joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100073f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov ebx, edx
mov ebp, ecx
push edi
mov edi, dword [esp + 0x18]
mov esi, ebx
add edi, ebx
mov dword [esp + 0x10], ebx
cmp ebx, edi
jae 0x10007424
lea esp, [esp]
mov cl, byte [esi]
movzx edx, cl
test byte [edx*2 + 0x10052120], 1
je 0x1000743a
inc esi
cmp esi, edi
jb 0x10007410
mov dword [ebp], 0
mov eax, ebp
mov dword [ebp + 4], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, esi
sub eax, ebx
js 0x10007424
mov ax, word [edx*2 + 0x10052120]
shr ax, 0xb
test al, 1
je 0x1000747c
inc esi
mov edx, esi
cmp esi, edi
jae 0x10007424
jmp 0x10007460
mov cl, byte [esi]
movzx eax, cl
test byte [eax*2 + 0x10052120], 1
je 0x10007476
inc esi
cmp esi, edi
jb 0x10007460
jmp 0x10007424
mov eax, esi
sub eax, edx
js 0x10007424
cmp byte [esp + 0x20], 0
je 0x100074b4
inc esi
cmp cl, 0x3a
jne 0x10007424
mov edx, esi
cmp esi, edi
jae 0x10007424
nop
mov cl, byte [esi]
movzx eax, cl
test byte [eax*2 + 0x10052120], 1
je 0x100074a9
inc esi
cmp esi, edi
jb 0x10007490
jmp 0x10007424
mov eax, esi
sub eax, edx
jns 0x100074f3
jmp 0x10007424
cmp cl, 0x2c
jne 0x100074f3
inc esi
mov edx, esi
cmp esi, edi
jae 0x10007424
jmp 0x100074d0
mov cl, byte [esi]
movzx eax, cl
test byte [eax*2 + 0x10052120], 1
je 0x100074e9
inc esi
cmp esi, edi
jb 0x100074d0
jmp 0x10007424
mov eax, esi
sub eax, edx
js 0x10007424
mov al, byte [esp + 0x1c]
xor al, 1
shl al, 5
add al, 0x5b
cmp cl, al
jne 0x10007424
inc esi
mov ebx, 1
mov eax, esi
mov edi, edi
cmp eax, edi
jae 0x10007572
mov dl, byte [eax]
movzx ecx, dl
movzx ecx, word [ecx*2 + 0x10052120]
test ecx, 0x200
je 0x10007543
inc eax
cmp eax, edi
jae 0x10007557
mov edi, edi
mov cl, byte [eax]
cmp cl, dl
je 0x10007557
inc eax
cmp cl, 0x5c
jne 0x1000753d
inc eax
cmp eax, edi
jb 0x10007530
jmp 0x10007557
test ecx, 0x400
je 0x1000754e
inc ebx
jmp 0x10007557
test ecx, 0x800
je 0x10007557
dec ebx
inc eax
test bx, bx
jne 0x10007510
sub eax, esi
dec eax
sub esi, dword [esp + 0x10]
mov dword [ebp + 4], eax
mov eax, ebp
mov dword [ebp], esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
sub esi, dword [esp + 0x10]
pop edi
mov dword [ebp], esi
mov dword [ebp + 4], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10008750
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp byte [esp + 8], 0
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov ebx, ecx
mov esi, edx
mov eax, edi
cmovne esi, ebx
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
test edi, edi
je 0x10008795
sub ebx, edx
mov al, byte [edx]
lea edx, [edx + 1]
xor al, cl
lea esi, [esi + 1]
mov byte [ebx + edx - 1], al
movzx eax, byte [esi - 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub edi, 1
jne 0x10008776
pop edi
pop esi
pop ebx
ret
Function at 0x1000a010
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
xor eax, eax
push esi
push edi
mov esi, edx
mov dword [esp + 0x1c], eax
xor edx, edx
mov word [esp + 0x24], ax
mov dword [esp + 0x20], edx
mov edi, 0x1005bdb0
mov dword [esp + 0x18], edi
mov ebx, ecx
test ebp, ebp
je 0x1000a179
lea ecx, [ebp + 2]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea ecx, [edx*4 + 1]
push ecx
lea ecx, [esp + 0x1c]
call fcn.100035c0
mov edi, dword [esp + 0x18]
test eax, eax
je 0x1000a171
mov eax, 0xaaaaaaab
mov ecx, edi
mul ebp
shr edx, 1
mov dword [esp + 0x14], edx
je 0x1000a0e6
mov ebp, edx
lea ecx, [ecx]
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shr eax, 4
add edx, edx
movzx eax, byte [eax + edx*8 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx edx, byte [esi + 1]
movzx eax, byte [esi + 2]
and edx, 0xf
shr eax, 6
movzx eax, byte [eax + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
movzx eax, byte [esi + 2]
add esi, 3
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], al
add ecx, 4
sub ebp, 1
jne 0x1000a080
mov ebp, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
lea eax, [edx + edx*2]
sub ebp, eax
je 0x1000a13f
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx edx, byte [esi]
and edx, 3
shl edx, 4
cmp ebp, 1
jne 0x1000a116
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov dl, 0x3d
mov byte [ecx + 1], al
jmp 0x1000a135
movzx eax, byte [esi + 1]
shr eax, 4
mov al, byte [eax + edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
and eax, 0xf
mov dl, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
add ecx, 4
mov eax, dword [esp + 0x1c]
sub ecx, edi
mov edx, dword [esp + 0x20]
test eax, eax
je 0x1000a155
cmp ecx, eax
sbb esi, esi
neg esi
jmp 0x1000a165
test edx, edx
je 0x1000a15e
lea esi, [edx - 1]
jmp 0x1000a160
xor esi, esi
cmp esi, ecx
sbb esi, esi
inc esi
test esi, esi
je 0x1000a179
mov eax, ecx
mov byte [ecx + edi], 0
jmp 0x1000a179
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], eax
mov al, byte [esp + 0x20]
pop esi
mov byte [ebx + 0xc], al
mov eax, ebx
pop ebp
mov byte [ebx + 0xd], 0
mov dword [ebx + 8], edx
pop ebx
add esp, 0x18
ret

Function at 0x1000a600
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov bl, al
lea edi, [ecx + eax]
xor bl, 0x15
mov esi, edx
cmp ecx, edi
jae 0x1000a627
sub esi, ecx
mov dl, byte [ecx]
mov al, dl
xor al, bl
mov bl, dl
mov byte [esi + ecx], al
inc ecx
cmp ecx, edi
jb 0x1000a617
pop edi
pop esi
pop ebx
ret
Function at 0x1000fd80
Capabilities:
Check mutex on windows
Create thread
Resume thread

Disassembly:
push esi
push str.LocalIDMEventMonitor
push 1
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x1b40], eax
test eax, eax
je 0x1000fe4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000fdc7
push dword [esi + 0x1b40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1b40], 0
xor al, al
pop esi
ret
mov ecx, esi
call fcn.10010870
test al, al
je 0x1000fe45
push 1
mov ecx, esi
call fcn.100123a0
test al, al
je 0x1000fe45
lea eax, [esi + 0x1b30]
mov dword [0x1005be08], esi
push eax
push 4
push esi
push 0x1000ff60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1b38], eax
test eax, eax
je 0x1000fe3b
lea eax, [esi + 0x1b34]
push eax
push 4
push esi
push 0x100117b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [esi + 0x1b38]
mov dword [esi + 0x1b3c], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 1
setbe al
pop esi
ret
mov dword [0x1005be08], 0
push 0
mov ecx, esi
call fcn.100109a0
xor al, al
pop esi
ret

Function at 0x1000fe60
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea eax, [edi + 0x1b38]
xchg dword [eax], esi
test esi, esi
je 0x1000ff55
xor ebx, ebx
lea eax, [edi + 0x1b3c]
xchg dword [eax], ebx
test ebx, ebx
je 0x1000fed8
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1000fed8
cmp dword [esp + 0xc], 0x103
jne 0x1000fed8
push 0
push 0
push 0x10
push dword [edi + 0x1b34]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
je 0x1000fecc
push 0x1388
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000fed8
push 0x42b
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 0x1b30], eax
jne 0x1000ff01
push esi
mov ecx, edi
call fcn.100109a0
push ecx
mov ecx, edi
call fcn.1000eb00
push 0x4c7
call dword [sym.imp.KERNEL32.dll_ExitThread]
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1000ff4d
cmp dword [esp + 0xc], 0x103
jne 0x1000ff4d
push 0
push 0
push 0x10
push dword [edi + 0x1b30]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
je 0x1000ff41
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000ff55
push 0x42b
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
mov ecx, edi
call fcn.100109a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fff0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c38]
cmp eax, 0xffffffff
je 0x100100a6
push 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0x10
push ecx
push eax
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 0x100007f
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x1001008a
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push dword [esi + 0x1c38]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x1001008a
push 0x28
push dword [esi + 0x1c3c]
push dword [esi + 0x1c38]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push closesocket
push dword [esi + 0x1c38]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1001008a
push dword [esp + 0xa]
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esi + 4], ax
mov al, 1
pop esi
add esp, 0x18
ret
push dword [esi + 0x1c38]
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov dword [esi + 0x1c38], 0xffffffff
mov word [esi + 4], ax
xor al, al
pop esi
add esp, 0x18
ret

Function at 0x100100b0
Capabilities:
Connect pipe
Create pipe

Disassembly:
push edi
push 0
push 0xea60
push 0x20000
push 0x1000
push 0xff
mov edi, ecx
call fcn.100060e0
cmp eax, 0x6000000
sbb eax, eax
and eax, 0xfffffff8
add eax, 8
push eax
push 0x40000003
lea eax, [edi + 6]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov dword [edi + 0x1c40], eax
cmp eax, 0xffffffff
je 0x1001012c
mov ecx, dword [edi + 0x1c58]
push esi
mov dword [edi + 0x1c54], ecx
lea ecx, [edi + 0x1c44]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
pop esi
jne 0x10010130
cmp eax, 0x217
je 0x10010130
cmp eax, 0x3e5
je 0x1001013c
xor al, al
pop edi
ret
push dword [edi + 0x1c58]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
pop edi
ret
Function at 0x10010870
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x194
push esi
push edi
mov esi, ecx
call fcn.100060e0
test eax, eax
je 0x10010991
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x10010991
push dword [esi]
lea eax, [esi + 6]
push str..pipeIDMNetworkMonitor._u
push 0x40
push eax
call fcn.1000f480
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 0x10
push 0
push 0
push 1
push 0
call edi
mov dword [esi + 0x1b44], eax
test eax, eax
je 0x10010991
push 0
push 0
push 1
push 0
call edi
mov dword [esi + 0x1b48], eax
test eax, eax
je 0x10010991
push 0
push 0
push 1
push 0
call edi
mov dword [esi + 0x1c2c], eax
test eax, eax
je 0x10010991
push 0
push 0
push 1
push 0
call edi
mov dword [esi + 0x1c58], eax
test eax, eax
je 0x10010991
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10010991
mov byte [esi + 0x1c34], 1
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [esi + 0x1c3c], eax
test eax, eax
je 0x10010991
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x1c38], eax
cmp eax, 0xffffffff
je 0x10010991
lea ecx, [esi + 0x1b04]
call fcn.1002b390
test al, al
je 0x10010991
push ecx
mov ecx, esi
call fcn.10014aa0
mov ecx, dword [0x1005ce4c]
test ecx, ecx
je 0x10010986
lea eax, [esi + 0x1c30]
push eax
push dword [esi + 0x1c2c]
call ecx
mov al, 1
pop edi
pop esi
add esp, 0x194
ret
pop edi
xor al, al
pop esi
add esp, 0x194
ret
Function at 0x10013520
Capabilities:
Get file version info

Disassembly:
sub esp, 0x838
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x12ec], 0
je 0x1001367d
lea eax, [esp + 0x18]
push eax
push dword [esi + 0x12e8]
call dword [sym.imp.msvcrt.dll__wstat64]
add esp, 8
test eax, eax
js 0x1001367d
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
cmp dword [esi + 0x12f8], ecx
jne 0x10013578
cmp dword [esi + 0x12fc], eax
jne 0x10013578
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x838
ret
mov dword [esi + 0x12fc], eax
lea eax, [esp + 0x10]
push eax
push dword [esi + 0x12e8]
mov dword [esi + 0x12f8], ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
mov dword [esp + 0xc], edi
test edi, edi
je 0x1001367d
mov dword [esp + 0x58], 0x7e0
lea eax, [esp + 0x5c]
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], 0x10055250
cmp edi, 0x7e0
jbe 0x100135e2
push edi
call dword [sym.imp.msvcrt.dll_malloc]
xor ecx, ecx
mov dword [esp + 0x58], eax
add esp, 4
test eax, eax
cmovne ecx, edi
mov dword [esp + 0x58], ecx
je 0x1001364a
mov edi, dword [esp + 0xc]
push eax
push edi
push dword [esp + 0x18]
push dword [esi + 0x12e8]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x10013646
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
push 0x10055da4
push dword [esp + 0x60]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x10013646
mov ecx, dword [esp + 0x14]
mov bl, 1
movzx edx, byte [ecx + 0xa]
movzx eax, byte [ecx + 8]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xe]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xc]
shl edx, 8
or edx, eax
mov eax, dword [esp + 0x54]
mov dword [esi + 0x116c], edx
jmp 0x1001364c
mov eax, dword [esp + 0x54]
xor bl, bl
xor ecx, ecx
mov dword [esp + 0x50], 0x100550d0
lea edx, [esp + 0x5c]
cmp eax, edx
cmove eax, ecx
mov dword [esp + 0x54], eax
test eax, eax
je 0x10013671
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
add esp, 0x838
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x838
ret
Function at 0x10013f10
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [ecx + 0x1168]
push edi
lea edi, [ecx + 0x1168]
mov dword [esp + 0x10], 0
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.msvcrt.dll__time64]
add esp, 4
mov dword [edi], eax
cmp eax, esi
jne 0x10013f46
inc eax
mov dword [edi], eax
cmp byte [esp + 0x18], 0
jne 0x10013f51
mov bl, 1
jmp 0x10013fac
lea eax, [esp + 0x10]
push eax
push 4
push 0
push str.SOFTWAREDownloadManager
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10013faa
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 2
push 0
push 0
push 0
push str.ConfigTime
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10013faa
push 4
push edi
push 4
push eax
push eax
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10013faa
mov bl, 1
jmp 0x10013fac
xor bl, bl
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10013fbd
push eax
call esi
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10013fc8
push ecx
call esi
pop edi
pop esi
mov al, bl
pop ebx
add esp, 8
ret 4
Function at 0x10014aa0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
push edi
mov edi, ecx
cmp word [edi + 0x1170], 0
jne 0x10014abd
mov eax, 0x64
mov word [edi + 0x1170], ax
call fcn.100060e0
cmp eax, 0xa000000
jb 0x10014ba0
mov eax, dword [edi + 0x1b50]
lea esi, [edi + 0x1b50]
test eax, eax
je 0x10014aea
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 0
push esi
push 0x20019
push 0
push str.SOFTWAREMicrosoftAccessibility
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10014ba0
mov eax, dword [edi + 0x1b48]
test eax, eax
je 0x10014b23
push 1
push eax
push 4
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 4
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push str.TextScaleFactor
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10014ba0
mov esi, dword [esp + 8]
lea eax, [esi - 0x64]
cmp eax, 0x96
ja 0x10014ba0
movzx eax, word [edi + 0x1170]
cmp esi, eax
je 0x10014ba0
mov eax, dword [edi + 0x1b54]
mov word [edi + 0x1170], si
mov ecx, dword [edi + 0x1b58]
lea ecx, [ecx + ecx*4]
lea ecx, [eax + ecx*4]
cmp eax, ecx
jae 0x10014b96
mov edx, dword [eax + 8]
imul edx, esi
mov dword [eax + 0xc], edx
add eax, 0x14
cmp eax, ecx
jae 0x10014b96
mov esi, dword [esp + 8]
jmp 0x10014b80
pop edi
mov al, 1
pop esi
add esp, 8
ret 4
pop edi
xor al, al
pop esi
add esp, 8
ret 4
Function at 0x100156b0
Capabilities:
Create thread

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
xor ebx, ebx
push eax
push 1
push dword [esi + 0x24]
call edi
mov ebp, dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
lea eax, [esp + 0x2c]
push eax
push 1
push dword [esi + 0x24]
call ebp
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x10]
inc eax
test eax, eax
jle 0x10015803
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 1
push dword [esi + 0x24]
call edi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
cmp ebx, eax
jl 0x1001572a
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 1
push dword [esi + 0x24]
call ebp
mov eax, dword [esp + 0x1c]
mov edx, dword [esi + 0x24]
mov ecx, ebx
sub ecx, eax
mov eax, dword [edx + 0xc]
cmp dword [eax + ecx*4], 0
je 0x100157d9
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 1
push edx
call edi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
cmp ebx, eax
jl 0x10015774
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 1
push dword [esi + 0x24]
call ebp
mov eax, dword [esp + 0x1c]
mov ecx, ebx
sub ecx, eax
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0xc]
push dword [eax + ecx*4]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x100157d9
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 1
push dword [esi + 0x24]
call edi
mov edi, dword [esp + 0x14]
cmp ebx, edi
jl 0x100157b7
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0
push eax
push 1
push dword [esi + 0x24]
call ebp
mov eax, dword [esi + 0x24]
mov ecx, ebx
sub ecx, edi
mov eax, dword [eax + 0xc]
push dword [eax + ecx*4]
lea edi, [eax + ecx*4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov edi, dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
lea eax, [esp + 0x10]
inc ebx
push eax
push 1
push dword [esi + 0x24]
call edi
lea eax, [esp + 0x2c]
push eax
push 1
push dword [esi + 0x24]
call ebp
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x10]
inc eax
cmp ebx, eax
jl 0x100156f2
push 0
push 0
push esi
push 0x10015840
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10015827
or al, 0xff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
mov ecx, 0x9b
call fcn.10039bf0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret 4
Function at 0x1001be90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.msvcrt.dll_malloc]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x14]
mov dword [esi], 0x10055570
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov eax, dword [edi + 0x1c]
mov edx, dword [edi + 0x20]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x28]
mov dword [esp + 0x14], eax
mov word [esi + 0x34], 0x1ff
test ebx, ebx
jle 0x1001bf27
lea eax, [ebx*2 + 0x20]
mov dword [esi + 0x30], eax
add eax, 4
push eax
call ebp
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1001bf04
add ecx, 4
mov dword [esi + 0x28], ecx
test ecx, ecx
je 0x1001bf27
lea eax, [ebx + ebx]
mov dword [esi + 0x2c], ebx
push eax
push dword [esp + 0x18]
xor edx, edx
push ecx
mov word [eax + ecx], dx
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1001bf3c
mov dword [esi + 0x28], 0x1005bdb0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
movzx eax, byte [edi + 0x38]
mov byte [esi + 0x38], al
movzx eax, byte [edi + 0x39]
mov byte [esi + 0x39], al
movzx eax, byte [edi + 0x3a]
mov byte [esi + 0x3a], al
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x48]
mov ecx, dword [edi + 0x4c]
mov dword [esi + 0x48], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x4c], ecx
mov ebx, dword [eax + 4]
mov ecx, dword [eax]
movzx eax, byte [eax + 0xc]
mov dword [esp + 0x14], ecx
mov byte [esi + 0x5c], al
mov byte [esi + 0x5d], 0
test ebx, ebx
jle 0x1001bfaf
lea eax, [ebx + 0x10]
push eax
mov dword [esi + 0x58], eax
call ebp
add esp, 4
mov dword [esi + 0x50], eax
test eax, eax
je 0x1001bfaf
push ebx
push dword [esp + 0x18]
mov dword [esi + 0x54], ebx
push eax
mov byte [eax + ebx], 0
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1001bfc4
mov dword [esi + 0x50], 0x1005bdb0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov eax, dword [edi + 0x60]
mov ebx, dword [edi + 0x64]
mov dword [esp + 0x14], eax
mov al, byte [edi + 0x6c]
mov byte [esi + 0x6c], al
mov byte [esi + 0x6d], 0
test ebx, ebx
jle 0x1001c006
lea eax, [ebx + 0x10]
push eax
mov dword [esi + 0x68], eax
call ebp
add esp, 4
mov dword [esi + 0x60], eax
test eax, eax
je 0x1001c006
push ebx
push dword [esp + 0x18]
mov dword [esi + 0x64], ebx
push eax
mov byte [eax + ebx], 0
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1001c01b
mov dword [esi + 0x60], 0x1005bdb0
mov dword [esi + 0x68], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x70], 0x1005bdb0
mov eax, esi
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov word [esi + 0x7c], 0x100
mov dword [esi + 0x80], 0x1005bdb0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov word [esi + 0x8c], 0xff
pop edi
mov byte [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
pop esi
pop ebp
pop ebx
ret 0xc