joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5767ea90
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x5767eb6d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5768f284], 0
jne 0x5767eb39
lea edx, [ebp - 8]
mov eax, dword [0x5768ee08]
call fcn.57667e90
push dword [ebp - 8]
lea edx, [ebp - 0xc]
mov eax, dword [0x5768ee10]
call fcn.57667e90
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.57667b38
push dword [ebp - 0x10]
lea eax, [ebp - 4]
mov edx, 3
call fcn.57665858
mov eax, dword [ebp - 4]
call fcn.57665998
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.KERNEL32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.KERNEL32.dll_MapViewOfFile
mov dword [0x5768f284], eax
mov eax, dword [0x5768f284]
xor edx, edx
mov dword [eax], edx
push ebx
call sub.KERNEL32.dll_CloseHandle
cmp dword [0x5768f284], 0
je 0x5767eb50
mov eax, dword [0x5768f284]
call fcn.5767ea80
mov ebx, eax
jmp 0x5767eb52
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5767eb74
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.5766552c
ret

Function at 0x5767f33c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
xor eax, eax
mov dword [ebp - 0x150], eax
xor eax, eax
push ebp
push 0x5767f3e1
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x150]
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
call fcn.57665700
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
xor ecx, ecx
call fcn.5767d7e8
mov ebx, eax
test bl, bl
je 0x5767f3c8
mov eax, dword [ebp - 0x140]
push eax
call sub.KERNEL32.dll_CloseHandle
push 0x64
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
push 0
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_TerminateThread
mov eax, dword [ebp - 0x144]
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x12c]
push eax
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5767f3e8
lea eax, [ebp - 0x150]
call fcn.57665508
ret
Function at 0x5767f60c
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x5767f7f6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x5768f290], 0
jne 0x5767f7db
lea eax, [ebp - 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x5767f7d4
xor eax, eax
push ebp
push 0x5767f7cd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
cmp dword [ebp - 8], 0
je 0x5767f7b6
mov eax, dword [ebp - 8]
add eax, eax
push eax
push 0x40
call sub.KERNEL32.dll_LocalAlloc
mov ebx, eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
push 3
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x5767f7b0
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x5768ed68]
call fcn.57667e90
mov eax, dword [ebp - 0x24]
call fcn.57665998
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x5767f6e4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [0x5768ed6c]
call fcn.57667e90
mov eax, dword [ebp - 0x28]
call fcn.57665998
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x5767f717
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x2c]
mov eax, dword [0x5768ed70]
call fcn.57667e90
mov eax, dword [ebp - 0x2c]
call fcn.57665998
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueA
test eax, eax
jne 0x5767f74a
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov esi, dword [ebx]
dec esi
test esi, esi
jl 0x5767f79c
inc esi
xor ecx, ecx
lea edi, [ecx + ecx*2]
mov eax, dword [ebx + edi*4 + 4]
mov edx, dword [ebx + edi*4 + 8]
cmp edx, dword [ebp - 0xc]
jne 0x5767f767
cmp eax, dword [ebp - 0x10]
je 0x5767f798
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x14]
jne 0x5767f77c
cmp eax, dword [ebp - 0x18]
je 0x5767f798
lea eax, [ecx + ecx*2]
mov edx, dword [ebx + eax*4 + 8]
mov eax, dword [ebx + eax*4 + 4]
cmp edx, dword [ebp - 0x1c]
jne 0x5767f791
cmp eax, dword [ebp - 0x20]
je 0x5767f798
or dword [ebx + edi*4 + 0xc], 2
inc ecx
dec esi
jne 0x5767f754
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_AdjustTokenPrivileges
push ebx
call sub.KERNEL32.dll_LocalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5767f7d4
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_CloseHandle
ret
mov byte [0x5768f290], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5767f7fd
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.5766552c
ret
Function at 0x5d8a91
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5d87dc
inc edi
call fcn.005d8ad1
sub edi, ecx
add ecx, 1
sub edi, ecx
xor dword [edx], eax
add edi, 0x1e93a544
add edx, 2
add edi, 0x6d742098
and ecx, ecx
dec edi
cmp edx, esi
jl fcn.005d8a91
add edi, ecx
add edi, 0x8370c622
add edi, 0xe4d3b60c
ret
Function at 0x100073a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101a23ec]
sub eax, dword [0x101a2384]
mov dword [0x101a2300], eax
mov ecx, dword [0x1047eb38]
and ecx, dword [0x101a2348]
mov dword [0x1047eaf4], ecx
mov edx, dword [0x101a23cc]
imul edx, dword [0x1047eb70]
mov dword [0x101a2358], edx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov eax, dword [0x1047eb04]
add eax, dword [0x101a23f0]
mov dword [0x101a23e4], eax
mov ecx, dword [0x101a2334]
imul ecx, dword [0x1047eb88]
mov dword [0x1047eaf8], ecx
mov edx, dword [0x1047ebb8]
add edx, dword [0x1047ebac]
mov dword [0x101a2370], edx
mov eax, dword [0x1047eb34]
add eax, dword [0x1047eb00]
mov dword [0x1047eb60], eax
mov ecx, dword [0x101a22ec]
and ecx, dword [0x101a2300]
mov dword [0x1047eb90], ecx
mov edx, dword [0x101a2388]
and edx, dword [0x1047eb9c]
mov dword [0x1047eb94], edx
push 0
call fcn.1012b5f8
mov eax, dword [0x101a23c0]
imul eax, dword [0x101a23cc]
mov dword [0x1047eb98], eax
mov ecx, dword [0x1047eb84]
imul ecx, dword [0x1047ebac]
mov dword [0x101a2330], ecx
mov edx, dword [0x101a23d8]
sub edx, dword [0x101a2350]
mov dword [0x101a2318], edx
mov eax, dword [0x101a23e0]
and eax, dword [0x101a2308]
mov dword [0x1047eb58], eax
mov ecx, dword [0x101a2384]
sub ecx, dword [0x101a2324]
mov dword [0x101a2368], ecx
mov edx, dword [0x101a2388]
imul edx, dword [0x1047eaf0]
mov dword [0x1047eb54], edx
mov eax, dword [0x1047eb88]
and eax, dword [0x101a22f8]
mov dword [0x101a2398], eax
mov ecx, dword [0x1047eb6c]
imul ecx, dword [0x1047eb48]
mov dword [0x101a233c], ecx
mov edx, dword [0x1047eafc]
imul edx, dword [0x101a2350]
mov dword [0x1047eb08], edx
xor eax, eax
jmp 0x1000753e
pop ebp
ret

Function at 0x10007540
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1047eb64]
and eax, dword [0x101a238c]
mov dword [0x101a23cc], eax
mov ecx, dword [0x1047eb08]
imul ecx, dword [0x1047eb48]
mov dword [0x101a23d0], ecx
mov edx, dword [0x101a23d0]
add edx, dword [0x101a23d8]
mov dword [0x1047eb20], edx
mov eax, dword [0x1047ebb8]
add eax, dword [0x101a22ec]
mov dword [0x1047ebb8], eax
mov ecx, dword [0x1047eb18]
and ecx, dword [0x1047eb94]
mov dword [0x1047eb78], ecx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov edx, dword [0x101a2394]
add edx, dword [0x101a2320]
mov dword [0x101a23e0], edx
mov eax, dword [0x1047eafc]
imul eax, dword [0x101a2384]
mov dword [0x101a23b0], eax
mov ecx, dword [0x101a2398]
add ecx, dword [0x101a2304]
mov dword [0x101a23d0], ecx
push 0
call fcn.1012b5f8
mov edx, dword [0x101a2310]
sub edx, dword [0x101a234c]
mov dword [0x1047eb6c], edx
mov eax, dword [0x101a2324]
add eax, dword [0x101a235c]
mov dword [0x101a22f4], eax
xor eax, eax
jmp 0x1000764f
pop ebp
ret
Function at 0x10007660
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101a22f4]
sub eax, dword [0x101a23c0]
mov dword [0x101a22f0], eax
mov ecx, dword [0x1047eb90]
imul ecx, dword [0x1047eb80]
mov dword [0x1047eb70], ecx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov edx, dword [0x1047eb40]
add edx, dword [0x101a239c]
mov dword [0x101a238c], edx
push 0
call fcn.1012b5f8
mov eax, dword [0x101a237c]
and eax, dword [0x1047eb48]
mov dword [0x1047eb8c], eax
xor eax, eax
jmp 0x1000772a
pop ebp
ret

Function at 0x10007730
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101a239c]
add eax, dword [0x101a2304]
mov dword [0x1047eb4c], eax
mov ecx, dword [0x101a2304]
imul ecx, dword [0x1047eb44]
mov dword [0x1047ebb4], ecx
mov edx, dword [0x101a23e0]
imul edx, dword [0x1047eb6c]
mov dword [0x1047eb00], edx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov eax, dword [0x101a2308]
imul eax, dword [0x1047eb0c]
mov dword [0x101a23c8], eax
mov ecx, dword [0x1047eb40]
add ecx, dword [0x1047eb54]
mov dword [0x101a2340], ecx
mov edx, dword [0x1047eb2c]
imul edx, dword [0x101a23a0]
mov dword [0x1047eaf0], edx
mov eax, dword [0x1047ebb0]
imul eax, dword [0x1047eb6c]
mov dword [0x101a23c8], eax
mov ecx, dword [0x101a2328]
sub ecx, dword [0x101a23a8]
mov dword [0x1047eb60], ecx
mov edx, dword [0x101a2320]
and edx, dword [0x1047eb60]
mov dword [0x101a23ec], edx
mov eax, dword [0x1047eb24]
imul eax, dword [0x101a233c]
mov dword [0x1047eb3c], eax
push 0
call fcn.1012b5f8
mov ecx, dword [0x101a23c8]
sub ecx, dword [0x1047eb58]
mov dword [0x1047eb54], ecx
mov edx, dword [0x1047eb24]
add edx, dword [0x101a2350]
mov dword [0x101a23e8], edx
mov eax, dword [0x101a2340]
imul eax, dword [0x101a2364]
mov dword [0x1047eb1c], eax
mov ecx, dword [0x1047eb48]
imul ecx, dword [0x101a235c]
mov dword [0x1047eb04], ecx
xor eax, eax
jmp 0x100078af
pop ebp
ret
Function at 0x100078c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1047eb68]
add eax, dword [0x1047eb9c]
mov dword [0x101a22f0], eax
mov ecx, dword [0x101a2340]
and ecx, dword [0x101a23e4]
mov dword [0x1047eb00], ecx
mov edx, dword [0x1047eb6c]
add edx, dword [0x101a22ec]
mov dword [0x101a23d4], edx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov eax, dword [0x101a23ec]
sub eax, dword [0x101a23e8]
mov dword [0x1047eba4], eax
mov ecx, dword [0x1047eb20]
sub ecx, dword [0x1047eb7c]
mov dword [0x101a23b8], ecx
mov edx, dword [0x1047eb40]
and edx, dword [0x101a23b4]
mov dword [0x101a2384], edx
mov eax, dword [0x1047eb04]
sub eax, dword [0x1047eb28]
mov dword [0x101a231c], eax
mov ecx, dword [0x101a2330]
sub ecx, dword [0x1047eaf0]
mov dword [0x1047eb1c], ecx
push 0
call fcn.1012b5f8
mov edx, dword [0x101a23c0]
imul edx, dword [0x1047eb84]
mov dword [0x1047eb60], edx
mov eax, dword [0x101a23b4]
imul eax, dword [0x101a2300]
mov dword [0x101a23c4], eax
mov ecx, dword [0x101a23a0]
sub ecx, dword [0x1047eb04]
mov dword [0x1047eb2c], ecx
mov edx, dword [0x1047eb68]
add edx, dword [0x101a2398]
mov dword [0x1047eb44], edx
mov eax, dword [0x1047ebb4]
sub eax, dword [0x101a22e8]
mov dword [0x101a23b0], eax
mov ecx, dword [0x101a2360]
imul ecx, dword [0x1047eb14]
mov dword [0x101a2394], ecx
mov edx, dword [0x101a2304]
and edx, dword [0x101a2328]
mov dword [0x1047eb34], edx
xor eax, eax
jmp 0x10007a3a
pop ebp
ret

Function at 0x10007a40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1047eb3c]
add eax, dword [0x101a2324]
mov dword [0x1047eb5c], eax
mov ecx, dword [0x101a2320]
and ecx, dword [0x101a2398]
mov dword [0x101a23cc], ecx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov edx, dword [0x1047eb78]
add edx, dword [0x101a2344]
mov dword [0x1047ebb0], edx
mov eax, dword [0x1047eb30]
imul eax, dword [0x101a2338]
mov dword [0x1047eb78], eax
mov ecx, dword [0x1047eb24]
imul ecx, dword [0x101a236c]
mov dword [0x101a22f0], ecx
mov edx, dword [0x101a22ec]
imul edx, dword [0x1047eb4c]
mov dword [0x101a23e8], edx
push 0
call fcn.1012b5f8
mov eax, dword [0x101a2370]
sub eax, dword [0x101a235c]
mov dword [0x1047eb08], eax
mov ecx, dword [0x101a238c]
sub ecx, dword [0x101a2318]
mov dword [0x1047eb2c], ecx
mov edx, dword [0x101a230c]
imul edx, dword [0x101a23b8]
mov dword [0x101a2338], edx
mov eax, dword [0x101a2334]
and eax, dword [0x1047eb74]
mov dword [0x101a2398], eax
mov ecx, dword [0x101a2328]
add ecx, dword [0x101a23d4]
mov dword [0x101a22fc], ecx
mov edx, dword [0x1047eb90]
add edx, dword [0x1047eb54]
mov dword [0x101a236c], edx
mov eax, dword [0x101a23c4]
imul eax, dword [0x101a2358]
mov dword [0x1047eb24], eax
mov ecx, dword [0x1047eb64]
sub ecx, dword [0x101a2370]
mov dword [0x101a2354], ecx
mov edx, dword [0x101a23e4]
add edx, dword [0x101a2304]
mov dword [0x101a2304], edx
xor eax, eax
jmp 0x10007b87
pop ebp
ret
Function at 0x10007b90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101a231c]
imul eax, dword [0x101a23e0]
mov dword [0x101a2388], eax
mov ecx, dword [0x1047eb5c]
imul ecx, dword [0x101a2360]
mov dword [0x101a237c], ecx
mov edx, dword [0x101a23bc]
and edx, dword [0x1047eb14]
mov dword [0x101a2384], edx
mov eax, dword [0x101a2324]
imul eax, dword [0x1047eb6c]
mov dword [0x1047ebb4], eax
push str.fuckyou
call fcn.10005b10
add esp, 4
mov ecx, dword [0x1047eaf0]
and ecx, dword [0x101a2390]
mov dword [0x101a2370], ecx
push 0
call fcn.1012b5f8
mov edx, dword [0x1047eb80]
and edx, dword [0x1047eb10]
mov dword [0x1047eb98], edx
mov eax, dword [0x101a2380]
imul eax, dword [0x1047eb98]
mov dword [0x101a23a4], eax
mov ecx, dword [0x1047ebac]
and ecx, dword [0x1047eb78]
mov dword [0x101a235c], ecx
mov edx, dword [0x1047eba4]
and edx, dword [0x101a2310]
mov dword [0x101a23e4], edx
mov eax, dword [0x1047ebb0]
sub eax, dword [0x101a2378]
mov dword [0x1047eb10], eax
xor eax, eax
jmp 0x10007c7f
pop ebp
ret

Function at 0x10007c90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101a23a8]
sub eax, dword [0x101a23bc]
mov dword [0x1047eb94], eax
mov ecx, dword [0x101a2370]
add ecx, dword [0x1047eb20]
mov dword [0x1047eb04], ecx
mov edx, dword [0x1047eb60]
add edx, dword [0x1047eb24]
mov dword [0x1047eb18], edx
mov eax, dword [0x101a2390]
imul eax, dword [0x101a230c]
mov dword [0x101a2344], eax
mov ecx, dword [0x1047eba8]
and ecx, dword [0x1047eb18]
mov dword [0x101a23e0], ecx
mov edx, dword [0x101a2380]
sub edx, dword [0x101a2308]
mov dword [0x101a23e4], edx
mov eax, dword [0x101a2390]
sub eax, dword [0x101a2388]
mov dword [0x101a23b0], eax
mov ecx, dword [0x101a232c]
sub ecx, dword [0x101a2314]
mov dword [0x101a239c], ecx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov edx, dword [0x1047eb60]
sub edx, dword [0x1047eb58]
mov dword [0x1047eb40], edx
mov eax, dword [0x1047eb04]
sub eax, dword [0x101a23d0]
mov dword [0x101a231c], eax
mov ecx, dword [0x101a2304]
and ecx, dword [0x1047eb74]
mov dword [0x101a23e8], ecx
mov edx, dword [0x101a2388]
imul edx, dword [0x101a2300]
mov dword [0x101a2358], edx
mov eax, dword [0x1047eb04]
add eax, dword [0x101a2304]
mov dword [0x101a2380], eax
mov ecx, dword [0x101a23ac]
sub ecx, dword [0x101a2334]
mov dword [0x101a22f0], ecx
mov edx, dword [0x1047ebb4]
and edx, dword [0x1047eb68]
mov dword [0x101a22e8], edx
mov eax, dword [0x1047eb8c]
imul eax, dword [0x101a2308]
mov dword [0x101a238c], eax
mov ecx, dword [0x1047eb50]
imul ecx, dword [0x101a22f0]
mov dword [0x101a2370], ecx
push 0
call fcn.1012b5f8
mov edx, dword [0x1047ebb0]
add edx, dword [0x1047eb90]
mov dword [0x1047ebb4], edx
mov eax, dword [0x101a23ec]
add eax, dword [0x1047eb68]
mov dword [0x101a230c], eax
mov ecx, dword [0x1047eb44]
sub ecx, dword [0x1047eaf8]
mov dword [0x101a2334], ecx
xor eax, eax
jmp 0x10007e84
pop ebp
ret
Function at 0x10007e90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101a238c]
sub eax, dword [0x101a22fc]
mov dword [0x1047eb24], eax
mov ecx, dword [0x101a2344]
add ecx, dword [0x1047eb38]
mov dword [0x1047eb48], ecx
mov edx, dword [0x101a23e8]
add edx, dword [0x101a23e0]
mov dword [0x1047eb84], edx
mov eax, dword [0x101a2364]
imul eax, dword [0x1047eb80]
mov dword [0x1047eb04], eax
mov ecx, dword [0x101a2314]
add ecx, dword [0x101a2378]
mov dword [0x1047eb74], ecx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov edx, dword [0x1047ebb4]
and edx, dword [0x101a23bc]
mov dword [0x1047eba0], edx
push 0
call fcn.1012b5f8
mov eax, dword [0x101a22f4]
sub eax, dword [0x1047eb80]
mov dword [0x101a2398], eax
mov ecx, dword [0x101a2338]
imul ecx, dword [0x1047eb54]
mov dword [0x101a23c0], ecx
mov edx, dword [0x101a2328]
add edx, dword [0x101a23f0]
mov dword [0x101a23b4], edx
mov eax, dword [0x101a2340]
add eax, dword [0x101a23ac]
mov dword [0x1047eb78], eax
mov ecx, dword [0x101a23cc]
add ecx, dword [0x101a23b0]
mov dword [0x1047eb78], ecx
mov edx, dword [0x101a238c]
imul edx, dword [0x1047eb34]
mov dword [0x101a23ac], edx
mov eax, dword [0x101a234c]
and eax, dword [0x1047eb88]
mov dword [0x1047eb40], eax
mov ecx, dword [0x101a2374]
imul ecx, dword [0x1047eb98]
mov dword [0x101a22ec], ecx
xor eax, eax
jmp 0x10007ff8
pop ebp
ret

Function at 0x10008000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1047eb58]
and eax, dword [0x101a234c]
mov dword [0x101a23d0], eax
mov ecx, dword [0x101a2390]
sub ecx, dword [0x101a23c8]
mov dword [0x101a2384], ecx
mov edx, dword [0x1047eaf8]
imul edx, dword [0x101a2324]
mov dword [0x101a2344], edx
mov eax, dword [0x101a23bc]
and eax, dword [0x101a2308]
mov dword [0x101a2344], eax
mov ecx, dword [0x1047eb8c]
sub ecx, dword [0x101a23b8]
mov dword [0x101a23ac], ecx
mov edx, dword [0x101a2364]
sub edx, dword [0x1047eb88]
mov dword [0x1047eb40], edx
mov eax, dword [0x1047eb1c]
and eax, dword [0x1047eb70]
mov dword [0x1047eafc], eax
push str.fuckyou
call fcn.10005b10
add esp, 4
mov ecx, dword [0x1047eb98]
sub ecx, dword [0x1047eb88]
mov dword [0x101a2370], ecx
mov edx, dword [0x101a22f4]
sub edx, dword [0x1047ebac]
mov dword [0x1047eb70], edx
mov eax, dword [0x1047eb80]
add eax, dword [0x1047eb14]
mov dword [0x101a23c4], eax
mov ecx, dword [0x101a2390]
sub ecx, dword [0x101a2310]
mov dword [0x1047eb34], ecx
push 0
call fcn.1012b5f8
mov edx, dword [0x1047eb84]
sub edx, dword [0x1047ebb4]
mov dword [0x1047eaf8], edx
mov eax, dword [0x101a2314]
add eax, dword [0x101a23d8]
mov dword [0x101a2310], eax
xor eax, eax
jmp 0x10008165
pop ebp
ret
Function at 0x10008170
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1047eb30]
imul eax, dword [0x101a2348]
mov dword [0x101a2334], eax
mov ecx, dword [0x101a2390]
and ecx, dword [0x101a2340]
mov dword [0x1047eb34], ecx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov edx, dword [0x1047eb08]
and edx, dword [0x1047eaf0]
mov dword [0x101a22fc], edx
mov eax, dword [0x101a2328]
sub eax, dword [0x101a2360]
mov dword [0x1047eb70], eax
mov ecx, dword [0x1047eb1c]
sub ecx, dword [0x101a23d8]
mov dword [0x1047eb08], ecx
push 0
call fcn.1012b5f8
mov edx, dword [0x101a233c]
imul edx, dword [0x1047eb0c]
mov dword [0x1047eb6c], edx
mov eax, dword [0x101a236c]
imul eax, dword [0x1047eb68]
mov dword [0x1047eb60], eax
mov ecx, dword [0x1047eb2c]
imul ecx, dword [0x101a2384]
mov dword [0x1047eb70], ecx
mov edx, dword [0x101a237c]
imul edx, dword [0x1047eb90]
mov dword [0x1047ebb0], edx
mov eax, dword [0x101a23b8]
imul eax, dword [0x1047eb78]
mov dword [0x1047eb28], eax
xor eax, eax
jmp 0x100082ba
pop ebp
ret

Function at 0x100082c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101a2360]
sub eax, dword [0x101a2374]
mov dword [0x101a23ec], eax
mov ecx, dword [0x1047eb58]
and ecx, dword [0x101a22f0]
mov dword [0x1047eaf0], ecx
mov edx, dword [0x1047eb50]
sub edx, dword [0x1047eaf4]
mov dword [0x101a232c], edx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov eax, dword [0x101a230c]
add eax, dword [0x101a2340]
mov dword [0x101a2390], eax
mov ecx, dword [0x101a239c]
imul ecx, dword [0x101a23a4]
mov dword [0x101a2388], ecx
mov edx, dword [0x101a23e4]
add edx, dword [0x1047eb0c]
mov dword [0x101a2308], edx
mov eax, dword [0x1047eb68]
imul eax, dword [0x101a2344]
mov dword [0x101a2308], eax
mov ecx, dword [0x101a23a8]
add ecx, dword [0x101a23dc]
mov dword [0x101a22f0], ecx
mov edx, dword [0x1047eb6c]
and edx, dword [0x101a23c0]
mov dword [0x1047ebac], edx
mov eax, dword [0x1047eb70]
imul eax, dword [0x101a22f4]
mov dword [0x101a235c], eax
mov ecx, dword [0x1047eb80]
add ecx, dword [0x101a2370]
mov dword [0x101a231c], ecx
push 0
call fcn.1012b5f8
mov edx, dword [0x1047eb0c]
sub edx, dword [0x101a2354]
mov dword [0x1047eb8c], edx
mov eax, dword [0x101a2364]
and eax, dword [0x1047eb70]
mov dword [0x101a23c8], eax
mov ecx, dword [0x101a2300]
imul ecx, dword [0x101a236c]
mov dword [0x101a2364], ecx
mov edx, dword [0x101a2304]
and edx, dword [0x101a23e0]
mov dword [0x1047ebb0], edx
xor eax, eax
jmp 0x10008417
pop ebp
ret
Function at 0x10008420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1047eaf4]
add eax, dword [0x1047eb60]
mov dword [0x101a23dc], eax
mov ecx, dword [0x101a22f0]
and ecx, dword [0x1047eb30]
mov dword [0x101a23d4], ecx
push str.fuckyou
call fcn.10005b10
add esp, 4
mov edx, dword [0x1047eb70]
sub edx, dword [0x1047eb50]
mov dword [0x101a23c8], edx
mov eax, dword [0x101a2330]
sub eax, dword [0x101a2328]
mov dword [0x101a2310], eax
mov ecx, dword [0x101a2334]
add ecx, dword [0x101a23b8]
mov dword [0x1047eb9c], ecx
mov edx, dword [0x1047eb8c]
imul edx, dword [0x1047eb6c]
mov dword [0x101a235c], edx
mov eax, dword [0x101a2310]
sub eax, dword [0x1047eb08]
mov dword [0x1047eb08], eax
mov ecx, dword [0x1047eb08]
add ecx, dword [0x1047eb1c]
mov dword [0x101a230c], ecx
mov edx, dword [0x1047eb04]
and edx, dword [0x101a2304]
mov dword [0x1047eb5c], edx
push 0
call fcn.1012b5f8
mov eax, dword [0x101a23c8]
imul eax, dword [0x1047eb30]
mov dword [0x1047eba4], eax
xor eax, eax
jmp 0x10008565
pop ebp
ret

Function at 0x10008570
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1047eaf8]
sub eax, dword [0x1047eb0c]
mov dword [0x101a22f8], eax
mov ecx, dword [0x101a237c]
and ecx, dword [0x1047eb78]
mov dword [0x1047eb64], ecx
mov edx, dword [0x101a22f0]
imul edx, dword [0x101a2354]
mov dword [0x1047eb18], edx
mov eax, dword [0x1047eb44]
add eax, dword [0x1047eb14]
mov dword [0x1047eb98], eax
mov ecx, dword [0x101a23d4]
and ecx, dword [0x101a22f4]
mov dword [0x101a2370], ecx
mov edx, dword [0x1047eb40]
sub edx, dword [0x1047eb24]
mov dword [0x1047eb14], edx
mov eax, dword [0x1047eb44]
add eax, dword [0x1047eb10]
mov dword [0x101a22f0], eax
push str.fuckyou
call fcn.10005b10
add esp, 4
mov ecx, dword [0x1047eb1c]
and ecx, dword [0x1047eb48]
mov dword [0x1047eb20], ecx
mov edx, dword [0x101a23d0]
imul edx, dword [0x1047eb10]
mov dword [0x101a23b4], edx
mov eax, dword [0x1047eb00]
sub eax, dword [0x101a2348]
mov dword [0x1047eb24], eax
mov ecx, dword [0x101a2360]
add ecx, dword [0x101a2350]
mov dword [0x1047eb48], ecx
mov edx, dword [0x1047eaf4]
add edx, dword [0x101a23f0]
mov dword [0x101a23f0], edx
mov eax, dword [0x101a23ec]
imul eax, dword [0x1047eb84]
mov dword [0x1047eb88], eax
mov ecx, dword [0x101a235c]
and ecx, dword [0x1047eb78]
mov dword [0x1047eb98], ecx
mov edx, dword [0x101a2390]
imul edx, dword [0x1047eb0c]
mov dword [0x101a2338], edx
push 0
call fcn.1012b5f8
mov eax, dword [0x101a23ec]
sub eax, dword [0x1047eb94]
mov dword [0x1047eb34], eax
mov ecx, dword [0x101a2300]
add ecx, dword [0x1047eb68]
mov dword [0x101a2368], ecx
xor eax, eax
jmp 0x100086e9
pop ebp
ret