joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10043880
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 0x10175a17
call fcn.100b6430
cmp byte [edi], 0
jne 0x100438a0
cmp byte [edi + 0x2c4c], 0
je 0x100438b8
push 0xdda
push 0x100c05b8
push str._g.Initialized___g.SettingsLoaded
call dword [sym.imp.ucrtbased.dll__wassert]
add esp, 0xc
or edx, 0xffffffff
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], str.Window
mov esi, 0x100c18c1
mov al, 0x57
or ebx, 0xffffffff
cmp al, 0x23
jne 0x100438e3
cmp byte [esi], al
jne 0x100438e3
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100c46f0]
test al, al
jne 0x100438d5
mov esi, dword [edi + 0x2c60]
not edx
mov ecx, dword [edi + 0x2c64]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0x10056f00
mov dword [esp + 0x18], 0x10056f60
mov dword [esp + 0x1c], 0x10057060
cmp esi, ecx
jne 0x100439c9
inc esi
test ecx, ecx
je 0x1004393e
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10043943
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x100439c9
mov eax, dword [0x1010713c]
test eax, eax
je 0x1004395b
inc dword [eax + 0x36c]
push dword [0x10168b44]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call dword [0x10103304]
mov ebx, eax
add esp, 8
mov eax, dword [edi + 0x2c68]
test eax, eax
je 0x100439bd
mov ecx, dword [edi + 0x2c60]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call sub.VCRUNTIME140D.dll_memcpy
mov ecx, dword [edi + 0x2c68]
add esp, 0xc
test ecx, ecx
je 0x100439ad
mov eax, dword [0x1010713c]
test eax, eax
je 0x100439ad
dec dword [eax + 0x36c]
push dword [0x10168b44]
push ecx
call dword [0x10103308]
add esp, 8
mov dword [edi + 0x2c68], ebx
mov dword [edi + 0x2c64], esi
mov eax, dword [edi + 0x2c60]
movups xmm0, xmmword [esp + 0xc]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2c68]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [esp + 0x1c]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [edi + 0x2c60]
mov byte [edi], 1
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x100565f0
Capabilities:
Hash data with crc32

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov ebp, ecx
mov ecx, 0x10175a17
push edi
call fcn.100b6430
mov esi, dword [0x1010713c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], 0
mov edi, dword [esi + 0x2c6c]
mov ecx, dword [esi + 0x2c70]
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x28], 0
cmp edi, ecx
jne 0x100566f8
inc edi
test ecx, ecx
je 0x10056662
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10056667
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x100566f8
test esi, esi
je 0x1005667e
inc dword [esi + 0x36c]
push dword [0x10168b44]
lea eax, [edi*8]
sub eax, edi
shl eax, 2
push eax
call dword [0x10103304]
mov ebx, eax
add esp, 8
mov eax, dword [esi + 0x2c74]
test eax, eax
je 0x100566ec
mov ecx, dword [esi + 0x2c6c]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 2
push edx
push eax
push ebx
call sub.VCRUNTIME140D.dll_memcpy
mov ecx, dword [esi + 0x2c74]
add esp, 0xc
test ecx, ecx
je 0x100566dc
mov eax, dword [0x1010713c]
test eax, eax
je 0x100566dc
dec dword [eax + 0x36c]
push dword [0x10168b44]
push ecx
call dword [0x10103308]
add esp, 8
mov dword [esi + 0x2c74], ebx
mov dword [esi + 0x2c70], edi
mov eax, dword [esi + 0x2c6c]
mov ecx, dword [esi + 0x2c74]
movups xmm0, xmmword [esp + 0x10]
lea edx, [eax*8]
sub edx, eax
mov eax, dword [esp + 0x28]
movups xmmword [ecx + edx*4], xmm0
movq xmm0, qword [esp + 0x20]
movq qword [ecx + edx*4 + 0x10], xmm0
mov dword [ecx + edx*4 + 0x18], eax
inc dword [esi + 0x2c6c]
cmp dword [esi + 0x2c6c], 0
jg 0x10056751
push 0x4b7
push 0x100c0510
push str.Size___0
call dword [sym.imp.ucrtbased.dll__wassert]
add esp, 0xc
mov eax, dword [esi + 0x2c6c]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x2c74]
mov esi, ebp
lea edi, [eax + ecx*4]
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x10056770
mov eax, dword [0x1010713c]
sub esi, ecx
test eax, eax
je 0x10056788
inc dword [eax + 0x36c]
push dword [0x10168b44]
inc esi
push esi
call dword [0x10103304]
push esi
push ebp
push eax
call sub.VCRUNTIME140D.dll_memcpy
mov dword [edi - 0x1c], eax
lea esi, [ebp + 1]
mov al, byte [ebp]
add esp, 0x14
or edx, 0xffffffff
test al, al
je 0x100567db
or ebx, 0xffffffff
cmp al, 0x23
jne 0x100567c2
cmp byte [esi], al
jne 0x100567c2
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x100c46f0]
test al, al
jne 0x100567b4
not edx
lea eax, [edi - 0x1c]
mov dword [edi - 0x18], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x10056cf0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, ecx
mov ecx, 0x10175a17
push edi
mov dword [esp + 8], ebx
call fcn.100b6430
mov edi, dword [0x1010713c]
mov dword [edi + 0x2c50], 0
test ebx, ebx
je 0x10056dfd
push esi
lea esi, [edi + 0x2c54]
mov dword [edi + 0x2c50], 0
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x10056d4b
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.1005ba90
mov dword [esi], 0
cmp dword [esi + 4], 0
jne 0x10056d60
push 8
mov ecx, esi
call fcn.1005ba90
mov eax, dword [esi]
xor ebx, ebx
mov ecx, dword [esi + 8]
mov byte [ecx + eax], 0
inc dword [esi]
mov eax, dword [edi + 0x2c60]
test eax, eax
jle 0x10056db8
push ebp
xor ebp, ebp
cmp ebx, eax
jl 0x10056d96
push 0x4ad
push 0x100c0510
push str.i___Size
call dword [sym.imp.ucrtbased.dll__wassert]
add esp, 0xc
mov eax, dword [edi + 0x2c68]
add eax, ebp
push esi
push eax
push edi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [edi + 0x2c60]
inc ebx
add esp, 0xc
add ebp, 0x18
cmp ebx, eax
jl 0x10056d96
pop ebp
mov esi, dword [esi]
mov ebx, 0x10107138
mov ecx, dword [esp + 0xc]
mov edx, 0x100c3cd0
lea eax, [esi - 1]
neg esi
sbb esi, esi
and esi, eax
mov eax, dword [edi + 0x2c5c]
test eax, eax
cmovne ebx, eax
call fcn.1003cc40
mov edi, eax
test edi, edi
je 0x10056dfc
push edi
push esi
push 1
push ebx
call dword [sym.imp.ucrtbased.dll_fwrite]
push edi
call dword [sym.imp.ucrtbased.dll_fclose]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ecx
ret
Function at 0x100616b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov eax, dword [0x10103040]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
mov ecx, 0x1017489e
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], esi
call fcn.100b6430
movq xmm0, qword [esi + 0x70]
mov esi, dword [esi + 0x78]
mov ebp, dword [sym.imp.ucrtbased.dll__wassert]
movq qword [esp + 0x24], xmm0
mov edi, dword [esp + 0x24]
mov dword [esp + 0x10], 0xffffffff
test esi, esi
jns 0x10061718
push 0x46c
push 0x100f30e0
push str.__o___b__size__o___0_
call ebp
add esp, 0xc
mov dword [esp + 0x28], esi
mov eax, esi
jmp 0x10061733
xor eax, eax
mov dword [esp + 0x28], 0
test esi, esi
jle 0x10061733
mov cl, byte [edi]
mov edx, 1
mov eax, edx
test cl, cl
jne 0x10061772
add ebx, eax
cmp ebx, esi
jg 0x1006173d
test ebx, ebx
jns 0x10061751
push 0x46c
push 0x100f30e0
push str.__o___b__size__o___0_
call ebp
add esp, 0xc
cmp ebx, esi
jg 0x10061768
test ebx, ebx
js 0x10061768
cmp ebx, esi
jge 0x10061768
mov al, byte [edi + ebx]
movzx eax, al
jmp 0x10061821
xor al, al
movzx eax, al
jmp 0x10061821
cmp cl, 3
jne 0x10061825
cmp eax, esi
jl 0x10061783
xor al, al
jmp 0x10061787
mov al, byte [edi + edx]
inc edx
movzx ecx, al
cmp edx, esi
jl 0x10061792
xor al, al
jmp 0x10061796
mov al, byte [edi + edx]
inc edx
shl ecx, 8
movzx eax, al
or ecx, eax
mov dword [esp + 0x18], ecx
cmp edx, esi
jl 0x100617aa
xor al, al
jmp 0x100617ae
mov al, byte [edi + edx]
inc edx
movzx ebp, al
cmp edx, esi
jl 0x100617b9
xor al, al
jmp 0x100617bd
mov al, byte [edi + edx]
inc edx
shl ebp, 8
xor ebx, ebx
movzx eax, al
or ebp, eax
test ecx, ecx
je 0x10061825
nop dword [eax + eax]
cmp edx, esi
jl 0x100617d8
xor al, al
jmp 0x100617dc
mov al, byte [edi + edx]
inc edx
movzx eax, al
mov dword [esp + 0x1c], eax
cmp edx, esi
jl 0x100617eb
xor al, al
jmp 0x100617ef
mov al, byte [edi + edx]
inc edx
movzx eax, al
cmp edx, esi
jl 0x100617fa
xor cl, cl
jmp 0x100617fe
mov cl, byte [edi + edx]
inc edx
shl eax, 8
movzx ecx, cl
or eax, ecx
mov ecx, dword [esp + 0x14]
cmp ecx, ebp
jl 0x10061812
cmp ecx, eax
jl 0x1006181d
inc ebx
mov ebp, eax
cmp ebx, dword [esp + 0x18]
jl 0x100617d0
jmp 0x10061825
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x20]
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
mov edx, esp
movq xmm0, qword [ebx + 0x64]
mov eax, dword [ebx + 0x6c]
movq qword [edx], xmm0
mov dword [edx + 8], eax
lea eax, [esp + 0x30]
push eax
call fcn.1005f550
add esp, 4
mov ecx, esp
sub esp, 0xc
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ecx], xmm0
movq xmm0, qword [ebx + 0x34]
mov dword [ecx + 8], eax
mov ecx, esp
mov eax, dword [ebx + 0x3c]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea eax, [esp + 0x48]
push eax
call fcn.1005fa20
mov edx, dword [esp + 0x60]
add esp, 0x1c
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop edi
pop esi
movq qword [edx], xmm0
mov dword [edx + 8], ecx
mov ecx, dword [esp + 0x34]
pop ebp
pop ebx
xor ecx, esp
call fcn.100b3fd0
add esp, 0x30
ret
Function at 0x1006f0b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, 0x10175a17
call fcn.100b6430
mov ecx, edi
call fcn.1006eeb0
mov ecx, dword [edi + 0x40]
xor eax, eax
mov ebp, dword [sym.imp.ucrtbased.dll__wassert]
mov dword [esp + 0x14], eax
test ecx, ecx
jle 0x1006f23a
xor esi, esi
mov dword [esp + 0x18], esi
cmp eax, ecx
jl 0x1006f103
push 0x4ad
push 0x100c0510
push str.i___Size
call ebp
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ebx, dword [edi + 0x48]
add ebx, esi
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x1006f223
cmp dword [ebx], 0x10000
ja 0x1006f223
cmp dword [ecx + 0x38], edi
je 0x1006f138
push 0x857
push 0x100f3618
push str.r.Font__ContainerAtlas__atlas
call ebp
add esp, 0xc
cmp dword [edi + 0x1c], 0
jle 0x1006f144
cmp dword [edi + 0x20], 0
jg 0x1006f158
push 0x6a1
push 0x100f3618
push str.TexWidth___0__TexHeight___0
call ebp
add esp, 0xc
mov eax, 0xffff
cmp word [ebx + 8], ax
jne 0x1006f177
push 0x6a2
push 0x100f3618
push str.rect__IsPacked__
call ebp
add esp, 0xc
movzx eax, word [ebx + 8]
sub esp, 0x1c
movzx esi, word [ebx + 4]
movzx ecx, word [ebx + 0xa]
movzx edx, word [ebx + 6]
movss xmm0, dword [ebx + 0xc]
movd xmm6, eax
add eax, esi
movss dword [esp + 0x18], xmm0
movd xmm3, ecx
cvtdq2ps xmm3, xmm3
movd xmm2, eax
lea eax, [edx + ecx]
mulss xmm3, dword [edi + 0x28]
mov ecx, dword [ebx + 0x18]
movd xmm1, eax
movzx eax, word [ebx]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
mulss xmm2, dword [edi + 0x24]
mulss xmm1, dword [edi + 0x28]
movd xmm0, edx
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm6, xmm6
addss xmm0, dword [ebx + 0x14]
mulss xmm6, dword [edi + 0x24]
movss dword [esp + 0x14], xmm1
movss dword [esp + 0x10], xmm2
movss xmm2, dword [ebx + 0x10]
movss dword [esp + 0xc], xmm3
movss xmm3, dword [ebx + 0x14]
movss dword [esp + 8], xmm6
movss dword [esp + 4], xmm0
movd xmm0, esi
cvtdq2ps xmm0, xmm0
addss xmm0, dword [ebx + 0x10]
movss dword [esp], xmm0
push eax
call fcn.1006fe80
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ecx, dword [edi + 0x40]
inc eax
add esi, 0x1c
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
cmp eax, ecx
jl 0x1006f103
mov ecx, dword [edi + 0x34]
xor esi, esi
test ecx, ecx
jle 0x1006f295
cmp esi, ecx
jl 0x1006f25e
push 0x4ad
push 0x100c0510
push str.i___Size
call ebp
mov ecx, dword [edi + 0x34]
add esp, 0xc
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + esi*4]
cmp byte [eax + 0x54], 0
je 0x1006f28d
cmp esi, ecx
jl 0x1006f282
push 0x4ad
push 0x100c0510
push str.i___Size
call ebp
add esp, 0xc
mov ecx, dword [edi + 0x3c]
mov ecx, dword [ecx + esi*4]
call fcn.1006f980
mov ecx, dword [edi + 0x34]
inc esi
cmp esi, ecx
jl 0x1006f25e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10071df0
Capabilities:
Compute adler32 checksum

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ecx, 0x10175a17
mov edi, edx
call fcn.100b6430
mov ebx, dword [esp + 0x20]
mov eax, 0x5e6ea9af
mul ebx
xor esi, esi
mov ecx, 1
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebx
sub edx, eax
mov dword [esp + 0xc], edx
test ebx, ebx
je 0x10071f1e
push ebp
nop
xor ebx, ebx
cmp edx, 7
jbe 0x10071e8c
mov ebp, 7
sub ebp, edi
nop
movzx eax, byte [edi]
add ebx, 8
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add edi, 8
add esi, ecx
add ecx, eax
add esi, ecx
lea eax, [edi + ebp]
cmp eax, edx
jb 0x10071e40
xor ebp, ebp
cmp ebx, edx
jae 0x10071ee2
mov eax, edx
sub eax, ebx
cmp eax, 2
jb 0x10071ed3
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, ebp
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add ebp, ecx
add edi, 2
add ecx, eax
add ebx, ecx
sub edx, 1
jne 0x10071eb0
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x10]
jae 0x10071edd
jmp 0x10071ed5
mov ebx, ebp
movzx eax, byte [edi]
add ecx, eax
add esi, ecx
inc edi
lea eax, [ebx + ebp]
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, dword [esp + 0x10]
add esi, eax
sub dword [esp + 0x24], edx
mov edx, 0x15b0
mov dword [esp + 0x10], edx
jne 0x10071e30
pop ebp
shl esi, 0x10
pop edi
lea eax, [ecx + esi]
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x1007d4a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov eax, dword [0x10103040]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x68]
push ebx
push ebp
mov ebp, dword [esp + 0x78]
mov ebx, ecx
push esi
push edi
mov edi, dword [esp + 0x84]
mov ecx, 0x10175a17
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebp
call fcn.100b6430
mov eax, dword [0x1010713c]
mov dword [esp + 0x18], eax
cmp dword [eax + 0x2bfc], 0
jne 0x1007d4f0
call fcn.10041040
mov al, byte [edi]
mov esi, edi
test al, al
je 0x1007d50a
cmp al, 0x25
jne 0x1007d502
cmp byte [esi + 1], al
jne 0x1007d50a
inc esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1007d4f8
cmp byte [esi], 0x25
jne 0x1007d54f
mov ecx, esi
call fcn.1007d2f0
cmp byte [eax], 0
jne 0x1007d51f
mov edi, esi
jmp 0x1007d54f
sub eax, esi
mov edi, 0x20
inc eax
cmp eax, edi
cmovb edi, eax
cmp edi, 1
jb 0x1007d54b
jbe 0x1007d546
lea eax, [edi - 1]
push eax
lea eax, [esp + 0x50]
push esi
push eax
call dword [sym.imp.ucrtbased.dll_strncpy]
add esp, 0xc
mov byte [esp + edi + 0x4b], 0
lea edi, [esp + 0x4c]
push edi
push ebp
mov ebp, dword [esp + 0x84]
lea ecx, [esp + 0x34]
push ebp
mov edx, 0x20
call fcn.1007a7f0
add esp, 0xc
lea esi, [esp + 0x2c]
nop
mov al, byte [esi]
cmp al, 0x20
je 0x1007d57a
cmp al, 9
jne 0x1007d57d
inc esi
jmp 0x1007d570
mov edi, esi
test al, al
je 0x1007d5a0
inc esi
cmp byte [esi], 0
jne 0x1007d583
cmp esi, edi
jbe 0x1007d5a0
nop dword [eax]
mov al, byte [esi - 1]
cmp al, 0x20
je 0x1007d59b
cmp al, 9
jne 0x1007d5a0
dec esi
cmp esi, edi
ja 0x1007d590
lea eax, [esp + 0x2c]
cmp edi, eax
je 0x1007d5bb
mov eax, esi
sub eax, edi
push eax
lea eax, [esp + 0x30]
push edi
push eax
call sub.VCRUNTIME140D.dll_memmove
add esp, 0xc
sub esi, edi
mov byte [esp + esi + 0x2c], 0
cmp ebp, 4
je 0x1007d5d1
mov eax, 0x11
cmp ebp, 5
jne 0x1007d5d6
mov eax, 0x20010
movss xmm0, dword [ebx + 8]
lea edx, [esp + 0x2c]
subss xmm0, dword [ebx]
mov ecx, dword [esp + 0x14]
push 0
push 0
push eax
movss dword [esp + 0x30], xmm0
lea eax, [esp + 0x30]
movss xmm0, dword [ebx + 0xc]
subss xmm0, dword [ebx + 4]
push eax
push 0x20
movss dword [esp + 0x3c], xmm0
call fcn.10080c70
mov esi, dword [esp + 0x2c]
add esp, 0x14
mov bl, al
cmp dword [esi + 0x2bfc], 0
jne 0x1007d650
mov eax, dword [esp + 0x1c]
cmp dword [esi + 0x19bc], eax
je 0x1007d644
push 0xa4c
push 0x100f6840
push str.g.ActiveId__id
call dword [sym.imp.ucrtbased.dll__wassert]
add esp, 0xc
mov eax, dword [esi + 0x19bc]
mov dword [esi + 0x2bfc], eax
test bl, bl
je 0x1007d680
mov edx, dword [esi + 0x1d60]
lea ecx, [esp + 0x2c]
push 0
push dword [esp + 0x24]
push ebp
call fcn.1007aa20
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.100b3fd0
add esp, 0x64
ret
mov ecx, dword [esp + 0x6c]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100b3fd0
add esp, 0x64
ret
Function at 0x10098ae0
Capabilities:
Create thread

Disassembly:
mov ecx, 0x10175a17
call fcn.100b6430
mov eax, dword [esp + 8]
sub eax, 0
je 0x10098b21
sub eax, 1
jne 0x10098b19
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push dword [esp + 0xc]
push 0x10098720
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
ret 0xc
cmp dword [esp + 0xc], 0
jne 0x10098b19
call fcn.100988b0
ret 0xc
Function at 0x1009f710
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x24
mov eax, dword [0x10103040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
mov ecx, 0x10174f86
call fcn.100b6430
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1009f81e
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1009f817
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esp + 0x14], 0x10
jb 0x1009f7fb
call ebx
cmp dword [esp + 0x20], eax
jne 0x1009f7fb
call ebp
cmp dword [esp + 0x1c], eax
je 0x1009f7fb
mov edx, dword [esi]
test edx, edx
jne 0x1009f7c3
push 0x200
push edx
push dword [0x10107144]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1009f817
jmp 0x1009f7ee
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1009f7ee
shl eax, 3
push eax
push edx
push 0
push dword [0x10107144]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1009f817
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x1c]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1009f783
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1009f868
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1009f868
mov ebp, dword [esp + 0x38]
nop
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1009f862
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [esp + 0x10]
mov ecx, ebx
push ebp
call fcn.1009f480
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1009f830
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100b3fd0
add esp, 0x24
ret

Function at 0x1009f880
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0x10174f86
call fcn.100b6430
cmp dword [ebx], 0
je 0x1009f8da
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x1009f8c9
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1009f8c1
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x1009f8a2
pop edi
pop ebp
push dword [ebx]
push 0
push dword [0x10107144]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x1009f8e0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
mov eax, dword [0x10103040]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
mov ecx, 0x10174f86
call fcn.100b6430
imul esi, esi, 0x2c
add esi, dword [0x10172cc0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebp, [eax*2 + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1009f94c
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.100b3fd0
add esp, 8
ret
test ebx, ebx
je 0x1009f96d
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1009f98e
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1009f98e
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1009f988
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1009f98e
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [esp + 0x14]
pop edi
mov byte [esi + 0x14], bl
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100b3fd0
add esp, 8
ret