joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4137d3
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x78
push ebx
push ebp
mov eax, ecx
mov ebp, edx
mov dword [esp + 0x14], eax
push esi
push edi
test eax, eax
je 0x413964
mov edi, dword [eax + 0x120]
mov dword [esp + 0x14], edi
test edi, edi
je 0x413964
mov ecx, edi
call fcn.004114f0
test eax, eax
je 0x413964
xor ebx, ebx
cmp dword [edi + 0xa0], ebx
je 0x413964
cmp dword [edi + 0x14f10], ebx
jle 0x413964
mov eax, dword [edi + 0x14f24]
cmp eax, 0x24000
ja 0x413948
test ebp, ebp
je 0x413964
push eax
push ebx
push ebp
call fcn.004172a0
add esp, 0xc
mov edx, ebp
mov ecx, edi
call fcn.00414254
push 0x64
pop eax
push eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.004172a0
add esp, 0xc
cmp dword [edi + 0x9c], ebx
jne 0x4396dd
lea ecx, [edi + 0x14f04]
lea edx, [esp + 0x20]
call fcn.00414016
mov esi, dword [edi + 0x1c]
cmp dword [edi + 0xa4], ebx
jne 0x439704
cmp dword [edi + 0x6c], ebx
je 0x413950
mov word [esi + ebp], 0x6958
add esi, 2
mov word [esi + ebp], 0x676e
lea ecx, [ebp + 2]
push 0xf
add ecx, esi
pop edx
call fcn.00413ca0
mov edx, dword [edi + 0x14f1c]
add esi, 6
lea ecx, [esi + ebp]
call fcn.00413ca0
mov edx, dword [edi + 0x14f20]
add esi, 4
add edx, dword [edi + 0x14f24]
mov dword [esp + 0x18], edx
lea ecx, [esi + ebp]
call fcn.00413ca0
add esi, 4
mov dword [esp + 0x10], esi
push 0x19
pop ecx
lea edi, [esi + ebp]
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
push 0x64
pop eax
add edi, eax
cmp dword [esi + 0xa4], ebx
jne 0x43970c
mov ecx, ebx
test edi, edi
je 0x413932
movzx eax, byte [ecx + ebp]
xor eax, ebx
shr bx, 8
movzx eax, al
xor bx, word [eax*4 + 0x455398]
inc ecx
movzx ebx, bx
cmp ecx, edi
jb 0x413915
mov ecx, dword [esp + 0x1c]
lea eax, [edi + ebp]
push ebx
push eax
call fcn.00413968
mov eax, dword [esi + 0x14f24]
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78
ret
mov word [esi + ebp], 0x6e49
add esi, 2
mov word [esi + ebp], 0x6f66
jmp 0x4138aa
xor eax, eax
jmp 0x413948
xor esi, esi
mov ecx, 0xff
inc esi
mov eax, ecx
add ecx, 0xff
cdq
idiv dword [esp + 0x10]
mov byte [esp + esi + 0x20], al
inc esi
cmp ecx, 0x639c
jl 0x4396e5
jmp 0x413883
sub esi, 2
jmp 0x413892
mov edx, ebp
mov ecx, esi
call fcn.0043ee0f
mov edx, dword [esp + 0x18]
jmp 0x41390f
Function at 0x4154ba
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x4779a8], 3
push esi
mov esi, ecx
je 0x415506
push dword [0x477168]
call fcn.004199ba
pop ecx
lea eax, [ebp - 0x1c]
push eax
push dword [0x477174]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov eax, dword [ebp - 0x16]
sub eax, esi
mov word [ebp - 2], ax
xor eax, eax
mov word [ebp - 4], ax
push dword [ebp - 4]
push dword [0x477174]
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415a7e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push esi
push edi
mov edi, edx
lea edx, [ebp - 0x80]
push ecx
call fcn.00415aa7
mov esi, eax
pop ecx
test esi, esi
jne 0x439ea4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x80
cmp esi, eax
jbe 0x439ec1
push esi
push eax
push str.Error_writing_ID3v1_tag:_buffer_too_small:_buffer_size_d__ID3v1_size_d_n
call fcn.0043a0b8
add esp, 0xc
jmp 0x415a9f
push edi
push esi
lea ecx, [ebp - 0x80]
push 1
push ecx
call fcn.0041a76a
add esp, 0x10
cmp eax, esi
je 0x415a9f
push str.Error_writing_ID3v1_tag__n
call fcn.0043a0b8
xor eax, eax
pop ecx
inc eax
jmp 0x415aa1

Function at 0x4177df
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x44765c
push str.FlsAlloc
push 0
call fcn.0041775f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417811
push dword [ebp + 8]
mov ecx, esi
call fcn.00416578
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x417853
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x44768c
push str.FlsSetValue
push 3
call fcn.0041775f
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x417887
mov ecx, esi
call fcn.00416578
call esi
jmp 0x41788d
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x427e72
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00427cf1

Function at 0x42b493
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042ae01

Function at 0x42b49e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042b03c
Function at 0x43a134
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov edi, edx
push ebp
push 4
push 1
push str.RIFF
call fcn.0041a76a
lea edx, [edi + 0x24]
mov ecx, ebp
call fcn.0043afd3
push ebp
push 4
push 2
push str.WAVEfmt
call fcn.0041a76a
push 0x10
pop edx
mov ecx, ebp
call fcn.0043afd3
push ebp
push 2
lea eax, [esp + 0x38]
mov word [esp + 0x38], 1
push 1
push eax
call fcn.0041a76a
mov ebx, dword [esp + 0x4c]
mov eax, ebx
push ebp
sar eax, 8
push 2
mov byte [esp + 0x55], al
lea eax, [esp + 0x54]
push 1
push eax
mov byte [esp + 0x5c], bl
call fcn.0041a76a
mov esi, dword [esp + 0x58]
add esp, 0x40
mov edx, esi
mov ecx, ebp
call fcn.0043afd3
imul esi, ebx
mov ecx, ebp
add esi, esi
mov edx, esi
call fcn.0043afd3
lea eax, [ebx + ebx]
mov byte [esp + 0x1c], al
push ebp
sar eax, 8
push 2
mov byte [esp + 0x25], al
lea eax, [esp + 0x24]
push 1
push eax
call fcn.0041a76a
push ebp
push 2
lea eax, [esp + 0x34]
mov word [esp + 0x34], 0x10
push 1
push eax
call fcn.0041a76a
push ebp
push 4
push 1
push str.data
call fcn.0041a76a
mov edx, edi
mov ecx, ebp
call fcn.0043afd3
push ebp
call fcn.0041a227
add esp, 0x34
neg eax
sbb eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x43a140
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov edi, edx
push ebp
push 4
push 1
push str.RIFF
call fcn.0041a76a
lea edx, [edi + 0x24]
mov ecx, ebp
call fcn.0043afd3
push ebp
push 4
push 2
push str.WAVEfmt
call fcn.0041a76a
push 0x10
pop edx
mov ecx, ebp
call fcn.0043afd3
push ebp
push 2
lea eax, [esp + 0x38]
mov word [esp + 0x38], 1
push 1
push eax
call fcn.0041a76a
mov ebx, dword [esp + 0x4c]
mov eax, ebx
push ebp
sar eax, 8
push 2
mov byte [esp + 0x55], al
lea eax, [esp + 0x54]
push 1
push eax
mov byte [esp + 0x5c], bl
call fcn.0041a76a
mov esi, dword [esp + 0x58]
add esp, 0x40
mov edx, esi
mov ecx, ebp
call fcn.0043afd3
imul esi, ebx
mov ecx, ebp
add esi, esi
mov edx, esi
call fcn.0043afd3
lea eax, [ebx + ebx]
mov byte [esp + 0x1c], al
push ebp
sar eax, 8
push 2
mov byte [esp + 0x25], al
lea eax, [esp + 0x24]
push 1
push eax
call fcn.0041a76a
push ebp
push 2
lea eax, [esp + 0x34]
mov word [esp + 0x34], 0x10
push 1
push eax
call fcn.0041a76a
push ebp
push 4
push 1
push str.data
call fcn.0041a76a
mov edx, edi
mov ecx, ebp
call fcn.0043afd3
push ebp
call fcn.0041a227
add esp, 0x34
neg eax
sbb eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x43a2ae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1038
call fcn.00430a90
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push edi
call fcn.0041b7c7
lea ecx, [ebp - 0x34]
push ecx
push eax
call fcn.0041b2ed
add esp, 0xc
mov ebx, 0x1000
test eax, eax
jne 0x43a313
test dword [ebp - 0x2e], ebx
je 0x43a313
test esi, esi
js 0x43a365
jle 0x43a30f
mov eax, ebx
cmp esi, ebx
ja 0x43a2f1
mov eax, esi
push edi
push eax
lea eax, [ebp - 0x1034]
push 1
push eax
call fcn.0041ab7a
add esp, 0x10
cmp eax, 1
jb 0x43a365
sub esi, eax
test esi, esi
jg 0x43a2e9
xor eax, eax
jmp 0x43a368
push 1
push esi
push edi
call fcn.0041a517
add esp, 0xc
test eax, eax
je 0x43a30f
test esi, esi
js 0x43a351
jle 0x43a30f
mov eax, ebx
cmp esi, ebx
ja 0x43a331
mov eax, esi
push edi
push eax
lea eax, [ebp - 0x1034]
push 1
push eax
call fcn.0041ab7a
add esp, 0x10
cmp eax, 1
jb 0x43a365
sub esi, eax
test esi, esi
jg 0x43a329
jmp 0x43a30f
cmp dword [0x4779d4], 0xa
jge 0x43a365
push str.fskip_problem:_Mostly_the_return_status_of_functions_is_not_evaluate_so_it_is_more_secure_to_polute__stderr_._n
call fcn.0043a0b8
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a480
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
lea eax, [ebp - 4]
push esi
push edi
push eax
lea eax, [ebp - 8]
mov edi, edx
push eax
push dword [ebp + 0xc]
mov esi, ecx
lea edx, [ebp - 0x408]
push dword [ebp + 8]
mov ecx, dword [0x478258]
push edi
push 0
call fcn.0043cbff
add esp, 0x18
test eax, eax
jne 0x43a514
push ebx
mov ebx, 0x400
jmp 0x43a4d1
call fcn.0043cbff
add esp, 0x18
cmp eax, 0xffffffff
je 0x43a510
test eax, eax
jg 0x43a513
push esi
push ebx
lea eax, [ebp - 0x408]
push 1
push eax
call fcn.0041ab7a
add esp, 0x10
lea ecx, [ebp - 8]
lea edx, [ebp - 0x408]
push ecx
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [0x478258]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
push eax
test eax, eax
jne 0x43a4c0
call fcn.0043cbff
add esp, 0x18
test eax, eax
jg 0x43a513
or eax, 0xffffffff
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43acae
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1200
call fcn.00430a90
push ebx
push ebp
push esi
xor esi, esi
mov ebp, ecx
push edi
mov edi, edx
cmp dword [0x477128], esi
je 0x43ad5a
cmp dword [0x4779c4], esi
je 0x43ad5a
cmp dword [esp + 0x1218], 1
jne 0x43ad16
mov edx, esi
cmp dword [esp + 0x1214], edx
jle 0x43addc
movzx ecx, word [edi + edx*2]
mov eax, ecx
sar eax, 8
mov byte [esp + esi + 0x10], al
mov byte [esp + esi + 0x11], cl
add esi, 2
inc edx
cmp edx, dword [esp + 0x1214]
jl 0x43acf3
jmp 0x43adc7
mov ebx, esi
cmp dword [esp + 0x1214], ebx
jle 0x43addc
movzx ecx, word [edi + ebx*2]
movzx edx, word [edi + ebx*2 + 0x900]
mov eax, ecx
sar eax, 8
mov byte [esp + esi + 0x10], al
mov eax, edx
sar eax, 8
mov byte [esp + esi + 0x11], cl
mov byte [esp + esi + 0x12], al
mov byte [esp + esi + 0x13], dl
add esi, 4
inc ebx
cmp ebx, dword [esp + 0x1214]
jl 0x43ad25
jmp 0x43adc7
cmp dword [esp + 0x1218], 1
jne 0x43ad8d
mov ecx, esi
cmp dword [esp + 0x1214], ecx
jle 0x43addc
movzx eax, word [edi + ecx*2]
mov byte [esp + esi + 0x10], al
sar eax, 8
mov byte [esp + esi + 0x11], al
add esi, 2
inc ecx
cmp ecx, dword [esp + 0x1214]
jl 0x43ad6f
jmp 0x43adc7
mov edx, esi
cmp dword [esp + 0x1214], edx
jle 0x43addc
movzx eax, word [edi + edx*2]
movzx ecx, word [edi + edx*2 + 0x900]
mov byte [esp + esi + 0x10], al
sar eax, 8
mov byte [esp + esi + 0x11], al
mov byte [esp + esi + 0x12], cl
sar ecx, 8
mov byte [esp + esi + 0x13], cl
add esi, 4
inc edx
cmp edx, dword [esp + 0x1214]
jl 0x43ad98
test esi, esi
jle 0x43addc
push ebp
push esi
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0041a76a
add esp, 0x10
cmp dword [0x4790f0], 1
jne 0x43adec
push ebp
call fcn.004199ba
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1200
ret

Function at 0x43adf7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 2
lea eax, [ebp - 4]
mov word [ebp - 4], 0
push 1
push eax
call fcn.0041ab7a
movsx eax, byte [ebp - 4]
add esp, 0x10
movzx ecx, byte [ebp - 3]
shl eax, 8
or eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x43afd3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, edx
mov byte [ebp - 4], dl
sar eax, 8
mov byte [ebp - 3], al
mov eax, edx
push ecx
sar eax, 0x10
push 4
mov byte [ebp - 2], al
lea eax, [ebp - 4]
sar edx, 0x18
push 1
push eax
mov byte [ebp - 1], dl
call fcn.0041a76a
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x40a34f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41a4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x41cb0c]
mov esi, ecx
call fcn.0040a317
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0040138e
add esp, 0x10
xor esi, esi
lea edx, [ebp + esi - 0x10]
call fcn.0040a2a5
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.0040a2bf
inc esi
cmp esi, 0xc
pop ecx
jl 0x40a37e
cmp dword [0x41cb08], 0
movzx ax, byte [ebp - 5]
movzx eax, ax
pop esi
je 0x40a3bd
movzx cx, byte [0x41b70f]
cmp ax, cx
je 0x40a3c7
or eax, 0xffffffff
jmp 0x40a3c9
movzx cx, byte [0x41b715]
jmp 0x40a3b3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b060
leave
ret

Function at 0x40b060
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a4c0]
jne 0x40b06a
repz ret
jmp fcn.0040ce8d
Function at 0x10167b10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov ecx, 0x102ed49c
call fcn.100cca1c
mov eax, dword [0x102c6ac4]
mov dword [ebp - 4], eax
jmp 0x10167b35
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x10167b4b
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x10167b49
mov eax, dword [ebp - 4]
jmp 0x10167bc5
jmp 0x10167b2d
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10167bc2
mov eax, dword [ebp - 4]
add eax, 0x20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
cmp eax, 0xfe0
jbe 0x10167b85
mov eax, dword [ebp - 4]
mov ecx, dword [0x102c6ac4]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov dword [0x102c6ac4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101690f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x102902c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x102ed624
call fcn.100cca1c
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x102c6ad0]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 5
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1016914b
mov eax, dword [ebp - 0x14]
sub eax, 5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1016916d
mov eax, 0xa
jmp 0x10169254
cmp dword [ebp + 0xc], 0
je 0x101691ba
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x14]
add eax, 5
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
sub edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 1], edx
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x101691b8
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xeb
mov eax, dword [ebp - 0x1c]
mov byte [eax + 1], 0xf9
jmp 0x101691f6
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x101691e1
push 7
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100cc44f
add esp, 0xc
jmp 0x101691f6
push 5
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100cc44f
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [ebp + 0xc]
and al, 1
shl al, 1
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 0x14]
and dl, 0xfd
or dl, al
mov eax, dword [ebp - 8]
mov byte [eax + 0x14], dl
mov al, byte [ebp + 0xc]
and al, 1
shl al, 2
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 0x14]
and dl, 0xfb
or dl, al
mov eax, dword [ebp - 8]
mov byte [eax + 0x14], dl
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c83ea
mov esp, ebp
pop ebp
ret
Function at 0x10169340
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x102902c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x102ed624
call fcn.100cca1c
mov dword [ebp - 8], 0
push 0
push 4
call fcn.100c8057
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x101694ea
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100c79d6
test eax, eax
je 0x101694e0
mov dword [ebp - 8], 1
cmp dword [ebp - 0x28], 0x10
jb 0x10169480
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x1c], eax
jne 0x10169480
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x20], eax
je 0x10169480
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1016940b
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
push ecx
push 0
mov edx, dword [0x102c6acc]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10169409
mov dword [ebp - 8], 0
jmp 0x1016949c
jmp 0x10169460
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x10169460
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x102c6acc]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x10169458
mov dword [ebp - 8], 0
jmp 0x1016949c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov edx, dword [ebp - 0x20]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 8], ecx
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100c53a2
test eax, eax
jne 0x1016939d
cmp dword [ebp - 8], 0
je 0x101694b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x101694b4
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0
jne 0x101694e0
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x101694e0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x102c6acc]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c83ea
mov esp, ebp
pop ebp
ret
Function at 0x10169710
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov ecx, 0x102ed624
call fcn.100cca1c
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10169340
add esp, 4
test eax, eax
jne 0x10169760
mov dword [ebp - 4], 9
jmp 0x101697ce
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x101697ce
mov dword [ebp - 8], 0
jmp 0x1016977a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x101697ce
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x101697cc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10169840
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10169771
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10169b60
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov ecx, 0x102ed624
call fcn.100cca1c
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10169be2
mov dword [ebp - 4], 0
jmp 0x10169b8d
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x10169bcd
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10169bcb
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10169b84
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x102c6acc]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1016ab30
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, 0x102ed6f8
call fcn.100cca1c
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x1016ab86
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x90
je 0x1016ab86
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0xcc
je 0x1016ab86
xor eax, eax
jmp 0x1016abc7
mov dword [ebp - 4], 1
jmp 0x1016ab98
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x1016abc2
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
mov edx, 1
imul eax, edx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
cmp ecx, eax
je 0x1016abc0
xor eax, eax
jmp 0x1016abc7
jmp 0x1016ab8f
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret