joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100390a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10048493
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
push ebx
push esi
push edi
mov eax, dword [0x10058014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov eax, dword [edi + 0x20]
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0xe0], eax
lea eax, [edi + 0x28]
push eax
call fcn.10029da0
mov eax, dword [esi]
mov ecx, dword [esi + 0x1c]
movq xmm0, qword [esi + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x94], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x84], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x80], eax
lea eax, [esi + 0x20]
mov dword [ebp - 0x7c], ecx
lea ecx, [ebp - 0x78]
push eax
movq qword [ebp - 0x90], xmm0
call fcn.1002b090
mov eax, dword [esi + 0x70]
movq xmm0, qword [esi + 0x68]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x74]
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
lea ebx, [edi + 0x1c]
push dword [0x1005c574]
mov edi, dword [edi + 0x18]
mov esi, dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1003916f
cmp dword [eax], esi
je 0x1003918d
mov eax, dword [eax + 8]
test eax, eax
jne 0x10039164
mov esi, dword [ebp - 0x78]
lea eax, [ebp - 0xe0]
mov dword [ebp - 0x1c], eax
cmp byte [esi + 0x400], 0
jne 0x100391a9
mov byte [esi + 0x400], 1
jmp 0x100391b8
cmp dword [eax + 4], 0
je 0x1003916f
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 1
push eax
push eax
call fcn.1003ae00
add esp, 8
jmp 0x10039219
push 0xe8
call fcn.1004234e
add esp, 4
mov esi, eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0xe0]
push eax
lea ecx, [esi + 0x20]
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x1003a9d0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x1c], 0
call fcn.1003acf0
push esi
push ebx
mov ecx, edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call fcn.1000baa0
lea ecx, [ebp - 0xe0]
call fcn.10039ea0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100392c0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x100392da
add ecx, 8
call fcn.10029d00
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x1003931c
push dword [0x1005c5ac]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1003930c
mov edx, dword [eax + 4]
test edx, edx
je 0x1003930c
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x1003931f
inc ecx
cmp ecx, 6
jl 0x10039300
push esi
call fcn.100427ad
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x90]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x10039590
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x100395aa
add ecx, 8
call fcn.1002f750
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x100395ec
push dword [0x1005c5ac]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x100395dc
mov edx, dword [eax + 4]
test edx, edx
je 0x100395dc
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x100395ef
inc ecx
cmp ecx, 6
jl 0x100395d0
push esi
call fcn.100427ad
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x90]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x10039610
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
lea ecx, [ecx + 0x40]
pop ebp
jmp fcn.10037460
Function at 0x10039730
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10048578
mov eax, dword fs:[0]
push eax
sub esp, 0x90
push ebx
push esi
push edi
mov eax, dword [0x10058014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x10039789
push dword [ebp + 8]
push 0x1003a2d0
push ebx
call eax
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [esi + 0x1c]
movq xmm0, qword [esi + 8]
mov dword [ebp - 0x9c], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x98], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x8c], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x84], eax
lea eax, [esi + 0x20]
mov dword [ebp - 0x80], ecx
lea ecx, [ebp - 0x7c]
push eax
movq qword [ebp - 0x94], xmm0
call fcn.1002b090
mov eax, dword [esi + 0x70]
movq xmm0, qword [esi + 0x68]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x74]
movq qword [ebp - 0x34], xmm0
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 0xb]
push dword [0x1005c5ac]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1003980f
mov ecx, dword [eax + 4]
jmp 0x10039811
xor ecx, ecx
push ecx
push dword [ebp + 8]
mov edx, 0x88
call fcn.10037320
mov ecx, dword [ebp - 0x9c]
mov esi, eax
add esp, 8
mov dword [ebp - 0x18], 0
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0x98]
mov dword [esi + 0xc], ecx
movq xmm0, qword [ebp - 0x94]
movq qword [esi + 0x10], xmm0
mov eax, dword [ebp - 0x8c]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x88]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x80]
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x7c]
mov dword [esi + 0x24], ecx
lea ecx, [esi + 0x28]
push eax
call fcn.1002b090
movq xmm0, qword [ebp - 0x34]
lea ecx, [ebp - 0x20]
movq qword [esi + 0x70], xmm0
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x78], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x7c], eax
mov dword [esi], 0x1003a5d0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], 0
call fcn.10039fa0
mov esi, dword [ebp - 0x38]
test esi, esi
je 0x100398cd
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x100398cd
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x100398cd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x100398ec
mov edx, dword [ecx]
lea eax, [ebp - 0x64]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
push ecx
push ebx
mov eax, dword [eax + 8]
call eax
add esp, 8
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1003991b
push 0
push eax
mov eax, dword [eax]
call eax
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10039c50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10048663
mov eax, dword fs:[0]
push eax
sub esp, 0xec
push ebx
push esi
push edi
mov eax, dword [0x10058014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov eax, dword [edi + 8]
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xf0], eax
lea eax, [edi + 0x10]
push eax
call fcn.10029da0
push esi
lea ecx, [ebp - 0xa8]
call fcn.100388a0
mov eax, dword [esi + 0x80]
movq xmm0, qword [esi + 0x78]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x84]
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
lea ebx, [edi + 4]
mov eax, dword [edi]
push dword [0x1005c574]
mov esi, dword [ebx]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10039ceb
cmp dword [eax], esi
je 0x10039d09
mov eax, dword [eax + 8]
test eax, eax
jne 0x10039ce0
mov edi, dword [ebp - 0x78]
lea eax, [ebp - 0xf0]
mov dword [ebp - 0x1c], eax
cmp byte [edi + 0x400], 0
jne 0x10039d28
mov byte [edi + 0x400], 1
jmp 0x10039d37
cmp dword [eax + 4], 0
je 0x10039ceb
lea eax, [ebp - 0xf0]
mov byte [ebp - 4], 1
push eax
push eax
call fcn.1003add0
add esp, 8
jmp 0x10039dd8
push 0xf8
call fcn.1004234e
add esp, 4
mov edi, eax
mov byte [ebp - 4], 2
lea ecx, [edi + 0x28]
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0x1003ab90
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x1c], 0
mov eax, dword [ebp - 0xf0]
mov dword [edi + 0x20], eax
lea eax, [ebp - 0xe8]
push eax
call fcn.1001cbd0
lea eax, [ebp - 0xa8]
push eax
lea ecx, [edi + 0x68]
call fcn.100388a0
movq xmm0, qword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
movq qword [edi + 0xe0], xmm0
mov eax, dword [ebp - 0x28]
push edi
mov dword [edi + 0xe8], eax
mov eax, dword [ebp - 0x24]
push ebx
mov dword [edi + 0xec], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call fcn.1000baa0
lea ecx, [ebp - 0x1c]
call fcn.1003aaf0
lea ecx, [ebp - 0xa8]
call fcn.100352d0
mov esi, dword [ebp - 0xac]
test esi, esi
je 0x10039e0e
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x10039e0e
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x10039e0e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xb4]
test ecx, ecx
je 0x10039e2c
mov edx, dword [ecx]
lea eax, [ebp - 0xd8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039fa0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x10039ffa
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x10039fd4
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x10039fd4
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x10039fd4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebx + 0x64]
add ebx, 0x40
test ecx, ecx
je 0x10039ff3
mov edx, dword [ecx]
cmp ecx, ebx
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebx + 0x24], 0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x1003a03c
push dword [0x1005c5ac]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1003a02c
mov edx, dword [eax + 4]
test edx, edx
je 0x1003a02c
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x1003a040
inc ecx
cmp ecx, 6
jl 0x1003a020
push esi
call fcn.100427ad
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
ret
mov al, byte [esi + 0x88]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
ret

Function at 0x1003a060
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x1003a07a
add ecx, 8
call fcn.100352d0
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x1003a0bc
push dword [0x1005c5ac]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1003a0ac
mov edx, dword [eax + 4]
test edx, edx
je 0x1003a0ac
mov ecx, 4
nop dword [eax]
cmp dword [edx + ecx*4], 0
je 0x1003a0bf
inc ecx
cmp ecx, 6
jl 0x1003a0a0
push esi
call fcn.100427ad
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
mov al, byte [esi + 0x98]
mov byte [esi], al
mov dword [edx + ecx*4], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret

Function at 0x1003a1d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100486f5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10058014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push dword [0x1005c574]
mov edi, dword [eax + 0x2c]
lea ebx, [eax + 0x2c]
lea esi, [eax + 0x30]
mov eax, dword [eax + 0x28]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1003a22b
nop word [eax + eax]
cmp dword [eax], edi
je 0x1003a272
mov eax, dword [eax + 8]
test eax, eax
jne 0x1003a220
push esi
push 0x50
mov dword [ebp - 0x18], esi
call fcn.10008120
add esp, 4
mov dword [ebp - 4], 1
mov ecx, eax
push esi
call fcn.10032c10
mov ecx, dword [ebp + 8]
push eax
push ebx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
call fcn.1000baa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [eax + 4], 0
je 0x1003a22b
push esi
push esi
mov dword [ebp - 4], 0
call fcn.10036790
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
call fcn.1003e370
test eax, eax
jne 0x1003c66b
sub dword [ebp + 0xc], 1
jne 0x1003c66b
push eax
push eax
push dword [ebp + 8]
push 0x1003db70
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc

Function at 0x1003cc40
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x10058014]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1003cc7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0xc], esi
call fcn.1003cbd0
mov dword [esp + 0x10], eax
test esi, esi
jne 0x1003cc8f
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.10041f5c
mov esp, ebp
pop ebp
ret
mov edx, 0x1004b728
lea ecx, [esp + 0xc]
call fcn.1003cb80
int3

Function at 0x1003de00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10048e7d
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10058014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.1004234e
mov dword [ebp - 0x14], eax
mov dword [eax], 0x1003da40
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push eax
push 0x1003e030
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x1003de81
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10041f5c
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1003e5a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1003e750
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1003e66d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1003e5ea
mov eax, dword [ebp - 4]
cmp eax, dword [0x10058004]
ja 0x1003e5ea
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003e5ba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1003e610
jmp 0x1003e66d
cmp dword [ebp - 0x14], 0x10000
jne 0x1003e653
cmp dword [ebp - 0x18], 0x10000
jb 0x1003e653
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003e646
mov eax, dword [ebp - 8]
jmp 0x1003e66f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1003e668
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1003e750
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003e5ba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003e680
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1003e780
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1003e745
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1003e6c5
mov eax, dword [ebp - 4]
cmp eax, dword [0x10058004]
ja 0x1003e6c5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003e695
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1003e6eb
jmp 0x1003e745
cmp dword [ebp - 0x14], 0x10000
jne 0x1003e72e
cmp dword [ebp - 0x18], 0x10000
jb 0x1003e72e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003e721
mov eax, dword [ebp - 8]
jmp 0x1003e747
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1003e740
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1003e780
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003e695
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003e7b0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1003eba0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x1005b994], 0
jne 0x1003e7ed
cmp dword [0x1005b990], 0
je 0x1003e7ed
mov eax, dword [0x1005b990]
mov dword [0x1005b994], eax
cmp dword [0x1005b994], 0
je 0x1003e86a
mov ecx, dword [0x1005b994]
cmp dword [ecx + 8], 0
je 0x1003e86a
mov edx, dword [0x1005b994]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1003e86a
mov ecx, dword [0x1005b994]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1003e86a
mov eax, dword [0x1005b994]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x1003e839
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x1003e840
xor eax, eax
jmp 0x1003e989
mov ecx, dword [0x1005b994]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x1003e989
mov edx, dword [0x1005b990]
mov dword [0x1005b994], edx
jmp 0x1003e886
mov eax, dword [0x1005b994]
mov ecx, dword [eax + 4]
mov dword [0x1005b994], ecx
cmp dword [0x1005b994], 0
je 0x1003e8c6
cmp dword [0x1005b994], 0
je 0x1003e8c4
mov edx, dword [0x1005b994]
cmp dword [edx + 8], 0
je 0x1003e8c4
mov eax, dword [0x1005b994]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x1003e8c4
mov edx, dword [0x1005b994]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1003e8c4
jmp 0x1003e81e
jmp 0x1003e878
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1003e990
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1003e987
mov eax, dword [ebp - 0x18]
mov dword [0x1005b994], eax
mov ecx, dword [0x1005b994]
mov dword [ecx], 0x52727464
mov edx, dword [0x1005b994]
mov dword [edx + 8], 0
mov eax, dword [0x1005b994]
mov ecx, dword [0x1005b990]
mov dword [eax + 4], ecx
mov edx, dword [0x1005b994]
mov dword [0x1005b990], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x1005b994]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x1003e957
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x1003e977
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1003e94e
mov eax, dword [0x1005b994]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1003e81e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100402e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1005b9dc], 0
je 0x100402f6
xor eax, eax
jmp 0x10040512
cmp dword [0x1005b9d8], 0
je 0x10040309
mov eax, dword [0x1005b9d8]
jmp 0x10040512
push 0x24
push 0
push 0x1005b9b4
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x1005b9b4], eax
push 0
push 0
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x1005b9b8], eax
cmp dword [0x1005b9b8], 0
jne 0x100403ae
mov dword [0x1005b9dc], 1
cmp dword [0x1005b9b8], 0
je 0x10040361
mov eax, dword [0x1005b9b8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1005b9bc], 0
mov dword [0x1005b9c0], 0
mov dword [0x1005b9c4], 0
mov dword [0x1005b9c8], 0
mov dword [0x1005b9cc], 0
mov dword [0x1005b9d0], 0
mov dword [0x1005b9d4], 0
xor eax, eax
jmp 0x10040512
push str.ImagehlpApiVersionEx
mov ecx, dword [0x1005b9b8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005b9bc], eax
push str.SymInitialize
mov edx, dword [0x1005b9b8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005b9c0], eax
push str.SymSetOptions
mov eax, dword [0x1005b9b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005b9c4], eax
push str.SymGetOptions
mov ecx, dword [0x1005b9b8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005b9c8], eax
push str.SymLoadModule64
mov edx, dword [0x1005b9b8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005b9cc], eax
push str.SymGetModuleInfo64
mov eax, dword [0x1005b9b8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005b9d0], eax
push str.SymFromName
mov ecx, dword [0x1005b9b8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1005b9d4], eax
push 8
push 0
lea edx, [ebp - 0xc]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, 0xc
mov word [ebp - 0xc], ax
cmp dword [0x1005b9bc], 0
je 0x10040493
cmp dword [0x1005b9c0], 0
je 0x10040493
cmp dword [0x1005b9cc], 0
je 0x10040493
cmp dword [0x1005b9d0], 0
je 0x10040493
cmp dword [0x1005b9d4], 0
jne 0x10040498
jmp 0x10040342
lea ecx, [ebp - 0xc]
push ecx
call dword [0x1005b9bc]
movzx edx, word [ebp - 0xc]
cmp edx, 0xc
jge 0x100404b0
jmp 0x10040342
push 0
push 0
mov eax, dword [0x1005b9b4]
push eax
call dword [0x1005b9c0]
test eax, eax
jne 0x100404c9
jmp 0x10040342
cmp dword [0x1005b9c8], 0
je 0x10040503
cmp dword [0x1005b9c4], 0
je 0x10040503
call dword [0x1005b9c8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xfffffff8
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, 0x2704
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
call dword [0x1005b9c4]
mov dword [0x1005b9d8], 0x1005b9b4
mov eax, dword [0x1005b9d8]
mov esp, ebp
pop ebp
ret