joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4128c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Enter_function_BOOL_CheckAndRecoverDevice___n
call edi
xor ebx, ebx
push 0x20c
lea eax, [ebp - 0x214]
push ebx
push eax
mov dword [ebp - 0x218], ebx
call fcn.0041d650
add esp, 0xc
lea ecx, [ebp - 0x218]
call fcn.00412050
cmp dword [ebp - 0x218], 2
jne 0x412920
push str.Status.configStatus__DeviceNotConfigurate_n
call edi
mov ebx, 1
lea eax, [ebp - 0x218]
call fcn.00412460
call fcn.00408760
cmp eax, 0x1e
jne 0x4129a7
cmp dword [ebp - 0x218], 1
jne 0x4129a7
mov esi, str.BTHENUM61118058_486c_4bb0_b4b8_ace4dcadec44_LOCALMFG0000
call fcn.004127d0
test eax, eax
je 0x412968
mov esi, str.BTHENUMdd533152_01f4_435c_abfe_984bc21a2a65_LOCALMFG0000
call fcn.004127d0
test eax, eax
je 0x412968
mov esi, str.BTHENUMcbecab40_a2c8_4ab3_adc1_de0fe95d8600_LOCALMFG0000
call fcn.004127d0
test eax, eax
jne 0x4129a7
push str.The_Audio__LwFilter__VirtualBluetoothSupport_dirver_YB__do_disable_enable_driver_to_recover_it_n
call edi
push str.Enter_Function_DisableRadioHandler__n_n
call edi
mov ecx, dword [0x436850]
mov esi, dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0
push 1
push 0x5e5d
push ecx
call esi
push str.Enter_Function_DisableRadioHandler__n_n
call edi
mov edx, dword [0x436850]
push 0
push 0
push 0x5e5d
push edx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0041558a
mov esp, ebp
pop ebp
ret

Function at 0x4129c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.Software_atherosVistaAddon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4129eb
xor al, al
mov esp, ebp
pop ebp
ret
mov eax, 4
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.HidePBAP
push ecx
mov dword [ebp - 8], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x412a2e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 1
setne al
mov esp, ebp
pop ebp
ret
Function at 0x413ea0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x413ec7
mov eax, dword [esi]
jmp 0x413ec9
mov eax, esi
lea edx, [ebp - 0x238]
xor ecx, ecx
push edx
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x238]
cmp ax, 9
je 0x413eee
cmp ax, 6
jne 0x413ef8
mov dword [0x4357a4], 0xf013f
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.0041d650
mov eax, dword [0x4357a4]
mov ecx, dword [0x4357a0]
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push eax
push 0
push str.SOFTWAREAtherosVistaAddOn
push ecx
mov dword [ebp - 0x214], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413f7e
mov ecx, dword [ebp - 0x210]
push edi
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.InstallDir
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x210]
push edx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
je 0x413f8f
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x413f7e
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413fb0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
call fcn.0040b550
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x414c50
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x10
xor esi, esi
push esi
push esi
push 0x434f70
mov dword [ebp - 0x24], esi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov ebx, eax
xor eax, eax
cmp ebx, esi
jbe 0x414d50
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x20]
push eax
push esi
push ebx
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x414d46
push edi
mov ecx, dword [ebp - 0xc]
push 0
mov eax, 0xff
push ecx
lea edx, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
push edx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SETUPAPI.dll_CM_Get_DevNode_Status]
mov edi, eax
push edi
push str.The_status_of_uResult_is__d__n
call fcn.0040ca40
mov ecx, dword [ebp - 0x28]
push ecx
push str.The_status_of_uProblem_is__d__n
call fcn.0040ca40
add esp, 0x10
test edi, edi
je 0x414d33
xor eax, eax
inc esi
push esi
mov dword [ebp - 0x20], eax
push str.The_MemberIndex_of_SetupDiEnumDeviceInfo_is__d__n
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], 0x1c
call fcn.0040ca40
add esp, 8
lea edx, [ebp - 0x20]
push edx
push esi
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x414cb3
jmp 0x414d45
push str.This_device_is_3002_UART_dongle._n
mov dword [ebp - 0x24], 1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
pop edi
push ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041558a
mov esp, ebp
pop ebp
ret

Function at 0x414d60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.0041d650
add esp, 0xc
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x414e0d
push 0x208
lea edx, [ebp - 0x20c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
push str.The_cServPath_is__s__n
call fcn.0040ca40
lea ecx, [ebp - 0x20c]
push str.system32
push ecx
call fcn.00415ac5
add esp, 0x10
test eax, eax
jne 0x414df6
lea edx, [ebp - 0x20c]
push str.System32
push edx
call fcn.00415ac5
add esp, 8
test eax, eax
je 0x414e06
push str.This_adminservice_is_for_MSFT_WU_or_3002_Intel._n
mov edi, 1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0041558a
mov esp, ebp
pop ebp
ret
Function at 0x415320
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008c
call fcn.00421620
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x43595c]
push esi
push edi
test eax, eax
je 0x415492
cmp ecx, eax
jg 0x415492
test ecx, eax
je 0x415492
push 0x435958
call fcn.00415180
lea eax, [ebp - 0x10084]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edi, dword [0x435958]
cmp edi, 0xffffffff
jne 0x415386
mov esi, 0x435958
call fcn.004150a0
mov edi, eax
jmp 0x4153d6
mov cx, word [ebp - 0x10084]
cmp cx, word [0x435968]
jne 0x4153b6
mov dx, word [ebp - 0x10082]
cmp dx, word [0x43596a]
jne 0x4153b6
mov ax, word [ebp - 0x1007e]
cmp ax, word [0x43596e]
je 0x4153d6
cmp edi, 0xffffffff
je 0x4153c2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x435958
mov dword [0x435958], 0xffffffff
call fcn.004150a0
test edi, edi
je 0x41547e
mov ecx, dword [0x435960]
movzx edx, word [ebp - 0x10076]
movzx eax, word [ebp - 0x10078]
push ecx
movzx ecx, word [ebp - 0x1007a]
push edx
movzx edx, word [ebp - 0x1007c]
push eax
push ecx
push edx
lea eax, [ebp - 0x10074]
push str._02d:_02d:_02d__03d__X:
push eax
call fcn.00415599
mov edx, dword [ebp + 8]
add esp, 0x1c
lea ecx, [ebp + 0xc]
push ecx
push edx
mov esi, eax
lea eax, [ebp + esi*2 - 0x10074]
push 0x8000
push eax
call fcn.004173ec
add esi, eax
lea ecx, [ebp + esi*2 - 0x10074]
push 0x430f5c
push ecx
call fcn.00415599
lea eax, [ebp - 0x10074]
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415455
sub eax, edx
push 0
sar eax, 1
lea edx, [ebp - 0x10088]
push edx
add eax, eax
push eax
lea ecx, [ebp - 0x10074]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x435960
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.0041558a
mov esp, ebp
pop ebp
ret

Function at 0x41558a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434304]
jne 0x415594
repz ret
jmp fcn.004175e9

Function at 0x41e1a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41e1cf
call fcn.00418671
mov dword [eax], esi
call fcn.0041865e
push 0x16
pop esi
mov dword [eax], esi
call fcn.0041860c
mov eax, esi
jmp 0x41e224
test dword [ebp + 0xc], 0xfffffff9
jne 0x41e1b5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41e1fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00418684
pop ecx
call fcn.0041865e
mov eax, dword [eax]
jmp 0x41e224
test al, 0x10
jne 0x41e222
test al, 1
je 0x41e222
test byte [ebp + 0xc], 2
je 0x41e222
call fcn.00418671
mov dword [eax], 5
call fcn.0041865e
mov dword [eax], 0xd
jmp 0x41e1f3
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42034c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004190c4
and dword [ebp - 0x14], 0
cmp dword [0x436784], 0
mov dword [ebp - 0x18], eax
jne 0x4203ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4204a7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4204a7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x436784], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x436788], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43678c], eax
call edi
push eax
call esi
mov dword [0x436794], eax
test eax, eax
je 0x4203ff
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x436790], eax
mov eax, dword [0x436790]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x420458
cmp dword [0x436794], ecx
je 0x420458
push eax
call esi
push dword [0x436794]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x420458
test ebx, ebx
je 0x420458
call edi
test eax, eax
je 0x42044f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42044f
test byte [ebp - 8], 1
jne 0x420458
or dword [ebp + 0x10], 0x200000
jmp 0x42048b
mov eax, dword [0x436788]
cmp eax, dword [ebp - 0x18]
je 0x42048b
push eax
call esi
test eax, eax
je 0x42048b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42048b
mov eax, dword [0x43678c]
cmp eax, dword [ebp - 0x18]
je 0x42048b
push eax
call esi
test eax, eax
je 0x42048b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x436784]
call esi
test eax, eax
je 0x4204a7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4204a9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041558a
leave
ret
Function at 0x1000d1a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1013b3dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp byte [edi + 8], 0
je 0x1000d1ec
mov eax, dword [edi]
cmp ebx, eax
jne 0x1000d1d7
cmp dword [edi + 4], esi
je 0x1000d1d7
mov dword [edi + 4], esi
jmp 0x1000d369
test eax, eax
je 0x1000d1ec
push eax
call fcn.100c1950
push dword [edi]
call fcn.100c1810
mov byte [edi + 8], 0
lea eax, [ebp - 0x210]
mov dword [edi], ebx
push eax
push 0x40
push 0xe
push ebx
mov dword [edi + 4], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000d21c
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c55b5
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi]
mov cl, byte [eax]
cmp cl, 0xe9
je 0x1000d22e
cmp cl, 0xe8
jne 0x1000d350
mov esi, dword [eax + 1]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esi, eax
push 0x1c
lea eax, [ebp - 0x22c]
push eax
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x1000d262
cmp dword [ebp - 0x21c], 0x1000
jne 0x1000d262
mov esi, dword [ebp - 0x228]
push 0x103
lea eax, [ebp - 0x108]
push eax
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_K32GetMappedFileNameA]
test eax, eax
lea eax, [ebp - 0x108]
je 0x1000d28a
mov dword [ebp - 0x230], eax
jmp 0x1000d2ad
push 0x103
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
lea ecx, [ebp - 0x108]
mov eax, str.unknown
cmove ecx, eax
mov dword [ebp - 0x230], ecx
mov esi, dword [edi]
call ebx
push 0x1c
lea ecx, [ebp - 0x22c]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x1000d2d8
cmp dword [ebp - 0x21c], 0x1000
mov esi, dword [ebp - 0x228]
je 0x1000d2da
mov esi, dword [edi]
push 0x103
lea eax, [ebp - 0x20c]
push eax
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_K32GetMappedFileNameA]
test eax, eax
je 0x1000d2fc
lea esi, [ebp - 0x20c]
jmp 0x1000d31f
push 0x103
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
lea esi, [ebp - 0x20c]
mov eax, str.unknown
cmove esi, eax
push 0x5c
push esi
call fcn.100c7d60
add esp, 8
test eax, eax
je 0x1000d331
lea esi, [eax + 1]
mov ecx, dword [0x1018b4c0]
test ecx, ecx
je 0x1000d350
push dword [ebp - 0x230]
mov eax, dword [ecx]
push esi
push str.WARNING:_Another_hook_is_already_present_while_trying_to_hook__s__hook_target_is__s._If_you_experience_crashes__try_disabling_the_other_hooking_application._n
push ecx
call dword [eax + 0x1c]
add esp, 0x10
mov ecx, dword [edi]
movq xmm0, qword [ecx]
movq qword [edi + 9], xmm0
mov eax, dword [ecx + 8]
mov dword [edi + 0x11], eax
mov ax, word [ecx + 0xc]
mov word [edi + 0x15], ax
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c55b5
mov esp, ebp
pop ebp
ret 8
Function at 0x10013e70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10013ea2
jl 0x10013e95
test ecx, ecx
jne 0x10013ea2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10013f62
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10015710
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10013f0e
jg 0x10013ecd
test esi, esi
je 0x10013f0e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10013ee5
mov eax, dword [esp + 0x10]
jl 0x10013edf
cmp eax, esi
jae 0x10013ee5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.100c7fd0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10013f2f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x10013f4b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10013eb4
jl 0x10013f4b
test ecx, ecx
jne 0x10013eb4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10013fa6
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x10013fa6
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.100c7fd0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x10014017
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10013fcc
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x10014002
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.100cfe9a
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10014017
cmp edi, eax
ja 0x10013fe0
test edi, edi
je 0x10014017
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.100cfe9a
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10015930
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f20e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1013b3dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100c57d1
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.100c44b8
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c870
Capabilities:
Create thread
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1013b3dc]
xor eax, esp
mov dword [esp + 0x24], eax
cmp dword [ebp + 0xc], 1
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x1001ca37
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1001ca4f
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov dword [0x10189cd8], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
mov dword [esp + 0x28], 0
lea eax, [esp + 0x24]
mov dword [0x10189ce0], edi
push eax
push 0x1001c310
mov dword [esp + 0x2c], edi
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 0x28]
test ecx, ecx
jne 0x1001c8fa
push edi
push str.FindWindowById
push str._s:_handle_window_by_process_id__lu_not_found._n
call fcn.100a6550
mov ecx, dword [esp + 0x34]
add esp, 0xc
cmp dword [0x10189cd8], 0
mov dword [0x10189cdc], ecx
je 0x1001ca4f
cmp dword [0x10189ce0], 0
je 0x1001ca4f
test ecx, ecx
je 0x1001ca4f
call fcn.1001c380
test eax, eax
je 0x1001ca4f
mov ecx, dword [0x10189cf4]
mov eax, 0x7fffffff
sub eax, ecx
cmp eax, 9
jb 0x1001ca58
cmp dword [0x10189cf8], 0x10
mov eax, 0x10189ce4
push 9
cmovae eax, dword [0x10189ce4]
push str.debug.log
push ecx
push eax
push ecx
push dword [esp + 0x38]
lea ecx, [esp + 0x24]
call fcn.10019a30
lea eax, [esp + 0xc]
mov ecx, 0x10189cfc
push eax
call fcn.1001ca70
mov ecx, dword [esp + 0x20]
cmp ecx, 0x10
jb 0x1001c9b4
mov edx, dword [esp + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001c9aa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001ca5d
push ecx
push edx
call fcn.100c5916
add esp, 8
push dword [0x10189ce0]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
push 0
push 0
push 0x1001c820
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xff
push 0x1018632c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x1018632c
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001ca10
sub ecx, edx
lea eax, [ecx + 0x1018632c]
cmp eax, 0x1018632c
jb 0x1001ca33
cmp byte [eax], 0x5c
je 0x1001ca33
dec eax
cmp eax, 0x1018632c
jae 0x1001ca26
mov byte [eax + 1], 0
mov ecx, dword [esp + 0x2c]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.100c55b5
mov esp, ebp
pop ebp
ret 0xc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
call fcn.100030f0
call fcn.100ce6d5
int3