x188ef904
xor eax, eax
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0xfc89
jl 0x10014273
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x100142b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0x9c01412
mov dword [esp + 0x10], 0x7745b1a0
mov word [esp + 0x14], 0xf3e3
mov byte [esp + 0x16], 0xb3
mov edx, 0xe40767c0
mov ecx, 0x67891f27
xor eax, eax
mov bl, byte [esp + esi + 0xc]
sub bl, dl
xor bl, cl
add ecx, eax
add edx, edi
mov byte [esp + esi + 0xc], bl
add eax, 0x136d
inc esi
add edi, 0x170f
cmp eax, 0xd5af
jl 0x100142e2
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
pop ebx
add esp, 0xc
ret