joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f920
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov esi, esp
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.0041512c
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.0041512c
mov esp, ebp
pop ebp
ret 8

Function at 0x40f980
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.0041512c
lea ecx, [eax + eax + 2]
mov esi, esp
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.0041512c
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.0041512c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x412a20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
shl ecx, 1
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov esi, esp
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.0041512c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x412a8b
mov eax, dword [ebp - 0x14]
jmp 0x412ad8
cmp dword [ebp - 0x20], 1
je 0x412a9e
cmp dword [ebp - 0x20], 2
je 0x412a9e
mov eax, 0xd
jmp 0x412ad8
cmp dword [ebp + 0xc], 0
je 0x412acc
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x412ac5
mov eax, dword [ebp - 0x2c]
shr eax, 1
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 - 2]
test edx, edx
je 0x412acc
mov eax, 0xd
jmp 0x412ad8
mov eax, dword [ebp - 0x2c]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x412b00]
call fcn.0041514f
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.0041512c
mov esp, ebp
pop ebp
ret 0xc
Function at 0x414ead
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x41bca0
call fcn.00414c68
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x414eed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x414eed
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x414f05
cmp eax, 0x20b
je 0x414ef2
mov dword [ebp - 0x1c], edi
jmp 0x414f19
cmp dword [ecx + 0x84], 0xe
jbe 0x414eed
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x414f13
cmp dword [ecx + 0x74], 0xe
jbe 0x414eed
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x4238fc], 0xffffffff
or dword [0x423900], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x423878]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x423874]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4238f8], eax
call fcn.00415240
call fcn.004152e0
cmp dword [0x423410], edi
jne 0x414f79
push fcn.004152e0
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.004152ce
push 0x423054
push 0x423050
call sub.MSVCR71.dll__initterm
push 0x415284
call fcn.00414d25
mov eax, dword [0x423870]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x42386c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x414fcd
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x42304c
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x414ff7
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x4150b1
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x415066
cmp ax, di
je 0x41500d
cmp dword [ebp - 0x20], edi
jne 0x415066
mov ax, word [esi]
cmp ax, di
je 0x415022
cmp ax, 0x20
ja 0x415022
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x41500d
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x41503e
movzx eax, word [ebp - 0x54]
jmp 0x415041
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.00406fd2
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x41505e
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x4150ab
cmp ax, 0x22
jne 0x415077
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x414ff7
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00414ca3
ret
Function at 0x415dda
Capabilities:
Parse pe header

Disassembly:
push 0x2c
push 0x41c220
call fcn.00414c68
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x415e46
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
je 0x415e1e
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x415e4c
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x415e16
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x415e16
mov al, 1
jmp 0x415e18
or dword [ebp - 4], 0xffffffff
xor al, al
call fcn.00414ca3
ret
Function at 0x415f4e
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, eax
cmp esi, 0x7ff80000
push edi
mov ebx, 0x10000
jbe 0x415f71
lea eax, [esi - 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x415f74
mov dword [ebp - 4], ebx
cmp esi, 0x80000000
jae 0x415f87
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 8], eax
jmp 0x415f8e
mov dword [ebp - 8], 0xfff80000
mov eax, dword [0x4238dc]
test eax, eax
mov ecx, dword [0x4238d8]
jne 0x415fa8
test ecx, ecx
je 0x415fbd
mov eax, ecx
mov dword [0x4238dc], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x415fbd
cmp edx, dword [ebp - 4]
jb 0x415fbd
cmp edx, dword [ebp - 8]
jbe 0x416091
mov eax, ecx
test ecx, ecx
jmp 0x415fe1
test eax, eax
je 0x415fdc
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x415fdc
cmp ecx, dword [ebp - 4]
jb 0x415fdc
cmp ecx, dword [ebp - 8]
jbe 0x416091
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x4238dc], eax
jne 0x415fc3
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp - 4]
mov edi, esi
jbe 0x41612c
cmp edi, 0x70000000
jb 0x416011
cmp edi, 0x80000000
ja 0x416011
mov edi, 0x6fff0000
push 0x1c
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41612c
cmp dword [ebp - 0x30], ebx
jne 0x416030
cmp dword [ebp - 0x34], ebx
jae 0x416043
mov edi, dword [ebp - 0x3c]
add edi, 0xffff0000
cmp edi, dword [ebp - 4]
ja 0x415ffc
jmp 0x41612c
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x4238dc], eax
je 0x41612c
mov ecx, dword [0x4238d8]
xor edx, edx
mov dword [eax + 4], ecx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov dword [0x4238d8], eax
lea ecx, [eax + 0xffe0]
mov esi, 0x7fd
mov dword [ecx + 0x18], edx
mov edx, ecx
sub ecx, 0x20
dec esi
jne 0x416083
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, dword [ebp - 4]
jb 0x416131
cmp esi, dword [ebp - 8]
ja 0x416131
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call sub.MSVCR71.dll_memset
add esp, 0xc
mov eax, esi
jmp 0x416133
cmp esi, 0x70000000
jb 0x4160d5
cmp esi, 0x80000000
ja 0x4160d5
mov esi, 0x80010000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x416131
cmp dword [ebp - 0x14], ebx
jne 0x416123
cmp dword [ebp - 0x18], ebx
jb 0x416123
mov ecx, esi
and ecx, 0xffff
je 0x416107
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x18], eax
add dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x4238dc], eax
jne 0x41605f
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
lea esi, [eax + ecx]
cmp esi, dword [ebp - 8]
jb 0x4160c0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416159
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x41c230
call fcn.00414c68
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4161b4
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x4161b0
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x1c], eax
cmp dword [eax], 0x4550
jne 0x4161b0
cmp word [eax + 0x14], 0
jne 0x4161a5
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x4161b6
mov eax, ecx
jmp 0x41619f
or dword [ebp - 4], 0xffffffff
xor eax, eax
call fcn.00414ca3
ret

Function at 0x4161ce
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
xor edi, edi
cmp dword [0x4238e4], edi
jne 0x4161f1
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x4238e4
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4161f8
mov eax, 0x10dd
jmp 0x41623c
push esi
mov esi, dword [0x4238d8]
mov dword [0x4238e0], edi
mov dword [0x4238f4], edi
mov dword [0x4238f0], edi
mov dword [0x4238e8], edi
mov dword [0x4238ec], edi
jmp 0x416235
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x41621f
xor eax, eax
pop esi
pop edi
pop ecx
ret

Function at 0x41623f
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4238e4], eax
je 0x416255
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x4238f4]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x4162a0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x416291
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x416291
call fcn.00416138
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x416264
mov dword [0x4238f4], ebx
call fcn.00415f27
mov esi, dword [0x4238f0]
cmp esi, ebx
je 0x4162cd
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x4162b5
pop edi
pop esi
mov dword [0x4238f0], ebx
mov dword [0x4238e4], ebx
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x416520
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x4238e8]
test eax, eax
jne 0x416590
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 8]
cmp edi, eax
jne 0x41653c
xor eax, eax
jmp 0x41658f
push esi
push 8
call fcn.00414c02
mov esi, eax
test esi, esi
pop ecx
jne 0x416550
push 8
pop edi
jmp 0x41656b
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x41657c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
pop ecx
and dword [0x4238ec], 0
mov dword [0x4238e8], edi
mov eax, edi
jmp 0x41658e
mov eax, dword [0x4238f0]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [0x4238f0], esi
xor eax, eax
pop esi
pop edi
ret 4
Function at 0x4167d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4238e4], eax
je 0x4167ec
mov eax, 0x10dd
jmp 0x4168c8
mov eax, dword [0x4238e8]
test eax, eax
jne 0x4168c8
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x416809
push 6
pop eax
jmp 0x4168c7
cmp dword [edi], 0
push ebx
push esi
jne 0x41681d
push 6
pop eax
mov dword [0x4238e8], eax
jmp 0x4168bf
push 0x18
call fcn.00414c02
mov esi, eax
test esi, esi
pop ecx
jne 0x416830
push 8
pop edi
jmp 0x4168a9
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.004161bc
movzx ecx, byte [edi + 0x17]
mov ebx, dword [edi + 0x18]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x41689e
cmp ecx, 0x17
ja 0x41689e
cmp dword [edi + 0x1c], eax
jne 0x41689e
lea eax, [ebp - 4]
push eax
push 0x40
push ecx
push ebx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x416874
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x4168a9
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x4238f4]
mov dword [esi], eax
mov dword [0x4238f4], esi
xor eax, eax
jmp 0x4168c5
cmp dword [0x4238e0], edx
push 9
pop edi
jne 0x4168af
mov dword [0x4238e8], edi
test esi, esi
je 0x4168ba
push esi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, edi
mov edi, dword [ebp + 8]
mov dword [0x4238ec], edi
pop esi
pop ebx
pop edi
leave
ret 8

Function at 0x4019f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019ff
push esp
mov dword [ebp - 0x24], 0x40171b
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a9e
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a7f
pop ebp
ret 0x10
Function at 0x100013d0
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x1000140c
mov eax, dword [section.L_sectio]
test eax, eax
jne 0x10001407
mov eax, dword [0x1000ff34]
push 0
push eax
push 0x10001150
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [section.L_sectio], eax
je 0x10001407
mov eax, 1
ret 4
xor eax, eax
ret 4
mov ecx, dword [section.L_sectio]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
ret 4

Function at 0x100015a0
Capabilities:
Print debug messages
Send data
Send data on socket

Disassembly:
mov eax, 0x402c
call fcn.10008bd0
mov ecx, dword [esp + 0x4030]
push edi
lea eax, [esp + 0x10]
push 0x20
push eax
push ecx
call fcn.10001700
mov edx, dword [esp + 0x4044]
add esp, 0xc
test edx, edx
je 0x10001612
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
push 0x2000
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x2034]
push ecx
push eax
push edx
call fcn.100016d0
add esp, 0x10
lea ecx, [esp + 0x2030]
lea edx, [esp + 0x10]
lea eax, [esp + 0x30]
push ecx
push edx
push str.1_s_s_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x1000162a
lea ecx, [esp + 0x10]
lea edx, [esp + 0x30]
push ecx
push str.1_s_
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1000ff90]
test eax, eax
jne 0x10001669
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x1000f020]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
push ecx
lea ecx, [esp + 0x38]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
pop edi
add esp, 0x402c
ret
lea eax, [esp + 0x30]
lea edi, [esp + 0x30]
mov dword [esp + 8], eax
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x1000fe40]
repne scasb al, byte es:[edi]
mov eax, dword [0x1000fe44]
not ecx
dec ecx
mov dword [esp + 4], ecx
mov ecx, dword [0x1000fe3c]
push ecx
mov ecx, dword [0x1000fe48]
push edx
push eax
push ecx
mov ecx, dword [0x1000f020]
lea edx, [esp + 0x1c]
push 0
push edx
lea eax, [esp + 0x1c]
push 1
push eax
push ecx
call dword [0x1000feac]
mov eax, 1
pop edi
add esp, 0x402c
ret
Function at 0x10001d40
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x10009bf8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
push str._AutoGive..............
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1000f024]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [eax*4 + 0x1000f348]
push ebx
push 4
push ecx
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push eax
call ebp
mov eax, dword [esp + 0x14]
push ebx
lea edx, [esp + 0x14]
push 4
push edx
push eax
call esi
push eax
call ebp
mov edx, dword [esp + 0x10]
push ebx
lea ecx, [esp + 0x2c]
push 4
add edx, 8
push ecx
push edx
call esi
push eax
call ebp
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x39]
mov byte [esp + 0x38], bl
rep stosd dword es:[edi], eax
mov ecx, dword [0x1000f024]
push ebx
stosb byte es:[edi], al
mov edx, dword [ecx*4 + 0x1000f1b8]
lea eax, [esp + 0x18]
push 4
push eax
push edx
mov dword [esp + 0x24], ebx
call esi
push eax
call ebp
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x10001f2a
push ebx
lea ecx, [esp + 0x14]
push 4
add eax, 0x158
push ecx
push eax
call esi
push eax
call ebp
mov eax, dword [esp + 0x10]
push ebx
lea edx, [esp + 0x28]
push 4
add eax, 0xfffffffc
push edx
push eax
call esi
push eax
call ebp
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push ebx
lea edx, [esp + 0x3c]
push ecx
push edx
push eax
call esi
push eax
call ebp
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x38]
mov dword [esp + 0x74], ebx
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
push ecx
lea edx, [esp + 0x30]
push str._X__X__d__s
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x38]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x18]
mov byte [esp + 0x74], 1
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [0x1000ff8c]
lea ecx, [esp + 0x1c]
push ecx
push 0x508
lea ecx, [edx + 0x3fc]
mov byte [esp + 0x7c], 2
call sub.MFC42.DLL_CWnd::GetDlgItemTextA
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x38]
push eax
push ecx
lea edx, [esp + 0x20]
push str._s__s
push edx
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x38]
xor eax, eax
push ebx
push ebx
mov dword [esp + 0x48], eax
push ebx
push ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x54], eax
push 0x419
lea edx, [esp + 0x50]
push edx
call fcn.10001b00
add esp, 0x28
lea ecx, [esp + 0x18]
push ebx
call sub.MFC42.DLL_CString::GetBuffer
push eax
lea eax, [esp + 0x30]
push eax
call fcn.100015a0
add esp, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0x74], 1
call fcn.100086d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x74], bl
call fcn.100086d4
lea ecx, [esp + 0x20]
mov dword [esp + 0x74], 0xffffffff
call fcn.100086d4
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret
Function at 0x10003180
Capabilities:
Get number of processors
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x10009ca8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [0x1000f024]
push ebx
push ebp
push esi
mov ebx, dword [eax*4 + 0x1000f4d8]
xor eax, eax
sub ebx, 0x2e8
xor ecx, ecx
mov dword [esp + 0x29], ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 0x2d], ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [esp + 0x35], ecx
mov dword [esp + 0x39], ecx
mov dword [esp + 0x1c], eax
mov word [esp + 0x3d], cx
mov byte [esp + 0x14], al
mov dword [esp + 0x10], eax
mov byte [esp + 0x2c], al
mov byte [esp + 0x3f], cl
mov dword [esp + 0x18], eax
lea ebp, [ebx + 0x73]
xor edx, edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], edx
lea ecx, [ebp - 0x74]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edx
push edx
push 1
push eax
push ecx
mov dword [esp + 0x4c], edx
call esi
push eax
call edi
mov edx, dword [esp + 0x14]
push 0
and edx, 0xff
lea eax, [esp + 0x30]
push edx
push eax
push ebx
call esi
push eax
call edi
push 0
lea ecx, [esp + 0x20]
push 4
push ecx
push ebp
call esi
push eax
call edi
push 0
lea edx, [esp + 0x14]
push 2
lea eax, [ebp + 4]
push edx
push eax
call esi
push eax
call edi
mov al, byte [esp + 0x14]
test al, al
je 0x1000326d
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x10003298
mov eax, dword [esp + 0x18]
add ebx, 0x7c
add ebp, 0x7c
inc eax
cmp eax, 0x2e
mov dword [esp + 0x18], eax
jl 0x100031ee
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
mov ecx, dword [esp + 0x1c]
xor edi, edi
push edi
push edi
xor eax, eax
push edi
push ecx
lea edx, [esp + 0x30]
mov dword [esp + 0x34], eax
push 0x3ee
push edx
mov dword [esp + 0x38], edi
mov dword [esp + 0x40], eax
call fcn.10001b00
lea eax, [esp + 0x44]
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.100015a0
add esp, 0x20
lea ecx, [esp + 0x50]
call sub.MFC42.DLL_CString::CString_1
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x50]
and edx, 0xffff
mov dword [esp + 0x48], edi
push edx
push str.vv__d
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x5c]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x10]
cmp ax, 2
jae 0x10003320
push edi
lea edx, [esp + 0x18]
push 1
mov byte [esp + 0x1c], 0
push edx
dec ebx
jmp 0x10003347
cmp ax, 0x3e8
jbe 0x1000332d
add eax, 0xfc18
jmp 0x10003338
cmp ax, 0x64
jae 0x1000333c
add eax, 0xffff
mov dword [esp + 0x10], eax
push edi
lea eax, [esp + 0x14]
push 2
push eax
add ebx, 0x77
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea ecx, [esp + 0x50]
mov dword [esp + 0x48], 0xffffffff
call fcn.100086d4
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret