joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b780
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0xc8]
sub esp, 0xc8
push 0xffffffffffffffff
push 0x1001b0db
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100221c0]
xor eax, ebp
mov dword [ebp + 0xc4], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [0x10025260], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
lea eax, [ebp]
push 0x40
push eax
call fcn.1000de0b
add esp, 0x14
lea edx, [ebp]
push edx
push 1
xor ecx, ecx
push esi
mov word [ebp + 0x80], cx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
mov dword [ebp - 0x18], ebx
cmp ebx, esi
je 0x1000b96d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000b81e
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e
lea ecx, [ebp + 0x86]
xor eax, eax
push esi
mov dword [ebp - 4], esi
push ecx
mov word [ebp + 0x84], ax
call fcn.1000d630
add esp, 0xc
push 0x1f
lea edx, [ebp + 0x84]
push edx
call fcn.1000b470
mov dword [ebp - 0x14], esi
cmp eax, esi
je 0x1000b885
lea edx, [ebp - 0x14]
xor ecx, ecx
push edx
mov word [ebp + eax*2 + 0x84], cx
lea eax, [ebp + 0x84]
push 0x1001f710
push eax
call fcn.1000d987
add esp, 0xc
cmp eax, 1
jne 0x1000b885
mov eax, dword [ebp - 0x14]
mov dword [0x10025260], eax
jmp 0x1000b955
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x1000b89f
push 0x5c0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x1000b8b3
push ebx
push esi
call fcn.1000bbd0
jmp 0x1000b8b5
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x10025260], eax
test eax, eax
jne 0x1000b8d7
push 0x100204b4
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], 1
call fcn.1000d18b
push eax
lea edx, [ebp + 0x84]
push 0x1001f710
push edx
mov edi, 1
call fcn.1000cd97
add esp, 0xc
lea esi, [ebp + 0x84]
call fcn.1000b5b0
test eax, eax
jne 0x1000b94e
push 0x100204b4
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 3
call fcn.1000d18b
call fcn.1000b650
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, dword [0x10025260]
test esi, esi
je 0x1000b93f
call fcn.1000bcb0
mov dword [0x10025260], 0
jmp 0x1000b946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x1000b94c
ret
mov eax, dword [0x10025260]
xor esi, esi
inc dword [eax + 0x5bc]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp edi, esi
jne 0x1000b96d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x10025260
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc4]
xor ecx, ebp
call fcn.1000c28b
add ebp, 0xc8
mov esp, ebp
pop ebp
ret
Function at 0x1000b9a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001b050
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100221c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x10025260]
xor edi, edi
cmp ecx, edi
jne 0x1000b9eb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x1000b9f8
mov dword [ebp - 0x14], edi
jmp 0x1000ba10
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x1000baa6
mov ecx, dword [0x10025260]
mov eax, dword [ecx]
cmp eax, edi
je 0x1000b9d7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1000b9d7
mov ebx, 0x10025260
mov dword [ebp - 4], edi
call fcn.1000bac0
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x1000ba4e
push 0x100204b4
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 1
call fcn.1000d18b
mov ecx, dword [0x10025260]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x1000ba68
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x1000ba92
push 0x100204b4
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 4
call fcn.1000d18b
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1000ba89
call fcn.1000bdd0
mov eax, 0x1000ba8f
ret
mov eax, dword [0x10025260]
mov eax, dword [eax]
test eax, eax
je 0x1000baa4
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bac0
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x1000baed
xor ecx, ecx
jmp 0x1000baf9
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x1000bbad
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x1000bb20
mov dword [esp + 0xc], esi
jmp 0x1000bb80
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x1000bb79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1000bb6c
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x1000bb80
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1000bb80
push 0x1001f718
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1000bb80
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x1000bba3
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x1000bb12
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x1000bbc1
mov ecx, dword [ebx]
add ecx, 8
call fcn.1000bd00
test eax, eax
je 0x1000bbc1
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x1000bbd0
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x1001b0ab
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100221c0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.1000d630
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x1000bc68
push 0x100204b4
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.1000d18b
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8

Function at 0x1000c28b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100221c0]
jne 0x1000c295
repz ret
jmp fcn.1000e5d9
Function at 0x10017065
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000e788
and dword [ebp - 4], 0
cmp dword [0x10024254], 0
mov ebx, eax
jne 0x10017116
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100171c7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100171c7
push eax
call fcn.1000e716
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10024254], eax
call esi
push eax
call fcn.1000e716
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10024258], eax
call esi
push eax
call fcn.1000e716
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1002425c], eax
call esi
push eax
call fcn.1000e716
pop ecx
mov dword [0x10024264], eax
test eax, eax
je 0x10017116
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000e716
pop ecx
mov dword [0x10024260], eax
mov eax, dword [0x10024260]
cmp eax, ebx
je 0x1001716e
cmp dword [0x10024264], ebx
je 0x1001716e
push eax
call fcn.1000e791
push dword [0x10024264]
mov esi, eax
call fcn.1000e791
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001716e
test edi, edi
je 0x1001716e
call esi
test eax, eax
je 0x10017165
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10017165
test byte [ebp - 0xc], 1
jne 0x1001716e
or dword [ebp + 0x10], 0x200000
jmp 0x100171a7
mov eax, dword [0x10024258]
cmp eax, ebx
je 0x100171a7
push eax
call fcn.1000e791
pop ecx
test eax, eax
je 0x100171a7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100171a7
mov eax, dword [0x1002425c]
cmp eax, ebx
je 0x100171a7
push eax
call fcn.1000e791
pop ecx
test eax, eax
je 0x100171a7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10024254]
call fcn.1000e791
pop ecx
test eax, eax
je 0x100171c7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100171c9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x49e4a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x45a640
sub eax, eax
test esi, esi
je 0x49e580
sub eax, 1
test ecx, ecx
je 0x49e57e
test esi, 3
je 0x49e4de
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x49e4c3
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x49e565
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x49e4ec
mov ecx, edx
test ecx, ecx
je 0x49e57e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x49e56b
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x49e612
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466d40
push 0x49ea62
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x4a525c], 0xffffffff
or dword [0x4a5260], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4a5200]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x4a51fc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4a5264], eax
call fcn.0049ea61
cmp dword [0x45aa40], 0
jne 0x49e695
push 0x49ea5e
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0049ea4c
push 0x401204
push 0x401200
call sub.MSVCRT.dll__initterm
mov eax, dword [0x4a51f8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4a51f4]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x4011fc
push 0x4011f8
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00467b18
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x6973e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a7000]
push edi
or ebp, 0xffffffff
jmp 0x697402
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x697409
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6973f8
mov eax, 1
add ebx, ebx
jne 0x69741b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x69742c
jne 0x69744b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69744b
dec eax
add ebx, ebx
jne 0x697438
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x697410
add ebx, ebx
jne 0x697447
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x69749d
xor ecx, ecx
sub eax, 3
jb 0x697463
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6974d2
sar eax, 1
mov ebp, eax
jmp 0x69746e
add ebx, ebx
jne 0x69746e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69743c
inc ecx
add ebx, ebx
jne 0x69747c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69743c
add ebx, ebx
jne 0x697489
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x69747e
jne 0x69749a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x69747e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6974bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6974ae
jmp 0x6973fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6974bc
add edi, ecx
jmp 0x6973fe
pop esi
mov edi, esi
mov ecx, 0x6268
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6974da
cmp byte [edi], 0x21
jne 0x6974da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6974df
lea edi, [esi + 0x28e000]
mov eax, dword [edi]
or eax, eax
je 0x697557
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x29cfac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x29d0ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x69750c
mov ecx, edi
jns 0x69753b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x29d0f0]
or eax, eax
je 0x697551
mov dword [ebx], eax
add ebx, 4
jmp 0x697529
call dword [esi + 0x29d100]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x697588
cmp al, 0xef
ja 0x69757b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x69755d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x69756a
mov ebp, dword [esi + 0x29d0f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6975bc
sub esp, 0xffffff80
jmp 0x4a818f
Function at 0x10001280
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [eax]
cmp edx, 2
jb 0x1000135c
push ebx
push edi
mov edi, dword [ebp + 8]
add ecx, 2
nop word [eax + eax]
movzx eax, byte [ecx - 2]
mov bl, byte [eax + 0x10041210]
test bl, bl
js 0x10001357
movzx eax, byte [ecx - 1]
mov al, byte [eax + 0x10041210]
test al, al
js 0x10001357
test esi, esi
je 0x100012d4
sar al, 4
shl bl, 2
or al, bl
mov byte [edi], al
inc edi
dec esi
cmp edx, 2
je 0x10001357
mov al, byte [ecx]
cmp al, 0x3d
jne 0x100012eb
cmp edx, 4
jne 0x10001357
cmp byte [ecx + 1], al
jne 0x10001357
jmp 0x10001348
movzx eax, al
mov bl, byte [eax + 0x10041210]
test bl, bl
js 0x10001357
test esi, esi
je 0x10001312
movzx eax, byte [ecx - 1]
sar bl, 2
mov al, byte [eax + 0x10041210]
shl al, 4
or al, bl
mov byte [edi], al
inc edi
dec esi
cmp edx, 3
je 0x10001357
mov al, byte [ecx + 1]
cmp al, 0x3d
jne 0x10001325
cmp edx, 4
jne 0x10001357
jmp 0x10001348
movzx eax, al
mov bl, byte [eax + 0x10041210]
test bl, bl
js 0x10001357
test esi, esi
je 0x10001348
movzx eax, byte [ecx]
mov al, byte [eax + 0x10041210]
shl al, 6
or al, bl
mov byte [edi], al
inc edi
dec esi
sub edx, 4
add ecx, 4
cmp edx, 2
jae 0x100012a0
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
sub dword [eax], esi
test edx, edx
pop esi
sete al
pop ebp
ret
Function at 0x10002f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100338d6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10048070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.10002fe0
mov eax, dword [edi + 0x8c]
lea ecx, [edi + 0x8c]
call dword [eax]
mov edx, dword [edi + 0x94]
test edx, edx
je 0x10002fb5
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10002fb5
cmp dword [eax + 0x14], 0x10
jb 0x10002f76
mov eax, dword [eax]
push edx
push ecx
push 1
push eax
call fcn.1001d2b4
add esp, 0x10
test eax, eax
jg 0x10002fa7
call fcn.1001d385
push str.filelog::write_file_with_hour
push str.....includesobaselogger_flogger.cpp
push dword [eax]
push str._filelog__write_failed__d____s:_s_n
call fcn.10001900
add esp, 0x10
jmp 0x10002fb5
push dword [edi + 0x94]
call fcn.10019dd1
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [edi + 0x8c]
mov eax, dword [edi + 0x8c]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10005ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push 2
push 0
push ebx
mov dword [ebp - 4], ecx
call fcn.1001a1da
add esp, 0xc
test eax, eax
je 0x10005ee8
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push ebx
call fcn.10019438
mov esi, eax
add esp, 4
test esi, esi
jns 0x10005f05
pop esi
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret 4
jne 0x10005f11
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
push esi
call fcn.10013d44
mov edi, eax
add esp, 4
test edi, edi
jne 0x10005f2d
lea eax, [edi - 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push 0
push ebx
call fcn.1001a1da
push ebx
push esi
push 1
push edi
call fcn.1001e269
add esp, 0x1c
cmp eax, esi
je 0x10005f5f
push edi
call fcn.100134c6
add esp, 4
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.10006100
push edi
mov esi, eax
call fcn.100134c6
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10008400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10033cd6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10048070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 0xc]
mov dword [edi], vtable.CDDAHook.0
mov byte [edi + 4], 0
push eax
mov dword [edi + 8], vtable.CCrtSection.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0
lea esi, [edi + 0x40]
xor eax, eax
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov word [edi + 0x2c], ax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.10006d80
mov dword [esi], eax
lea esi, [edi + 0x48]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1000ac20
mov dword [esi], eax
mov eax, edi
mov byte [edi + 0x50], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100094d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10048070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10048c04]
test eax, eax
je 0x100095a2
cmp dword [0x1004a240], 0
je 0x100095a2
cmp dword [0x1004a210], 0
je 0x100095a2
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push 0x40
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10009576
mov ecx, dword [0x10048c04]
mov eax, dword [0x1004a240]
mov dword [ecx + 0x40], eax
mov eax, dword [0x10048c04]
mov ecx, dword [0x1004a210]
mov dword [eax + 0x5c], ecx
mov eax, dword [ebp - 8]
test eax, eax
je 0x1000955e
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push ecx
push eax
push 0x64
push dword [0x10048c04]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str._DDAPrivacy__VTable_reset
push 0x223
push str.CDDAHook::UnInitD3DHook
push str...DwmHookDwmBlackScreenDDAHook.cpp
push 8
jmp 0x100095b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._DDAPrivacy__VirtualProtect_failed__LastError_d
push 0x227
push str.CDDAHook::UnInitD3DHook
push str...DwmHookDwmBlackScreenDDAHook.cpp
push 4
push 0x1004a248
call fcn.100026e0
add esp, 0x1c
jmp 0x100095c5
push str._DDAPrivacy__VTable_or_Present_not_valid
push 0x22c
push str.CDDAHook::UnInitD3DHook
push str...DwmHookDwmBlackScreenDDAHook.cpp
push 2
push 0x1004a248
call fcn.100026e0
add esp, 0x18
cmp word [0x10048c0c], 0
je 0x100095eb
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push str.sunlogin_dwm_wnd_cls
call dword [sym.imp.USER32.dll_UnregisterClassW]
xor eax, eax
mov word [0x10048c0c], ax
mov eax, dword [0x10048c08]
test eax, eax
je 0x10009605
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x10048c08], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001347d
mov esp, ebp
pop ebp
ret
Function at 0x1000b940
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100340da
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10048070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.1001241f
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x1000ba00
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.10015b20
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x10046280
push eax
call fcn.10015e13
push edi
push esi
call fcn.10012767
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001347d
mov esp, ebp
pop ebp
ret 4