joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031750
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], 0
je 0x100317c8
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push eax
push 0x40
push 2
push esi
call edi
test eax, eax
je 0x100317c8
lea ecx, [esp + 8]
push ecx
push 2
lea edx, [esp + 0x18]
push edx
add esi, 0xc
push esi
mov dword [esp + 0x20], 0xffff
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push eax
push ecx
push 2
push esi
call edi
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x100347f0
Capabilities:
Log keystrokes

Disassembly:
push ecx
cmp dword [esp + 8], 0
push esi
mov esi, ecx
je 0x1003496e
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push edi
push 0
push 0xd
call ebp
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
and eax, 0xff
mov ebx, eax
shl ebx, 0x10
mov eax, ebx
or eax, 1
push eax
push 0xd
push pe_nt_image_headers32
push ecx
call edi
mov edx, dword [esi + 4]
or ebx, 0xc0000001
push ebx
push 0xd
push 0x101
push edx
call edi
push 0x2f
call dword [sym.imp.USER32.dll_OemKeyScan]
mov ebx, eax
push 1
push ebx
call ebp
mov edx, dword [esi + 4]
and ebx, 0xff
shl ebx, 0x10
mov ecx, ebx
or ecx, 1
push ecx
push eax
push pe_nt_image_headers32
push edx
mov dword [esp + 0x20], eax
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 4]
or ebx, 0xc0000001
push ebx
push eax
push 0x101
push ecx
call edi
push 0
push 8
call ebp
and eax, 0xff
mov ebx, eax
mov eax, dword [esi + 4]
shl ebx, 0x10
mov edx, ebx
or edx, 1
push edx
push 8
push pe_nt_image_headers32
push eax
call edi
mov ecx, dword [esi + 4]
mov ebp, ebx
or ebp, 0x40000001
push ebp
push 8
push pe_nt_image_headers32
push ecx
call edi
mov edx, dword [esi + 4]
push ebp
push 8
push pe_nt_image_headers32
push edx
call edi
push ebp
push 8
mov eax, dword [esi + 4]
push pe_nt_image_headers32
push eax
call edi
mov ecx, dword [esi + 4]
or ebx, 0xc0000001
push ebx
push 8
push 0x101
push ecx
call edi
mov ebp, dword [esp + 0x18]
mov eax, ebp
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x10034900
sub eax, ecx
xor ebx, ebx
test eax, eax
mov dword [esp + 0x18], eax
jle 0x10034930
movsx edx, byte [ebx + ebp]
mov eax, dword [esi + 4]
push 0
push edx
push 0x102
push eax
call edi
add ebx, 1
cmp ebx, dword [esp + 0x18]
jl 0x10034915
push 0
push 0xd
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, dword [esi + 4]
and eax, 0xff
mov ebx, eax
shl ebx, 0x10
mov ecx, ebx
or ecx, 1
push ecx
push 0xd
push pe_nt_image_headers32
push edx
call edi
mov eax, dword [esi + 4]
or ebx, 0xc0000001
push ebx
push 0xd
push 0x101
push eax
call edi
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 4
Function at 0x100393b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100826a4
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x10097060]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
mov dword [esp + 0x14], ebx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ebx
mov byte [esi + 0x20], bl
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ebx
mov byte [esi + 0x58], bl
mov dword [esi + 0x74], vtable.CDictation.0
mov dword [esi + 0x84], 1
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x88], ebx
lea eax, [esi + 0x8c]
push eax
mov byte [esp + 0x18], 4
call fcn.10017970
mov dword [esi + 0xb2a28], 0x2570
mov dword [esi + 0xb2a2c], ebx
mov dword [esi + 0xb2a30], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x1003a2b0
Capabilities:
Terminate thread

Disassembly:
push ebp
push esi
mov ebp, 1
lea esi, [edi + 0x8c]
mov dword [ebx + 4], ebp
call fcn.10017f70
mov eax, dword [edi + 0xb2a2c]
test eax, eax
je 0x1003a2e2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0xb2a2c], 0
mov dword [ebx + 8], ebp
pop esi
mov dword [0x1009a200], ebp
pop ebp
ret

Function at 0x1003a380
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10096050
push 0x10069090
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10097060]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
call fcn.10031500
call fcn.10031750
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], ebx
push str.fb20121011
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, ebx
je 0x1003a443
push 0xc
push ebx
push ebx
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x1003a443
push ebx
push ebx
mov eax, dword [esi]
push eax
push 0x1003a300
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1009a1f4], eax
cmp eax, ebx
je 0x1003a443
mov ecx, dword [esi + 0x10]
mov dword [0x1009a1f8], ecx
mov edx, dword [esi + 0x20]
mov dword [0x1009a1fc], edx
mov eax, dword [esi + 0x40]
mov dword [0x1009a1f0], eax
mov ecx, dword [esi + 0x70]
mov dword [0x1009a1e0], ecx
mov dword [ebp - 0x24], 1
mov dword [esi], ebx
call fcn.10063050
mov dword [ebp - 4], 0xfffffffe
call fcn.1003a46c
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100413e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1007d611
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10097060]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esi], vtable.CPaths.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov byte [esp + 0x14], 2
call fcn.10044940
fld dword [esp + 0x20]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edi
fstp dword [esi + 0x40]
mov dword [esi + 0x44], 0x2710
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x10045c00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x1007e220
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10097060]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [esp + 0x34]
push ebx
push esi
call fcn.10001000
xor edi, edi
mov dword [esp + 0x2c], edi
fld dword [0x1008b790]
lea eax, [esi + 0x80]
fstp dword [esi + 0x24]
push eax
mov dword [esi], vtable.CPatrolAction.0
call fcn.10021d30
mov byte [esp + 0x2c], 1
mov edx, dword [0x10099194]
mov eax, dword [edx + 0xc]
mov ecx, 0x10099194
call eax
add eax, 0x10
mov dword [esi + 0x59248], eax
mov dword [esi + 0x591b0], edi
mov dword [esi + 0x591ac], edi
mov byte [esp + 0x2c], 2
lea ebp, [esi + 0x59250]
call fcn.1001f290
mov dword [ebp + 4], eax
mov dword [ebp + 8], edi
mov byte [esp + 0x2c], 3
mov dword [esi + 0x7c], edi
mov dword [esi + 0x591a4], edi
mov dword [esi + 0x591a8], edi
lea edi, [esi + 4]
cmp edi, ebx
je 0x10045cca
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x28]
push ecx
call fcn.10001dd0
mov eax, edi
call fcn.10021a20
mov ebx, ebp
call fcn.1001f090
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [esi + 0x5925c], eax
call edi
mov dword [esi + 0x59260], eax
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x10048600
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x1007e1d0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10097060]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
call fcn.10065ba0
test eax, eax
jne 0x100487c1
call fcn.10065b20
test eax, eax
jne 0x100487c1
mov eax, dword [ebp + 0x14]
mov ebx, dword [eax + 0x59774]
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0x59260]
cmp eax, 0x1f4
jbe 0x100487c1
lea eax, [esp + 0x2c]
push eax
mov ecx, 0x1008a934
call fcn.10001a30
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x28], 0
mov ecx, dword [ebp + 0x14]
add ecx, 0xc
call fcn.10005150
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x1c], esp
mov esi, esp
call fcn.10001cb0
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.1004a5b0
mov edi, eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x18], edi
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100486e0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
je 0x10048719
mov eax, edi
call fcn.10059b90
mov esi, dword [edi]
call fcn.10064990
test eax, eax
je 0x10048719
mov edi, dword [edi]
mov eax, ebx
call fcn.1004a950
test eax, eax
jne 0x10048719
cmp dword [ebx + 0x50], 0x64
jbe 0x10048719
mov edx, dword [ebx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [edx + 0x14]
jmp 0x100487b0
cmp dword [ebx + 0x1b8], 0
jne 0x100487c1
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0x470], 0
je 0x100487c1
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x10089640
call fcn.10001a30
mov dword [esp + 0x24], 1
mov ecx, dword [ebp + 0x14]
lea edx, [esp + 0x18]
push edx
add ecx, 0xc
call fcn.10005150
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x30], esp
mov esi, esp
call fcn.10001cb0
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.1004a5b0
mov edi, eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], 0xffffffff
call fcn.1001f1f0
test edi, edi
je 0x100487c1
mov eax, edi
call fcn.10059b90
mov esi, dword [edi]
call fcn.10064990
test eax, eax
je 0x100487c1
cmp dword [edi + 0x14], 0
jne 0x100487c1
mov eax, dword [ebx]
mov ecx, dword [edi]
mov edx, dword [eax + 0x14]
push ecx
mov ecx, ebx
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x59260], eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x10048cc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ecx, dword [edi + 0x14]
cmp dword [ecx + 0x164], 0
push ebx
push ebp
push esi
mov ebp, 1
je 0x10048d13
mov eax, dword [ecx + 0x5982c]
cmp eax, dword [ecx + 0x16c]
jae 0x10048d13
mov eax, dword [ecx + 0x59774]
test eax, eax
je 0x10048d13
mov esi, dword [eax + 0x64]
test esi, esi
jne 0x10048cf8
lea eax, [ebp + 0x63]
jmp 0x10048d02
mov eax, dword [eax + 0x30]
imul eax, eax, 0x64
xor edx, edx
div esi
cmp eax, dword [ecx + 0x168]
jbe 0x10048d13
mov eax, edi
call fcn.10048fd0
mov ebp, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [edi + 0x5925c]
cmp eax, 0x2710
jbe 0x10048d3b
call esi
lea ebx, [edi + 0x59250]
mov dword [edi + 0x5925c], eax
call fcn.1001f090
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x1004a2f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
fld dword [eax]
push ebx
push edi
push ecx
push edx
sub esp, 8
fstp dword [esp + 4]
fld dword [eax + 4]
lea eax, [esi + 0xf8]
fstp dword [esp]
call fcn.1003da40
mov edi, eax
cmp edi, 2
jne 0x1004a3a8
add dword [esi + 0x128], 1
cmp dword [esi + 0x128], 1
jle 0x1004a3bd
push 0x10099e10
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x100986c0
mov dword [esp + 0xc], 0xb
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 8]
push eax
mov eax, 0x100986d8
call fcn.1003a770
push 0x100986c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esi + 0x10]
xor eax, eax
cmp dword [ecx + 0x220], eax
je 0x1004a3bb
cmp dword [esi + 0xc], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x1004a383
call ebx
mov dword [esi + 0xc], eax
call ebx
mov edx, dword [esi + 0x10]
mov ecx, dword [edx + 0x224]
sub eax, dword [esi + 0xc]
imul ecx, ecx, 0x3e8
cmp eax, ecx
mov eax, edi
jbe 0x1004a3bd
mov dword [esi + 0x14], 1
pop edi
pop ebx
pop ecx
ret
cmp edi, 1
jne 0x1004a3bd
xor eax, eax
mov dword [esi + 0x128], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], eax
mov eax, edi
pop edi
pop ebx
pop ecx
ret

Function at 0x1004a3d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push edi
lea ecx, [esi + 0xf8]
call fcn.1003d830
mov edi, eax
cmp edi, 2
jne 0x1004a477
add dword [esi + 0x128], 1
cmp dword [esi + 0x128], 1
jle 0x1004a48c
push 0x10099e10
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x100986c0
mov dword [esp + 0xc], 0xb
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 8]
push eax
mov eax, 0x100986d8
call fcn.1003a770
push 0x100986c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esi + 0x10]
xor eax, eax
cmp dword [ecx + 0x220], eax
je 0x1004a48a
cmp dword [esi + 0xc], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x1004a452
call ebx
mov dword [esi + 0xc], eax
call ebx
mov edx, dword [esi + 0x10]
mov ecx, dword [edx + 0x224]
sub eax, dword [esi + 0xc]
imul ecx, ecx, 0x3e8
cmp eax, ecx
mov eax, edi
jbe 0x1004a48c
mov dword [esi + 0x14], 1
pop edi
pop ebx
pop ecx
ret
cmp edi, 1
jne 0x1004a48c
xor eax, eax
mov dword [esi + 0x128], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], eax
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x10063e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
fld dword [eax + 8]
fstp dword [esi + 8]
push edi
fld dword [eax + 0xc]
add eax, 0x9c
fstp dword [esi + 0xc]
lea edi, [esi + 0x9c]
fld dword [eax - 0x8c]
fstp dword [esi + 0x10]
fld dword [eax - 0x88]
fstp dword [esi + 0x14]
mov ecx, dword [eax - 0x84]
mov dword [esi + 0x18], ecx
mov edx, dword [eax - 0x80]
mov dword [esi + 0x1c], edx
mov ecx, dword [eax - 0x7c]
mov dword [esi + 0x20], ecx
mov edx, dword [eax - 0x78]
mov dword [esi + 0x24], edx
mov ecx, dword [eax - 0x74]
mov dword [esi + 0x28], ecx
mov edx, dword [eax - 0x70]
mov dword [esi + 0x2c], edx
mov ecx, dword [eax - 0x6c]
mov dword [esi + 0x30], ecx
mov edx, dword [eax - 0x68]
mov dword [esi + 0x34], edx
movzx ecx, byte [eax - 0x64]
mov byte [esi + 0x38], cl
mov edx, dword [eax - 0x60]
mov dword [esi + 0x3c], edx
mov ecx, dword [eax - 0x5c]
mov dword [esi + 0x40], ecx
mov edx, dword [eax - 0x58]
mov dword [esi + 0x44], edx
mov ecx, dword [eax - 0x54]
mov dword [esi + 0x48], ecx
mov edx, dword [eax - 0x50]
mov dword [esi + 0x4c], edx
mov ecx, dword [eax - 0x4c]
mov dword [esi + 0x50], ecx
mov edx, dword [eax - 0x48]
mov dword [esi + 0x54], edx
mov ecx, dword [eax - 0x44]
mov dword [esi + 0x58], ecx
mov edx, dword [eax - 0x40]
mov dword [esi + 0x5c], edx
mov ecx, dword [eax - 0x3c]
mov dword [esi + 0x60], ecx
mov edx, dword [eax - 0x38]
mov dword [esi + 0x64], edx
movzx ecx, byte [eax - 0x34]
mov byte [esi + 0x68], cl
mov edx, dword [eax - 0x30]
mov dword [esi + 0x6c], edx
mov ecx, dword [eax - 0x2c]
mov dword [esi + 0x70], ecx
mov edx, dword [eax - 0x28]
mov dword [esi + 0x74], edx
mov ecx, dword [eax - 0x24]
mov dword [esi + 0x78], ecx
mov edx, dword [eax - 0x20]
mov dword [esi + 0x7c], edx
mov ecx, dword [eax - 0x1c]
mov dword [esi + 0x80], ecx
mov edx, dword [eax - 0x18]
mov dword [esi + 0x84], edx
mov ecx, dword [eax - 0x14]
mov dword [esi + 0x88], ecx
mov edx, dword [eax - 0x10]
mov dword [esi + 0x8c], edx
mov ecx, dword [eax - 0xc]
mov dword [esi + 0x90], ecx
mov edx, dword [eax - 8]
mov dword [esi + 0x94], edx
mov ecx, dword [eax - 4]
mov dword [esi + 0x98], ecx
call fcn.100038f0
mov eax, esi
pop edi
ret

Function at 0x100673c5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10097060]
jne 0x100673cf
repz ret
jmp fcn.10069fa4
Function at 0x1006a1e5
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x100971f8]
je 0x1006a200
inc edi
cmp edi, 0x17
jb 0x1006a1f1
cmp edi, 0x17
jae 0x1006a380
push ebp
push 3
call fcn.10074676
cmp eax, 1
pop ecx
je 0x1006a34c
push 3
call fcn.10074676
test eax, eax
pop ecx
jne 0x1006a234
cmp dword [0x100991d4], 1
je 0x1006a34c
cmp ebx, 0xfc
je 0x1006a37f
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10099508
push ebp
call fcn.10069b54
add esp, 0xc
test eax, eax
je 0x1006a26a
push esi
push esi
push esi
push esi
push esi
call fcn.10067544
add esp, 0x14
push 0x104
mov esi, 0x10099521
push esi
push 0
mov byte [0x10099625], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1006a2ae
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.10069b54
add esp, 0xc
test eax, eax
je 0x1006a2ae
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10067544
add esp, 0x14
push esi
call fcn.10069a60
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1006a2f3
push esi
call fcn.10069a60
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1009981c
push 0x10083954
sub ecx, eax
push ecx
push eax
call fcn.100745c3
add esp, 0x14
test eax, eax
je 0x1006a2f3
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10067544
add esp, 0x14
jmp 0x1006a2f5
xor esi, esi
push 0x10083950
push ebx
push ebp
call fcn.10074552
add esp, 0xc
test eax, eax
je 0x1006a315
push esi
push esi
push esi
push esi
push esi
call fcn.10067544
add esp, 0x14
push dword [edi*8 + 0x100971fc]
push ebx
push ebp
call fcn.10074552
add esp, 0xc
test eax, eax
je 0x1006a337
push esi
push esi
push esi
push esi
push esi
call fcn.10067544
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10074395
add esp, 0xc
jmp 0x1006a37f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1006a37f
cmp ebp, 0xffffffff
je 0x1006a37f
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x100971fc]
push dword [esi]
call fcn.10069a60
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10074395
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1006a498
xor ebx, ebx
cmp dword [0x10099b60], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1007446b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1007454b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1007454b
push eax
call fcn.1006a42a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10099b60], eax
call esi
push eax
call fcn.1006a42a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10099b64], eax
call esi
push eax
call fcn.1006a42a
mov dword [0x10099b68], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1006fd56
test eax, eax
pop ecx
pop ecx
je 0x10074439
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10067544
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1007446b
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1006a42a
cmp eax, ebx
pop ecx
mov dword [0x10099b70], eax
je 0x1007446b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1006a42a
pop ecx
mov dword [0x10099b6c], eax
mov eax, dword [0x10099b6c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x100744f0
cmp dword [0x10099b70], ecx
je 0x100744f0
push eax
call fcn.1006a4a1
push dword [0x10099b70]
mov esi, eax
call fcn.1006a4a1
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x100744f0
cmp edi, ebx
je 0x100744f0
call esi
cmp eax, ebx
je 0x100744bd
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100744bd
test byte [ebp - 0x18], 1
jne 0x100744f0
lea eax, [ebp - 0x10]
push eax
call fcn.1006fd8d
test eax, eax
pop ecx
je 0x100744d8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10067544
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x100744e7
or dword [ebp + 0x10], 0x200000
jmp 0x1007452b
or dword [ebp + 0x10], 0x40000
jmp 0x1007452b
mov eax, dword [0x10099b64]
cmp eax, dword [ebp - 8]
je 0x1007452b
push eax
call fcn.1006a4a1
cmp eax, ebx
pop ecx
je 0x1007452b
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1007452b
mov eax, dword [0x10099b68]
cmp eax, dword [ebp - 8]
je 0x1007452b
push eax
call fcn.1006a4a1
cmp eax, ebx
pop ecx
je 0x1007452b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10099b60]
call fcn.1006a4a1
cmp eax, ebx
pop ecx
je 0x1007454b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1007454d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10079f60
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10099cbc], 0
je 0x10079f79
mov eax, dword [0x10099cbc]
jmp 0x1007a116
mov dword [0x10099cbc], 0x10099c94
push 0x28
push 0
push 0x10099c94
call fcn.100696f0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10099c94], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10099c98], eax
cmp dword [0x10099c98], 0
jne 0x10079fbf
xor eax, eax
jmp 0x1007a116
push str.ImagehlpApiVersionEx
mov eax, dword [0x10099c98]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10099c9c], eax
push str.SymInitialize
mov ecx, dword [0x10099c98]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10099ca0], eax
push str.SymSetOptions
mov edx, dword [0x10099c98]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10099ca4], eax
push str.SymGetOptions
mov eax, dword [0x10099c98]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10099ca8], eax
push str.SymLoadModule
mov ecx, dword [0x10099c98]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10099cac], eax
push str.SymGetModuleInfo
mov edx, dword [0x10099c98]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10099cb0], eax
push str.SymGetSymFromName
mov eax, dword [0x10099c98]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10099cb4], eax
push str.BindImage
mov ecx, dword [0x10099c98]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10099cb8], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.100696f0
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x10099c9c], 0
je 0x1007a09d
lea eax, [ebp - 8]
push eax
call dword [0x10099c9c]
cmp dword [0x10099c9c], 0
je 0x1007a0af
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x1007a0ca
mov edx, dword [0x10099c98]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x10099c98], 0
xor eax, eax
jmp 0x1007a116
cmp dword [0x10099ca0], 0
je 0x1007a0e3
push 0
push 0
mov eax, dword [0x10099c94]
push eax
call dword [0x10099ca0]
cmp dword [0x10099ca8], 0
je 0x1007a111
cmp dword [0x10099ca4], 0
je 0x1007a111
call dword [0x10099ca8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x10099ca4]
mov eax, dword [0x10099cbc]
mov esp, ebp
pop ebp
ret