joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100474b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x5fc
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, eax
add esp, 4
test esi, esi
je 0x100474da
mov dword [esi + 4], 0xffffffff
call fcn.10046e50
mov eax, esi
jmp 0x100474dc
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x100c4dbc], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x853822
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x853822], 5
mov edx, dword [ebp - 4]
push edx
push 1
push 0x853822
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x8538f9
call esi
mov bl, 6
lea ecx, [ebp - 4]
push ecx
mov byte [0x8538f9], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x8538f9
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x8533f6
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x8533f6], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x8533f6
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x853461
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x853461], 5
mov edx, dword [ebp - 4]
push edx
push 1
push 0x853461
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x853796
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x853796], 0x100b88a0
mov edx, dword [ebp - 4]
push edx
push 4
push 0x853796
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x85358b
call esi
mov dword [0x85358b], 0xaa
lea ecx, [ebp - 4]
mov edx, dword [ebp - 4]
push ecx
push edx
push 4
push 0x85358b
call esi
mov eax, 0x85351c
mov dword [0x101db240], eax
mov dword [0x101db244], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x85346e
mov dword [0x101db230], 0x853472
mov dword [0x101db234], 0x85349d
mov dword [0x101db238], 0x8534c5
mov dword [0x101db23c], 0x8534f1
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x85346e], 0x101db230
mov edx, dword [ebp - 4]
push edx
push 4
push 0x85346e
call esi
push 0x10047480
push 0x7d349a
mov bl, 0xe8
call fcn.10053c00
push 0x10047370
push 0x853554
call fcn.10053c00
push 0x10047350
push 0x85351f
mov bl, 0xe9
call fcn.10053c00
push 0x10047390
push 0x4d55ca
mov bl, 0xe8
call fcn.10053c00
push 0x100473d0
push 0x8606b0
mov bl, 0xe9
call fcn.10053c00
push 0x10046fe0
push 0x853753
mov bl, 0xe8
call fcn.10053c00
add esp, 0x30
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10047a70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x8606d6
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x8606d6], 0x6f
mov edx, dword [ebp - 4]
push edx
push 1
push 0x8606d6
call esi
push 0x100476e0
push 0x7d35a8
mov bl, 0xe8
call fcn.10053c00
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d0e17
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x4d0e17], 0x10047a60
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4d0e17
call esi
push 0x10047770
push 0x4d2a04
call fcn.10053c00
push 0x10047a00
push 0x7d378e
call fcn.10053c00
push 0x10047a00
push 0x811c42
call fcn.10053c00
push 0x100478e0
push 0x4d9344
call fcn.10053c00
push 0x10047960
push 0x4d9cc2
call fcn.10053c00
push 0x100477c0
push 0x4d58a0
call fcn.10053c00
push 0x10047880
push 0x4d935c
call fcn.10053c00
push 0x10047880
push 0x5b67b9
call fcn.10053c00
add esp, 0x40
push 0x10047880
push 0x5b832f
call fcn.10053c00
push 0x10047880
push 0x5cf380
call fcn.10053c00
push 0x10047830
push 0x4d6cf7
call fcn.10053c00
push 0x10047830
push 0x4e14f3
call fcn.10053c00
push 0x10047830
push 0x63e4c9
call fcn.10053c00
push 0x10047830
push 0x63ef07
call fcn.10053c00
push 0x10047830
push 0x641021
call fcn.10053c00
push 0x10047830
push 0x64be83
call fcn.10053c00
add esp, 0x40
push 0x10047830
push 0x64bf85
call fcn.10053c00
push 0x10047830
push 0x64c566
call fcn.10053c00
push 0x10047830
push 0x64c6cd
call fcn.10053c00
push 0x10047830
push 0x654255
call fcn.10053c00
push 0x10047830
push 0x654d25
call fcn.10053c00
push 0x10047830
push 0x659051
call fcn.10053c00
push 0x10047830
push 0x6595bd
call fcn.10053c00
push 0x10047830
push 0x659618
call fcn.10053c00
add esp, 0x40
push 0x10047830
push 0x659ed8
call fcn.10053c00
push 0x10047830
push 0x65f55c
call fcn.10053c00
push 0x10047830
push 0x65f63a
call fcn.10053c00
push 0x10047830
push 0x65f706
call fcn.10053c00
push 0x10047830
push 0x666d16
call fcn.10053c00
push 0x10047830
push 0x85f7ef
call fcn.10053c00
push 0x10047830
push 0x872549
call fcn.10053c00
push 0x10047830
push 0x91cc15
call fcn.10053c00
add esp, 0x40
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10048f80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x10061018]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100491b0
mov dword [esp + 0x24], 0x48
mov dword [esp + 0x28], 0x49
mov dword [esp + 0x2c], 0x4a
mov dword [esp + 0x30], 0x4b
mov dword [esp + 0x34], 0x4c
mov dword [esp + 0x38], 0x4d
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
movzx eax, word [esp + eax*4 + 0x24]
cwde
lea esi, [eax + eax*8]
add esi, esi
add esi, esi
add esi, esi
fld dword [esi + 0x100ba694]
call fcn.100569f0
fld dword [esi + 0x100ba698]
mov edi, eax
call fcn.100569f0
fld dword [esi + 0x100ba68c]
mov ebx, eax
call fcn.100569f0
fld dword [esi + 0x100ba690]
mov dword [esp + 0x20], eax
call fcn.100569f0
mov ecx, dword [esp + 0x20]
push eax
push ecx
push ebx
push edi
mov edx, 0x790b10
call edx
mov edi, dword [esp + 0x28]
add esp, 0x10
test al, al
je 0x100490bd
mov esi, dword [esp + edi*4 + 0x24]
lea esi, [esi + esi*8]
add esi, esi
add esi, esi
add esi, esi
cmp byte [esi + 0x100ba6a9], 0
je 0x100490bd
mov eax, dword [esp + 0x1c]
sub eax, dword [esi + 0x100ba6a4]
cmp dword [ebp + 8], 0x201
je 0x10049146
mov byte [esi + 0x100ba6a8], 0
cmp eax, 0x1f4
jb 0x100491b0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x100ba6a4], eax
lea eax, [esp + 0x10]
push eax
mov ecx, 8
mov dword [esp + 0x14], 0xebf308c1
mov dword [esp + 0x18], edi
call fcn.1004f8c0
add esp, 4
inc edi
mov dword [esp + 0x18], edi
cmp edi, 6
jl 0x10048ff3
fld dword [0x100bca04]
call fcn.100569f0
fld dword [0x100bca08]
mov esi, eax
call fcn.100569f0
fld dword [0x100bc9fc]
mov edi, eax
call fcn.100569f0
fld dword [0x100bca00]
mov ebx, eax
call fcn.100569f0
push eax
push ebx
push edi
push esi
mov edx, 0x790b10
call edx
add esp, 0x10
test al, al
je 0x100491b0
cmp byte [0x100bca19], 0
je 0x100491b0
cmp dword [ebp + 8], 0x201
jne 0x1004916b
mov byte [0x100bca18], 1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10056040
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esp + edi*4 + 0x24]
lea ecx, [edi + edi*8]
mov byte [ecx*8 + 0x100ba6a8], 1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10056040
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x1c]
sub eax, dword [0x100bca14]
mov byte [0x100bca18], 0
cmp eax, 0x1f4
jb 0x100491b0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bca14], eax
lea eax, [esp + 0x10]
push eax
mov ecx, 8
mov dword [esp + 0x14], 0xebf308c1
mov dword [esp + 0x18], 7
call fcn.1004f8c0
add esp, 4
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.10056040
mov esp, ebp
pop ebp
ret 4
Function at 0x100491d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x10061018]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x1c], eax
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x10049400
mov dword [esp + 0x24], 0x48
mov dword [esp + 0x28], 0x49
mov dword [esp + 0x2c], 0x4a
mov dword [esp + 0x30], 0x4b
mov dword [esp + 0x34], 0x4c
mov dword [esp + 0x38], 0x4d
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
movzx eax, word [esp + eax*4 + 0x24]
cwde
lea esi, [eax + eax*8]
add esi, esi
add esi, esi
add esi, esi
fld dword [esi + 0x100ba694]
call fcn.100569f0
fld dword [esi + 0x100ba698]
mov edi, eax
call fcn.100569f0
fld dword [esi + 0x100ba68c]
mov ebx, eax
call fcn.100569f0
fld dword [esi + 0x100ba690]
mov dword [esp + 0x20], eax
call fcn.100569f0
mov ecx, dword [esp + 0x20]
push eax
push ecx
push ebx
push edi
mov edx, 0x790b10
call edx
mov edi, dword [esp + 0x28]
add esp, 0x10
test al, al
je 0x1004930d
mov esi, dword [esp + edi*4 + 0x24]
lea esi, [esi + esi*8]
add esi, esi
add esi, esi
add esi, esi
cmp byte [esi + 0x100ba6a9], 0
je 0x1004930d
mov eax, dword [esp + 0x1c]
sub eax, dword [esi + 0x100ba6a4]
cmp dword [ebp + 8], 0x201
je 0x10049396
mov byte [esi + 0x100ba6a8], 0
cmp eax, 0x1f4
jb 0x10049400
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x100ba6a4], eax
lea eax, [esp + 0x10]
push eax
mov ecx, 8
mov dword [esp + 0x14], 0xebf308c1
mov dword [esp + 0x18], edi
call fcn.1004f8c0
add esp, 4
inc edi
mov dword [esp + 0x18], edi
cmp edi, 6
jl 0x10049243
fld dword [0x100bbc84]
call fcn.100569f0
fld dword [0x100bbc88]
mov esi, eax
call fcn.100569f0
fld dword [0x100bbc7c]
mov edi, eax
call fcn.100569f0
fld dword [0x100bbc80]
mov ebx, eax
call fcn.100569f0
push eax
push ebx
push edi
push esi
mov edx, 0x790b10
call edx
add esp, 0x10
test al, al
je 0x10049400
cmp byte [0x100bbc99], 0
je 0x10049400
cmp dword [ebp + 8], 0x201
jne 0x100493bb
mov byte [0x100bbc98], 1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10056040
mov esp, ebp
pop ebp
ret 4
mov edi, dword [esp + edi*4 + 0x24]
lea ecx, [edi + edi*8]
mov byte [ecx*8 + 0x100ba6a8], 1
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10056040
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x1c]
sub eax, dword [0x100bbc94]
mov byte [0x100bbc98], 0
cmp eax, 0x1f4
jb 0x10049400
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100bbc94], eax
lea eax, [esp + 0x10]
push eax
mov ecx, 8
mov dword [esp + 0x14], 0xebf308c1
mov dword [esp + 0x18], 6
call fcn.1004f8c0
add esp, 4
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor al, al
call fcn.10056040
mov esp, ebp
pop ebp
ret 4
Function at 0x10049510
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10061018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10049557
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10056040
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x18]
push eax
push 6
lea ecx, [ebp - 0x20]
push ecx
push edi
call ebx
mov edx, 0x1112
cmp word [ebp - 0x20], dx
jne 0x1004966c
cmp dword [ebp - 0x1e], 0x36
jne 0x1004966c
cmp byte [ebp + 0xc], 0
push esi
mov esi, 0x1009f5f4
je 0x10049597
mov esi, 0x1009f624
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
call ebx
mov edx, dword [0x1009f654]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi], edx
mov eax, dword [0x1009f658]
xor eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov ecx, dword [0x1009f65c]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 8], ecx
mov edx, dword [0x1009f660]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0xc], edx
call ebx
mov edx, dword [0x1009f654]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi + 0x10], edx
mov eax, dword [0x1009f658]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [0x1009f65c]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x18], ecx
mov edx, dword [0x1009f660]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0x1c], edx
call ebx
mov edx, dword [0x1009f654]
xor edx, dword [ebp - 0x14]
push edi
mov dword [esi + 0x20], edx
mov eax, dword [0x1009f658]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov ecx, dword [0x1009f65c]
xor ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ecx
mov edx, dword [0x1009f660]
xor edx, dword [ebp - 8]
mov dword [esi + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10056040
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.10056040
mov esp, ebp
pop ebp
ret 8
Function at 0x1004ae70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x1004ae00
push 5
sub eax, 0x836486
xor edi, edi
push 0x836481
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1004aecf
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x836481
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x836481
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1004aed5
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, fcn.1004adb0
push 5
sub ecx, 0x7dd309
push 0x7dd304
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1004af25
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x7dd304
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x7dd304
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1004af2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, fcn.1004adb0
push 5
sub edx, 0x833b0d
push 0x833b08
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1004af7b
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x833b08
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x833b08
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1004af81
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004c910
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x1004c990
push 5
sub eax, 0x80f9b0
xor edi, edi
push 0x80f9ab
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1004c96f
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x80f9ab
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x80f9ab
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1004c975
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100ca050], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004dda0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x10061018]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
mov ebx, dword [0x100c810c]
push esi
push edi
lea esi, [esp + 0x10]
call section..text
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x333cc8]
mov eax, str.exg.emu
call fcn.10001140
test al, al
je 0x1004de1d
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.exg.emu
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1004de1d
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x333cc4
je 0x1004de34
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.10056040
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x333cc4
lea esi, [ebx + 4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1004de16
xor eax, eax
lea esp, [esp]
mov edx, eax
shr edx, 8
xor dl, 0x95
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xda
mov byte [esi + eax], dl
inc eax
cmp eax, 0x333cc4
jb 0x1004de60
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.10056040
mov esp, ebp
pop ebp
ret

Function at 0x1004df10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x514
mov eax, dword [0x10061018]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
push esi
push edi
mov edi, dword [0x100c810c]
cmp dword [edi + 0x278], 0
je 0x1004e007
push 0x103
lea eax, [esp + 0x415]
push 0
push eax
mov byte [esp + 0x41c], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x414]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1004df7f
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ebx, [edi + 0xd3]
push ebx
lea esi, [esp + 0x414]
call fcn.10053d60
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x1004dfa8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea esi, [esp + 0x10]
call section..text
mov edx, esi
push edx
lea esi, [esp + 0x10]
mov eax, ebx
call fcn.10001140
test al, al
jne 0x1004dfdf
push 0x10
push str.Error
push str.Main.exe_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [edi + 0x278]
cmp eax, dword [esp + 0xc]
je 0x1004e007
push 0x10
push str.Error
push str.Main.exe_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x51c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10056040
mov esp, ebp
pop ebp
ret
Function at 0x1004e020
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x10061018]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, dword [0x100c810c]
cmp dword [ebx + 0x27c], 0
push esi
push edi
je 0x1004e13a
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0xf3]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x1004e0a7
lea ecx, [esp + 0x414]
push str.AntiHack__s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x27c]
cmp eax, dword [esp + 0x10]
je 0x1004e0e8
lea ecx, [esp + 0x414]
push str.AntiHack__s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x1004e128
push edi
lea eax, [esp + 0x414]
push str.AntiHack__s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Antihack
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1005bee4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004e13a
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10056040
mov esp, ebp
pop ebp
ret
Function at 0x1004e150
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x10061018]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, dword [0x100c810c]
cmp dword [ebx + 0x284], 0
push esi
push edi
je 0x1004e26a
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0x133]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x1004e1d7
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin1
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x284]
cmp eax, dword [esp + 0x10]
je 0x1004e218
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin1
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x1004e258
push edi
lea eax, [esp + 0x414]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin1
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1005bee4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004e26a
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10056040
mov esp, ebp
pop ebp
ret
Function at 0x1004e280
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x10061018]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, dword [0x100c810c]
cmp dword [ebx + 0x288], 0
push esi
push edi
je 0x1004e39a
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0x153]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x1004e307
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin2
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x288]
cmp eax, dword [esp + 0x10]
je 0x1004e348
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin2
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x1004e388
push edi
lea eax, [esp + 0x414]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin2
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1005bee4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1004e39a
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10056040
mov esp, ebp
pop ebp
ret