joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005b37c
Capabilities:
Check if file exists

Disassembly:
push 0x6c
mov eax, 0x10079399
call fcn.100600fa
lea eax, [ebp - 0x5c]
mov ebx, ecx
push eax
mov dword [ebp - 0x40], ebx
mov esi, edx
call fcn.10021910
and dword [ebp - 4], 0
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov ecx, dword [esi]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
jmp 0x1005b3ed
lea esi, [ebp - 0x34]
call fcn.100229c0
cmp dword [eax + 0x18], 8
jb 0x1005b3c4
mov eax, dword [eax + 4]
jmp 0x1005b3c7
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005b3e5
lea esi, [ebp - 0x34]
call fcn.100229c0
lea ebx, [ebp - 0x5c]
call fcn.10021a60
mov ebx, dword [ebp - 0x40]
lea esi, [ebp - 0x34]
call fcn.100229f0
lea esi, [ebp - 0x3c]
lea edi, [ebp - 0x34]
call fcn.10007b40
test al, al
jne 0x1005b3b1
cmp dword [ebp - 0x44], 0
jne 0x1005b417
mov edi, 0x44e
lea eax, [ebp - 0x5c]
call fcn.10021a30
mov eax, edi
call fcn.1006017d
ret
mov edi, ebx
call fcn.10039e5b
mov esi, ebx
call fcn.1003a520
push ebx
push 0x1008a504
push 0x1008a508
lea esi, [ebp - 0x2c]
call fcn.1003c4c4
add esp, 0xc
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [eax]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], eax
jmp 0x1005b4a1
lea esi, [ebp - 0x34]
call fcn.100229c0
cmp dword [eax + 0x18], 8
jb 0x1005b468
mov eax, dword [eax + 4]
jmp 0x1005b46b
add eax, 4
push eax
push str.___s_
lea esi, [ebp - 0x78]
call fcn.1003c4c4
pop ecx
pop ecx
push 0
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.1000a820
lea esi, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.1002fe50
lea esi, [ebp - 0x34]
call fcn.100229f0
lea esi, [ebp - 0x3c]
lea edi, [ebp - 0x34]
call fcn.10007b40
test al, al
jne 0x1005b455
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push ebx
call esi
test eax, eax
je 0x1005b4de
push 0x10089f24
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1005b4de
lea eax, [ebp - 0x2c]
push eax
mov eax, str.__md1M
call fcn.100078c0
push 0
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x60], 0xf
call fcn.100092a0
mov byte [ebp - 4], 4
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1005b4ff
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x78]
push ecx
push eax
call fcn.1005af6a
pop ecx
pop ecx
lea ecx, [ebp - 0x78]
mov edi, eax
call fcn.100077c0
test edi, edi
je 0x1005b520
mov esi, ebx
call fcn.1003a520
lea esi, [ebp - 0x2c]
call fcn.1002fe50
jmp 0x1005b407
Function at 0x1005b52d
Capabilities:
Check if file exists

Disassembly:
push 0xa4
mov eax, 0x1007a5f5
call fcn.100600fa
mov esi, ecx
mov edi, edx
push esi
mov dword [ebp - 0x54], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1005b558
mov eax, 0x44f
jmp 0x1005b6b2
push esi
call fcn.1005afd6
pop ecx
test eax, eax
je 0x1005b571
mov edx, edi
mov ecx, esi
call fcn.1005b16a
jmp 0x1005b6b2
push esi
push 0x1008a504
push str.__s__l___s_
lea esi, [ebp - 0x48]
call fcn.1003c4c4
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.100092a0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x1005b5ac
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.1005af6a
pop ecx
pop ecx
mov dword [ebp - 0x58], eax
cmp eax, ebx
jne 0x1005b69f
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x1005b5cf
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x78]
push eax
mov edi, 0x1008a554
call fcn.1003c1fe
pop ecx
pop ecx
lea esi, [ebp - 0x50]
lea edi, [ebp - 0x78]
mov byte [ebp - 4], 4
call fcn.10007f00
jmp 0x1005b67a
lea esi, [ebp - 0x50]
call fcn.10017190
push eax
call fcn.1004e86a
test eax, eax
jne 0x1005b609
inc ebx
jmp 0x1005b672
cmp ebx, 1
jne 0x1005b66d
lea esi, [ebp - 0x50]
call fcn.10017190
cmp dword [eax + 0x14], 0x35
jbe 0x1005b672
call fcn.10017190
push 0xffffffffffffffff
push 0x35
pop ecx
lea esi, [ebp - 0xb0]
mov edx, eax
call fcn.100077f0
push eax
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
call fcn.10017240
pop ecx
mov ecx, dword [ebp - 0x54]
push eax
mov byte [ebp - 4], 6
call fcn.10021a90
lea esi, [ebp - 0x94]
call fcn.1002fe50
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 4
call fcn.100077c0
jmp 0x1005b672
cmp ebx, 2
je 0x1005b697
lea esi, [ebp - 0x50]
call fcn.1001d330
lea esi, [ebp - 0x60]
lea edi, [ebp - 0x78]
call fcn.10007f20
mov esi, eax
lea edi, [ebp - 0x50]
call fcn.10007b40
test al, al
jne 0x1005b5f4
lea esi, [ebp - 0x78]
call fcn.10007a20
lea ecx, [ebp - 0x2c]
call fcn.100077c0
lea esi, [ebp - 0x48]
call fcn.1002fe50
mov eax, dword [ebp - 0x58]
call fcn.1006017d
ret
Function at 0x1005b6b8
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebx]
push esi
push edi
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
lea edi, [ebp - 0x14]
lea esi, [ebp - 0xc]
mov dword [ebp - 0x14], eax
call fcn.1003ee1d
test al, al
jne 0x1005b75d
call fcn.10050abd
add eax, 0x1c
cmp dword [eax + 0x18], 8
jb 0x1005b701
mov eax, dword [eax + 4]
jmp 0x1005b704
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1005b74c
lea esi, [ebp - 0xc]
call fcn.10050abd
cmp dword [eax + 0x18], 8
jb 0x1005b722
mov edi, dword [eax + 4]
jmp 0x1005b725
lea edi, [eax + 4]
lea esi, [ebp - 0xc]
call fcn.10050abd
add eax, 0x1c
cmp dword [eax + 0x18], 8
jb 0x1005b73b
mov eax, dword [eax + 4]
jmp 0x1005b73e
add eax, 4
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1005b750
and dword [ebp - 4], 0
lea esi, [ebp - 0xc]
call fcn.1003ebc1
jmp 0x1005b6d4
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x1005b764
Capabilities:
Check if file exists

Disassembly:
push 0x5c
mov eax, 0x1007af63
call fcn.100600fa
mov esi, ecx
push esi
mov edi, edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1005b789
mov eax, 0x44f
jmp 0x1005b832
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x1005b79e
mov eax, 0x450
jmp 0x1005b832
push esi
call fcn.1005afd6
pop ecx
test eax, eax
je 0x1005b7b4
push edi
mov ecx, esi
call fcn.1005b29f
pop ecx
jmp 0x1005b832
lea eax, [ebp - 0x68]
push eax
call fcn.1003d0b4
and dword [ebp - 4], 0
push edi
push esi
push 0x1008a504
push str.__s__x___s___r__o__s___y
lea esi, [ebp - 0x2c]
call fcn.1003c4c4
add esp, 0x10
push 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
call fcn.100092a0
mov byte [ebp - 4], 7
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1005b7f9
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
push ecx
push eax
call fcn.1005af6a
pop ecx
pop ecx
lea ecx, [ebp - 0x48]
mov edi, eax
call fcn.100077c0
test edi, edi
je 0x1005b81b
lea ebx, [ebp - 0x68]
call fcn.1005b6b8
lea esi, [ebp - 0x2c]
call fcn.1002fe50
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x68]
push eax
call fcn.1003d0ea
mov eax, edi
call fcn.1006017d
ret
Function at 0x1005ba11
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push str.docWatermark
push str._s_tid
lea esi, [ebp - 0x2c]
call fcn.1003c4c4
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x1005ba39
mov eax, dword [eax + 4]
jmp 0x1005ba3c
add eax, 4
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 4
pop esi
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
push str.Softwareprojonepodlp_volatile_threadMsg_server_
mov edi, 0x80000002
push edi
mov dword [ebp - 4], esi
call ebx
test eax, eax
jne 0x1005ba73
cmp dword [ebp - 8], esi
jne 0x1005ba73
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x1005ba77
and dword [ebp - 4], 0
lea esi, [ebp - 0x2c]
call fcn.1002fe50
cmp dword [ebp - 4], 0
je 0x1005bb01
push dword [ebp - 4]
call fcn.1003b818
test eax, eax
je 0x1005bb01
push str.docWatermark
push str._s_pid
lea esi, [ebp - 0x2c]
call fcn.1003c4c4
cmp dword [eax + 0x18], 8
pop ecx
pop ecx
jb 0x1005bab0
mov eax, dword [eax + 4]
jmp 0x1005bab3
add eax, 4
push 4
pop esi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
push str.Softwareprojonepodlp_volatile_threadMsg_server_
push edi
mov dword [ebp - 0xc], esi
call ebx
test eax, eax
jne 0x1005badc
cmp dword [ebp - 8], esi
jne 0x1005badc
mov eax, dword [ebp - 0x10]
jmp 0x1005bade
xor eax, eax
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x2c]
mov dword [edi], eax
call fcn.1002fe50
mov edi, dword [edi]
test edi, edi
je 0x1005bb01
mov ebx, edi
call fcn.1003b78f
test eax, eax
je 0x1005bb01
mov eax, dword [ebp - 4]
jmp 0x1005bb03
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005c615
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x1005d81d
Capabilities:
Hash data using sha1

Disassembly:
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x1005de7c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
lea ecx, [ebp - 0x30]
call fcn.10039c5b
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x30]
lea esi, [ebp - 0x10]
lea edi, [ebp - 8]
mov dword [ebp - 0x10], eax
call fcn.10007b40
test al, al
je 0x1005df18
mov esi, edi
call fcn.10008cc0
cmp dword [eax + 0x18], 8
jb 0x1005dec8
mov eax, dword [eax + 4]
jmp 0x1005decb
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 8], 0
jne 0x1005dedd
call fcn.1005f2e0
cmp byte [ebx + 0x29], 0
je 0x1005deea
call fcn.1005f2e0
jmp 0x1005de9b
mov eax, dword [ebx + 8]
cmp byte [eax + 0x29], 0
jne 0x1005deff
mov ebx, eax
mov eax, dword [ebx]
cmp byte [eax + 0x29], 0
je 0x1005def3
jmp 0x1005de98
mov eax, dword [ebx + 4]
jmp 0x1005df0e
cmp ebx, dword [eax + 8]
jne 0x1005df14
mov ebx, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x29], 0
je 0x1005df04
mov ebx, eax
jmp 0x1005de98
lea eax, [ebp - 0x30]
push eax
call fcn.10007fc0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1005e224
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x10099060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.1003ae16
mov dword [ebp - 0x230], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.10062cf0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.drivers
lea eax, [ebp - 0x210]
push eax
call esi
lea edx, [ebp - 0x210]
call fcn.1005de7c
push ebx
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1005e2d0
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x1005e35b
push edi
lea ecx, [ebp - 0x210]
call fcn.1003a32b
test eax, eax
jne 0x1005e359
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call esi
test eax, eax
jne 0x1005e359
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x22c]
call fcn.1005de56
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
pop ecx
jae 0x1005e31d
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1005e349
push 0
lea eax, [ebp - 0x210]
push eax
push edi
call esi
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x1005e34c
push 9
pop edi
lea esi, [ebp - 0x22c]
call fcn.1002fe50
jmp 0x1005e35b
xor edi, edi
push dword [ebp - 0x230]
call fcn.1003ae56
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1005ebcb
leave
ret
Function at 0x1005e511
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 4]
push ebx
push esi
movzx esi, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 6]
movzx ebx, byte [eax + 0xd]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 7]
push edi
movzx edi, byte [eax + 9]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 8]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xa]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xb]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xc]
shl edi, 8
or edi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edi, 8
or edi, ebx
shl edi, 8
or edi, eax
xor ecx, 0xa3b1bac6
xor edx, 0x56aa3350
xor esi, 0x677d9197
xor edi, 0xb27022dc
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
xor ecx, ecx
mov eax, dword [ecx + 0x10088948]
xor eax, dword [ebp + ecx - 0x20]
xor eax, dword [ebp + ecx - 0x18]
xor eax, dword [ebp + ecx - 0x1c]
mov edx, eax
shr edx, 0x18
mov ebx, eax
movzx edx, dl
mov dl, byte [edx + 0x10088838]
shr ebx, 0x10
mov byte [ebp + 0x70], dl
mov byte [ebp + 0x6d], bl
movzx edx, byte [ebp + 0x6d]
mov dl, byte [edx + 0x10088838]
mov ebx, eax
movzx eax, al
mov al, byte [eax + 0x10088838]
mov byte [ebp + 0x73], al
movzx eax, byte [ebp + 0x70]
shr ebx, 8
movzx edx, dl
shl eax, 8
or eax, edx
movzx esi, bl
mov bl, byte [esi + 0x10088838]
shl eax, 8
movzx edx, bl
or eax, edx
movzx edx, byte [ebp + 0x73]
shl eax, 8
or eax, edx
mov edx, eax
rol edx, 0xd
mov esi, eax
ror esi, 9
xor edx, esi
xor edx, dword [ebp + ecx - 0x24]
xor edx, eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp + ecx - 0x14], edx
mov dword [ecx + eax], edx
add ecx, 4
cmp ecx, 0x80
jb 0x1005e5c0
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x1005ebcb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10099060]
jne 0x1005ebd5
repz ret
jmp fcn.1006019b
Function at 0x10069bb2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10060406
and dword [ebp - 4], 0
cmp dword [0x1009e734], 0
mov ebx, eax
jne 0x10069c63
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10069d14
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10069d14
push eax
call fcn.10060394
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1009e734], eax
call esi
push eax
call fcn.10060394
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1009e738], eax
call esi
push eax
call fcn.10060394
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1009e73c], eax
call esi
push eax
call fcn.10060394
pop ecx
mov dword [0x1009e744], eax
test eax, eax
je 0x10069c63
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10060394
pop ecx
mov dword [0x1009e740], eax
mov eax, dword [0x1009e740]
cmp eax, ebx
je 0x10069cbb
cmp dword [0x1009e744], ebx
je 0x10069cbb
push eax
call fcn.1006040f
push dword [0x1009e744]
mov esi, eax
call fcn.1006040f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10069cbb
test edi, edi
je 0x10069cbb
call esi
test eax, eax
je 0x10069cb2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10069cb2
test byte [ebp - 0xc], 1
jne 0x10069cbb
or dword [ebp + 0x10], 0x200000
jmp 0x10069cf4
mov eax, dword [0x1009e738]
cmp eax, ebx
je 0x10069cf4
push eax
call fcn.1006040f
pop ecx
test eax, eax
je 0x10069cf4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10069cf4
mov eax, dword [0x1009e73c]
cmp eax, ebx
je 0x10069cf4
push eax
call fcn.1006040f
pop ecx
test eax, eax
je 0x10069cf4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1009e734]
call fcn.1006040f
pop ecx
test eax, eax
je 0x10069d14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10069d16
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1006aef0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1009e850], eax
je 0x1006af0e
mov eax, 0x10dd
jmp 0x1006afef
mov eax, dword [0x1009e860]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1006af8c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1006af6a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1006af6a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1006b060
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.1005f31a
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x1006af16
mov dword [0x1009e860], 0
call fcn.1006b000
mov ecx, dword [0x1009e85c]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x1006afd9
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.1005f31a
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x1006afa4
mov dword [0x1009e85c], 0
mov dword [0x1009e850], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1006b530
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x1006b545
xor eax, eax
jmp 0x1006b5ba
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x1006b572
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x1006b5b5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x1006b5b3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x1006b5af
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x1006b5b3
xor eax, eax
jmp 0x1006b5ba
jmp 0x1006b569
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1006b660
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1009e854], 0
je 0x1006b679
mov eax, dword [0x1009e854]
jmp 0x1006b719
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1006b68b
xor eax, eax
jmp 0x1006b719
push 8
call fcn.1005f40e
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1006b6e1
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x1006b6ca
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1005f31a
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x1009e854], eax
mov dword [0x1009e858], 0
mov eax, dword [ebp - 4]
jmp 0x1006b719
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1006b6fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1006b6ab
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x1009e85c]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x1009e85c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1006c010
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1006c220
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x1009e844], 0
jne 0x1006c04d
cmp dword [0x1009e840], 0
je 0x1006c04d
mov eax, dword [0x1009e840]
mov dword [0x1009e844], eax
cmp dword [0x1009e844], 0
je 0x1006c0ca
mov ecx, dword [0x1009e844]
cmp dword [ecx + 8], 0
je 0x1006c0ca
mov edx, dword [0x1009e844]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x1006c0ca
mov ecx, dword [0x1009e844]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1006c0ca
mov eax, dword [0x1009e844]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x1006c099
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x1006c0a0
xor eax, eax
jmp 0x1006c210
mov ecx, dword [0x1009e844]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10062cf0
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x1006c210
mov edx, dword [0x1009e840]
mov dword [0x1009e844], edx
jmp 0x1006c0e6
mov eax, dword [0x1009e844]
mov ecx, dword [eax + 4]
mov dword [0x1009e844], ecx
cmp dword [0x1009e844], 0
je 0x1006c126
cmp dword [0x1009e844], 0
je 0x1006c124
mov edx, dword [0x1009e844]
cmp dword [edx + 8], 0
je 0x1006c124
mov eax, dword [0x1009e844]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x1006c124
mov edx, dword [0x1009e844]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1006c124
jmp 0x1006c07e
jmp 0x1006c0d8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jne 0x1006c157
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.1006c400
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1006c170
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1006c300
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1006c20e
mov ecx, dword [ebp - 4]
mov dword [0x1009e844], ecx
mov edx, dword [0x1009e844]
mov dword [edx], 0x52727464
mov eax, dword [0x1009e844]
mov dword [eax + 8], 0
mov ecx, dword [0x1009e844]
mov edx, dword [0x1009e840]
mov dword [ecx + 4], edx
mov eax, dword [0x1009e844]
mov dword [0x1009e840], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [0x1009e844]
add ecx, 0x48
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0x38c
jmp 0x1006c1d9
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 1
jle 0x1006c1fd
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ecx + eax + 0x40], edx
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x1006c1d0
mov ecx, dword [0x1009e844]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 8], edx
jmp 0x1006c07e
xor eax, eax
mov esp, ebp
pop ebp
ret