joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002ef90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
mov eax, dword [esp + 0x64]
push ebx
mov ebx, dword [eax + 0x20]
test ebx, ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x64]
mov ebp, dword [edi]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
je 0x1002f168
lea esp, [esp]
movzx edx, byte [ebx + 8]
mov ecx, dword [esp + 0x68]
cmp edx, ecx
jne 0x1002f15d
movzx eax, byte [ebx + 9]
cmp eax, dword [esp + 0x70]
jne 0x1002f15d
mov eax, dword [ebx + 0x1c]
cmp eax, dword [ebx + 0x20]
je 0x1002eff2
mov edx, dword [ebp + 8]
cmp eax, dword [edx + 0x2c]
jne 0x1002f15d
cmp ecx, 0x64
jne 0x1002f013
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x1002f013
mov esi, dword [esp + 0x6c]
push eax
call fcn.1002ec50
add esp, 4
test eax, eax
je 0x1002f15d
mov eax, dword [edi + 0x188]
test eax, eax
je 0x1002f030
lea ecx, [ecx]
cmp ebx, dword [eax + 0x1c]
je 0x1002f15d
mov eax, dword [eax + 0x20]
test eax, eax
jne 0x1002f020
mov eax, dword [ebx]
push 0xffffffffffffffff
push eax
push str.___TRIGGER__s
push ebp
call fcn.10023920
mov ecx, dword [edi + 0xc]
add esp, 0xc
push eax
push 0
push 0
push 0
push 0x14
push ecx
call fcn.10016e40
mov edx, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x38], edx
mov edx, dword [edi + 0x188]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], edx
mov dword [edi + 0x188], ecx
mov edx, dword [ebx]
push edx
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x64], edi
call fcn.10025600
mov ecx, dword [edi + 0xc]
push ecx
call fcn.10014ac0
mov edx, dword [ebx + 0xc]
push edx
push ebp
mov dword [esp + 0x98], eax
call fcn.1002c380
add esp, 0x34
cmp byte [ebp + 0x1e], 0
mov esi, eax
jne 0x1002f194
lea eax, [esp + 0x3c]
push esi
push eax
call fcn.1002ced0
add esp, 8
test eax, eax
jne 0x1002f194
mov ecx, dword [esp + 0x64]
push 8
push ecx
push esi
push edi
call fcn.1002e450
push esi
call fcn.1002b920
mov edx, dword [esp + 0x94]
mov eax, dword [ebx + 0x24]
push edx
push eax
call fcn.1002ed90
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0x2c]
push edx
mov dword [edi + 0x188], ecx
call fcn.10025630
mov eax, dword [esp + 0x84]
mov ecx, dword [edi + 0xc]
push eax
push ecx
call fcn.10014b10
add esp, 0x28
mov ebx, dword [ebx + 0x28]
test ebx, ebx
jne 0x1002efc0
mov eax, dword [esp + 0x88]
test eax, eax
je 0x1002f179
mov ecx, dword [esp + 0x28]
or dword [eax], ecx
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x1002f18a
mov edx, dword [esp + 0x24]
or dword [eax], edx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
mov edx, dword [esp + 0x38]
push esi
mov dword [edi + 0x188], edx
call fcn.1002b920
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x50
ret
Function at 0x1003f300
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [esi + 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, esi
call fcn.10040440
mov ecx, esi
call fcn.10040a40
mov ecx, esi
call fcn.1003fbe0
mov ecx, esi
call fcn.10040010
cmp byte [esi + 0x20], 0
jne 0x1003f34c
mov ecx, esi
call fcn.1003f440
cmp byte [esi + 0x21], 0
jne 0x1003f359
mov ecx, esi
call fcn.1003f810
push ebx
push edi
lea ebx, [esi + 0x3c]
lea edi, [esi + 0x6c]
cmp edi, ebx
je 0x1003f371
push 0xffffffffffffffff
push 0
push ebx
mov ecx, edi
call fcn.10041c10
push 5
push str.Skin_
mov ecx, edi
call fcn.100415d0
cmp dword [edi + 0x14], 8
jb 0x1003f389
mov eax, dword [edi]
jmp 0x1003f38b
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1003f3a7
cmp dword [edi + 0x14], 8
jb 0x1003f39e
mov edi, dword [edi]
push edi
call fcn.10110103
add esp, 4
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1012bcf0
add esp, 0xc
cmp dword [ebx + 0x14], 8
jb 0x1003f3c5
mov ebx, dword [ebx]
push str.AllSkin
push ebx
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.10041b40
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop edi
pop ebx
test eax, eax
jne 0x1003f401
lea eax, [ebp - 0x20c]
push eax
call fcn.10110103
add esp, 4
mov ecx, esi
call fcn.10040990
mov ecx, esi
call fcn.100405c0
mov ecx, esi
call fcn.10040690
mov ecx, esi
call fcn.10040780
mov ecx, esi
call fcn.10040870
mov ecx, esi
call fcn.10040900
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
Function at 0x10040440
Capabilities:
Check for time delay via queryperformancecounter
Find taskbar

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x101ba0ec]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.10054700
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
mov dword [esi], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x30
call ebx
mov eax, dword [esp + 0x18]
mov dword [esi + 8], eax
call fcn.10054290
push 0
mov dword [esi + 0xc], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x30
call ebx
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
push 0
push str.Shell_TrayWnd
call ebx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, eax
call edi
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
push 0
mov dword [ecx + 0x10], eax
lea eax, [esp + 0x38]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call ebx
mov esi, eax
call edi
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
push 0
mov dword [ecx + 0x18], eax
lea eax, [esp + 0x38]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0
push str.Shell_TrayWnd
call ebx
mov esi, eax
call edi
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x14]
push ecx
push eax
call ebx
lea eax, [esp + 0x24]
push eax
push esi
call ebx
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebx]
mov dword [ebx + 4], eax
lea eax, [ebx + 0x168]
push eax
call esi
lea eax, [ebx + 0x180]
push eax
call esi
lea eax, [ebx + 0x170]
push eax
call esi
lea eax, [ebx + 0x1b0]
push eax
call esi
lea eax, [ebx + 0x190]
push eax
call esi
lea eax, [ebx + 0x1a0]
push eax
call esi
mov eax, dword [0x101c7da4]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
mov dword [ebx + 0x15c], eax
pop ebx
xor ecx, esp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
Function at 0x100405c0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
lea eax, [ebp - 0x20c]
mov esi, ecx
push 0
push eax
call fcn.1012bcf0
add esi, 0x24
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x100405f9
mov eax, dword [esi]
jmp 0x100405fb
mov eax, esi
push 0x1018433c
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.10041b40
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10040634
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esi + 0x14], 8
jb 0x1004063c
mov esi, dword [esi]
push str.Dict
push esi
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.10041b40
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop esi
test eax, eax
jne 0x10040676
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret

Function at 0x10040690
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x50], 8
lea eax, [esi + 0x3c]
jb 0x100406b1
mov eax, dword [eax]
push 0x10184350
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.10041b40
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100406eb
lea eax, [ebp - 0x20c]
push eax
call fcn.10110103
add esp, 4
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x100406f4
mov eax, dword [str.Config.ini]
mov dword [ecx], eax
mov eax, dword [0x10184364]
mov dword [ecx + 4], eax
mov eax, dword [0x10184368]
mov dword [ecx + 8], eax
mov eax, dword [0x1018436c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x10184370]
mov dword [ecx + 0x10], eax
mov ax, word [0x10184374]
mov word [ecx + 0x14], ax
cmp word [ebp - 0x20c], 0
jne 0x1004073f
xor ecx, ecx
jmp 0x1004075f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10040750
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x54]
call fcn.10041f80
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
Function at 0x10040780
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x50], 8
lea eax, [esi + 0x3c]
jb 0x100407a1
mov eax, dword [eax]
push 0x10184350
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.10041b40
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100407db
lea eax, [ebp - 0x20c]
push eax
call fcn.10110103
add esp, 4
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x100407e4
mov eax, dword [str.Related.ini]
mov dword [ecx], eax
mov eax, dword [0x1018437c]
mov dword [ecx + 4], eax
mov eax, dword [0x10184380]
mov dword [ecx + 8], eax
mov eax, dword [0x10184384]
mov dword [ecx + 0xc], eax
mov eax, dword [0x10184388]
mov dword [ecx + 0x10], eax
mov eax, dword [0x1018438c]
mov dword [ecx + 0x14], eax
cmp word [ebp - 0x20c], 0
jne 0x1004082d
xor ecx, ecx
jmp 0x10040845
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10040836
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0xcc]
call fcn.10041f80
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret

Function at 0x10040990
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x50], 8
lea eax, [esi + 0x3c]
jb 0x100409b1
mov eax, dword [eax]
push str.UseData
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.10041b40
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100409eb
lea eax, [ebp - 0x20c]
push eax
call fcn.10110103
add esp, 4
cmp word [ebp - 0x20c], 0
jne 0x100409f9
xor ecx, ecx
jmp 0x10040a11
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10040a02
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x144]
call fcn.10041f80
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
Function at 0x100412a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x188]
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [esi]
lea ebx, [edi + 0x180]
sub edx, dword [ebx]
mov eax, dword [esi + 4]
sbb eax, dword [ebx + 4]
push 0
push 0x3e8
push eax
push edx
call fcn.1010b5e0
push dword [edi + 0x1c4]
push dword [edi + 0x1c0]
push edx
push eax
call fcn.10155fc0
test edx, edx
jl 0x1004130a
jg 0x100412f0
cmp eax, 0x3e8
jbe 0x1004130a
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call fcn.10054290
mov dword [edi + 0xc], eax
mov eax, dword [0x101c7da4]
mov dword [edi + 0x15c], eax
mov eax, dword [edi + 0xc]
pop edi
pop esi
pop ebx
ret
Function at 0x10044a40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
xor edi, edi
mov dword [ebp - 0x34], 0
xorps xmm0, xmm0
mov dword [ebp - 0x30], edi
mov dword [esi + 8], edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov al, byte [ebx + 0x6012]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
movsd qword [ebp - 0x54], xmm0
movsd qword [ebp - 0x3c], xmm0
mov byte [ebp - 0x29], al
test al, al
je 0x10044c00
push edi
mov ecx, ebx
call fcn.100445d0
test al, al
je 0x10044abc
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10044960
test al, al
je 0x10044c14
jmp 0x10044ba5
mov al, byte [ebp - 0x29]
cmp al, 0x28
jne 0x10044b07
mov dword [ebp - 0x4c], 0x14
mov dword [ebp - 0x48], 6
mov dword [ebp - 0x44], 0xffffffff
mov eax, dword [esi + 8]
inc edi
mov dword [ebp - 0x30], edi
cmp eax, 0x3e8
je 0x10044c62
movups xmm0, xmmword [ebp - 0x4c]
inc eax
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
movups xmmword [esi + eax*8 + 0x10], xmm0
movsd xmm0, qword [ebp - 0x54]
jmp 0x10044bd3
cmp al, 0x29
jne 0x10044b22
mov dword [ebp - 0x4c], 0x28
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
jmp 0x10044ad8
movsx eax, byte [ebx + edi + 0x6012]
push eax
push 0x101844d8
mov dword [ebp - 0x58], eax
call fcn.1012ad50
add esp, 8
test eax, eax
je 0x10044b43
mov al, 1
jmp 0x10044b53
push dword [ebp - 0x58]
call fcn.101337c1
add esp, 4
test eax, eax
setne al
test al, al
je 0x10044be8
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10044680
test al, al
je 0x10044c3b
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.100448a0
test al, al
je 0x10044c3b
mov eax, dword [ebp - 0x4c]
add eax, 0xffffffeb
cmp eax, 0x12
ja 0x10044b9b
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0
jl 0x10044c27
mov eax, dword [esi + 8]
cmp eax, 0x3e8
je 0x10044c62
movups xmm0, xmmword [ebp - 0x4c]
mov edi, dword [ebp - 0x30]
inc eax
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
lea eax, [eax + eax*2]
movups xmmword [esi + eax*8 + 0x10], xmm0
movsd xmm0, qword [ebp - 0x3c]
movsd qword [ebp - 0x54], xmm0
movq qword [esi + eax*8 + 0x20], xmm0
mov ecx, 0x3e8
mov eax, dword [esi + 4]
inc eax
cdq
idiv ecx
mov dword [esi + 4], edx
mov al, byte [ebx + edi + 0x6012]
mov byte [ebp - 0x29], al
test al, al
jne 0x10044a90
cmp dword [ebp - 0x34], 1
je 0x10044c14
mov dword [ebx + 0x6208], 2
mov dword [ebx + 0x620c], 0x13e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret 4
mov dword [ebx + 0x6208], 2
mov dword [ebx + 0x620c], 0x109
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [ebx + 0x6208], 8
xor ecx, ebp
mov dword [ebx + 0x620c], 0x134
pop ebx
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret 4
push str.Queue_overflow_
push 0x101c51c8
call fcn.100453d0
push eax
call fcn.10045670
add esp, 0xc
push 1
call fcn.10138ec0
int3
Function at 0x10045140
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x7d38
call fcn.1010bb90
mov eax, dword [0x101ba0ec]
xor eax, esp
mov dword [esp + 0x7d34], eax
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x1f68]
push 0x5dd0
push edi
push eax
call fcn.1012b770
mov ecx, dword [esp + 0x1f7c]
or esi, 0xffffffff
add esp, 0xc
mov dword [esp + 0x1f60], esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], 0
test ecx, ecx
jle 0x1004537c
mov dword [esp + 0x10], 0x3e8
test ecx, ecx
je 0x10045375
mov edx, dword [esp + 0x1f68]
dec ecx
lea eax, [edx + edx*2]
movups xmm3, xmmword [esp + eax*8 + 0x1f78]
movq xmm2, qword [esp + eax*8 + 0x1f88]
lea eax, [edx + 1]
cdq
idiv dword [esp + 0x10]
movd eax, xmm3
mov dword [esp + 0x1f70], ecx
mov dword [esp + 0x1f68], edx
cmp eax, 0x14
jge 0x10045225
test eax, eax
jne 0x1004520b
cmp esi, 0x3e7
je 0x100453a6
inc esi
mov dword [esp + 0x1f60], esi
movsd qword [esp + esi*8 + 0x20], xmm2
jmp 0x100452fb
cmp esi, 0x3e7
je 0x100453a6
movsd xmm0, qword [edi + eax*8 + 0x5dd0]
jmp 0x100452ed
cmp eax, 0x28
jle 0x10045291
cmp esi, 0xffffffff
je 0x10045344
movsd xmm0, qword [esp + esi*8 + 0x20]
mov ecx, eax
dec esi
sub ecx, 0x29
je 0x10045288
sub ecx, 1
je 0x100452da
cmp eax, 0x32
jle 0x1004526f
mov eax, dword [eax*4 + 0x101845ac]
sub esp, 8
movsd qword [esp], xmm0
call eax
fstp qword [esp + 0x20]
movsd xmm0, qword [esp + 0x20]
add esp, 8
jmp 0x100452da
mov dword [edi + 0x6208], 8
xorps xmm0, xmm0
mov dword [edi + 0x620c], 0x1b9
jmp 0x100452da
xorps xmm0, xmmword [0x10198540]
jmp 0x100452da
add eax, 0xffffffeb
cmp eax, 0x12
ja 0x10045302
cmp esi, 0xffffffff
je 0x10045344
movsd xmm1, qword [esp + esi*8 + 0x20]
dec esi
mov dword [esp + 0x1f60], esi
cmp esi, 0xffffffff
je 0x10045344
movsd xmm0, qword [esp + esi*8 + 0x20]
sub esp, 0x18
mov eax, esp
mov ecx, edi
dec esi
movups xmmword [eax], xmm3
movq qword [eax + 0x10], xmm2
movaps xmm3, xmm1
movaps xmm2, xmm0
call fcn.10045080
cmp esi, 0x3e7
je 0x100453a6
mov ecx, dword [esp + 0x1f70]
inc esi
mov dword [esp + 0x1f60], esi
movsd qword [esp + esi*8 + 0x20], xmm0
mov esi, dword [esp + 0x1f60]
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
cmp eax, dword [esp + 0x14]
jl 0x100451a5
cmp esi, 0xffffffff
je 0x1004537c
movsd xmm0, qword [esp + esi*8 + 0x20]
dec esi
movsd qword [edi + 0x5dd0], xmm0
cmp esi, 0xffffffff
jne 0x1004534b
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x7d34]
xor ecx, esp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
push str.Attempt_to_pop_an_empty_stack_
jmp 0x100453ab
mov dword [edi + 0x6208], 3
xor al, al
mov dword [edi + 0x620c], 0x1ee
pop edi
pop esi
mov ecx, dword [esp + 0x7d34]
xor ecx, esp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
push str.Deleting_from_an_empty_queue_
jmp 0x100453ab
mov ecx, dword [esp + 0x7d3c]
xor al, al
mov dword [edi + 0x6208], 9
mov dword [edi + 0x620c], 0x1f3
pop edi
pop esi
xor ecx, esp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
push str.Stack_overflow_
push 0x101c51c8
call fcn.100453d0
push eax
call fcn.10045670
add esp, 0xc
push 1
call fcn.10138ec0
int3
Function at 0x10047390
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10157df6
mov eax, dword fs:[0]
push eax
sub esp, 0x67c
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x22c
lea eax, [ebp - 0x680]
push 0
push eax
call fcn.1012bcf0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
call fcn.1012bcf0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10047401
xor eax, eax
jmp 0x10047475
lea eax, [ebp - 0x680]
mov dword [ebp - 0x680], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10047469
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
xor eax, eax
movzx ecx, word [ebp + eax - 0x65c]
lea eax, [eax + 2]
mov word [ebp + eax - 0x21a], cx
test cx, cx
jne 0x10047425
lea eax, [ebp - 0x218]
push eax
call fcn.101391d9
add esp, 4
lea ecx, [ebp - 0x218]
call fcn.100472e0
test al, al
jne 0x10047491
lea eax, [ebp - 0x680]
push eax
push esi
call edi
test eax, eax
jne 0x10047423
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1012bcf0
add esp, 0xc
push dword [ebp - 0x678]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x104
lea ecx, [ebp - 0x420]
push ecx
push 0
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
sub esp, 0x18
lea eax, [ebp - 0x420]
mov ecx, esp
mov dword [ebp - 0x684], esp
push eax
call fcn.10041a70
sub esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
mov ecx, esp
push eax
call fcn.10041a70
lea ecx, [ebp - 0x450]
mov dword [ebp - 4], 0xffffffff
call fcn.1004b4d0
push eax
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.10049740
lea ecx, [ebp - 0x450]
call fcn.10047530
jmp 0x10047470

Function at 0x10048300
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfac
mov eax, dword [0x101ba0ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x7d0
lea eax, [ebp - 0xfa8]
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [ebp - 0xfa8]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x10048332
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x1004836c
sub esp, 8
lea ecx, [ebp - 0xfa8]
call fcn.100483e0
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1010a7f2
mov esp, ebp
pop ebp
ret