joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001980
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10001995
xor eax, eax
jmp 0x10001a0a
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x10000
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x100019c2
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x38d
jae 0x10001a05
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
cmp dword [eax + edx + 0x40], 0
je 0x10001a03
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x100019ff
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x10001a03
xor eax, eax
jmp 0x10001a0a
jmp 0x100019b9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001ac0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1001a3d4], 0
je 0x10001ad9
mov eax, dword [0x1001a3d4]
jmp 0x10001b79
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10001aeb
xor eax, eax
jmp 0x10001b79
push 8
call fcn.1001277d
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001b41
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10001b2a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10013170
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1001a3d4], eax
mov dword [0x1001a3d8], 0
mov eax, dword [ebp - 8]
jmp 0x10001b79
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10001b5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x10001b0b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1001a3dc]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1001a3dc], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a5c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013ddc
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1001a010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
push 0x3c
call fcn.1001277d
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 0xc]
mov ecx, esi
push 0
push 0
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0x10]
push ebx
push edi
call fcn.10009ea0
mov byte [ebp - 4], 1
mov dword [esi], vtable.Buttons.0
add esi, 0x28
mov dword [ebp + 0x10], esi
push 0x18
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1001277d
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov esi, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp + 0x10], esi
mov dword [esi + 8], ebx
mov ebx, dword [ebp - 0x14]
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 0
mov byte [esi + 0x38], 0
mov dword [esi + 4], edi
mov eax, dword [ebx + 0x2c]
cmp eax, dword [ebx + 0x30]
je 0x1000a683
mov dword [eax], esi
add dword [ebx + 0x2c], 4
jmp 0x1000a690
lea ecx, [ebp + 0x10]
push ecx
push eax
lea ecx, [ebx + 0x28]
call fcn.10009d40
mov dword [esi + 0x1c], ebx
cmp dword [ebx + 0x3c], 0
jne 0x1000a6a6
cmp byte [esi + 0x1a], 0
je 0x1000a6a6
mov dword [ebx + 0x3c], esi
mov byte [esi + 0x1b], 1
mov esi, dword [ebx + 0x2c]
lea eax, [ebp + 8]
sub esi, dword [ebx + 0x28]
lea ecx, [ebx + 0x34]
push eax
sar esi, 2
call fcn.10005c70
lea ecx, [esi - 1]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000ddd0
Capabilities:
Encode data using xor
Encrypt data using xtea
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1001a010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x28], ebx
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
cmp eax, 1
jne 0x1000ddfc
mov ax, word [ebx]
mov word [ecx + 2], ax
jmp 0x1000de1a
cmp eax, 2
jne 0x1000de14
mov dword [ecx + 2], 0xc1e7cae
mov ecx, dword [ebx + 0xc]
mov ax, word [ebx]
mov word [ecx + 6], ax
jmp 0x1000de1a
mov ax, word [ebx]
mov word [ecx], ax
mov eax, dword [0x7998bc]
xor edx, edx
cmp dword [ebx + 8], 2
mov esi, dword [ebx]
sete dl
mov dword [ebp - 0x14], eax
mov eax, dword [0x7998c0]
mov dword [ebp - 0x10], eax
mov eax, dword [0x7998c4]
lea edx, [edx*4 + 2]
mov dword [ebp - 0xc], eax
mov eax, dword [0x7998c8]
add esi, edx
mov ecx, esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], esi
and ecx, 0x80000007
jns 0x1000de65
dec ecx
or ecx, 0xfffffff8
add ecx, 1
je 0x1000de73
mov eax, 8
sub eax, ecx
add esi, eax
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebx + 0xc]
mov eax, esi
add ecx, edx
cdq
and edx, 3
mov dword [ebp - 0x20], ecx
add eax, edx
sar eax, 2
mov dword [ebp - 0x24], eax
test eax, eax
jle 0x1000df01
xor ebx, ebx
push edi
mov esi, dword [ecx + ebx*4]
xor eax, eax
mov edi, dword [ecx + ebx*4 + 4]
mov dword [ebp - 0x18], 0x20
mov edx, edi
mov ecx, edi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
and ecx, 3
add edx, edi
mov ecx, dword [ebp + ecx*4 - 0x14]
add ecx, eax
sub eax, 0x61c88647
xor edx, ecx
add esi, edx
mov edx, esi
mov ecx, esi
shl ecx, 4
shr edx, 5
xor edx, ecx
mov ecx, eax
shr ecx, 0xb
add edx, esi
and ecx, 3
mov ecx, dword [ebp + ecx*4 - 0x14]
add ecx, eax
xor edx, ecx
add edi, edx
sub dword [ebp - 0x18], 1
jne 0x1000dea0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + ebx*4], esi
mov dword [ecx + ebx*4 + 4], edi
add ebx, 2
cmp ebx, dword [ebp - 0x24]
jl 0x1000de90
mov ebx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x1c]
pop edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffffe
add ecx, esi
mov word [eax], cx
mov ecx, dword [ebx + 0xc]
mov dword [ebx], esi
push 0
movzx eax, word [ecx]
add eax, 2
push eax
push ecx
push dword [0x1001a060]
call dword [sym.imp.WS2_32.dll_send]
push dword [ebx + 0xc]
call fcn.10012ce6
push 0x10
push ebx
call fcn.100127ad
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
pop ebx
call fcn.1001276f
mov esp, ebp
pop ebp
ret 4
Function at 0x1000df50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 4
push 4
push 0x5b8610
call ebx
lea eax, [ebp - 8]
mov dword [0x5b8610], 0x1000c840
push eax
push dword [ebp - 4]
push 4
push 0x5b8610
call ebx
lea eax, [ebp - 4]
push eax
push 4
push 4
push 0x5b8574
call ebx
lea eax, [ebp - 8]
mov dword [0x5b8574], 0x1000c7c0
push eax
push dword [ebp - 4]
push 4
push 0x5b8574
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x4c6e87
push esi
call ebx
lea eax, [ebp - 0x10]
mov byte [0x4c6e87], 0xe8
push eax
mov dword [0x4c6e88], 0xffff2854
push dword [ebp - 0xc]
push 5
push 0x4c6e87
push esi
call ebx
call edi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 4
push 0x5bd9c0
push esi
call ebx
lea eax, [ebp - 0x10]
mov dword [0x5bd9c0], 0x1000d130
push eax
push dword [ebp - 0xc]
push 4
push 0x5bd9c0
push esi
call ebx
call edi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x453283
push esi
call ebx
mov ecx, 0x1000ce40
mov byte [0x453283], 0xe8
sub ecx, 0x453288
lea eax, [ebp - 0x10]
mov dword [0x453284], ecx
push eax
push dword [ebp - 0xc]
push 5
push 0x453283
push esi
call ebx
call edi
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x45cab6
push esi
call ebx
mov ecx, 0x1000c880
mov byte [0x45cab6], 0xe8
lea eax, [ebp - 0x10]
sub ecx, 0x45cabb
push eax
mov dword [0x45cab7], ecx
push dword [ebp - 0xc]
push 5
push 0x45cab6
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x80
push 4
mov esi, 0x1000dd30
push 0x45a34b
sub esi, 0x45a34f
call edi
mov eax, dword [0x45a34b]
add eax, 0x45a34f
mov dword [0x1001a7b4], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
mov dword [0x45a34b], esi
push 5
push 0x45a34b
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x238000
push 0x401000
call edi
mov byte [0x50bca4], 0xeb
mov byte [0x415fcd], 5
mov byte [0x41695c], 5
call fcn.1000b5f0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0x238000
push 0x401000
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e2a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x15c
mov eax, dword [0x1001a010]
xor eax, esp
mov dword [esp + 0x158], eax
cmp dword [ebp + 0xc], 1
push ebx
push esi
push edi
jne 0x1000e3ba
push 0x104
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movaps xmm0, xmmword [0x100172a0]
lea ecx, [esp + 0x28]
movups xmmword [esp + 0x28], xmm0
lea eax, [esp + 0x58]
sub esp, 0xc
movaps xmm0, xmmword [0x10017340]
sub eax, ecx
movups xmmword [esp + 0x44], xmm0
mov edi, esp
mov ebx, eax
movaps xmm0, xmmword [0x10017310]
movups xmmword [esp + 0x54], xmm0
sar ebx, 2
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x1000e34d
push ebx
mov ecx, edi
call fcn.10005be0
push dword [esp + 0x18]
mov esi, dword [edi]
lea eax, [esp + 0x38]
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
lea eax, [esi + ebx*4]
add esp, 0xc
mov dword [edi + 4], eax
lea ecx, [esp + 0x1c]
call fcn.1000f930
add esp, 0xc
cmp dword [eax + 0x14], 0x10
jb 0x1000e361
mov eax, dword [eax]
push eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
jb 0x1000e3a5
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000e39b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000e39b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100127ad
add esp, 8
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1001a7bc], eax
call fcn.1000df50
mov ecx, dword [esp + 0x164]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001276f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011cc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10011cec
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10011d14
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10011d1a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10011d82
jg 0x10011d31
test esi, esi
je 0x10011d82
test ecx, ecx
jl 0x10011d7d
jg 0x10011d3b
test eax, eax
je 0x10011d7d
cmp edi, ecx
jg 0x10011d4f
jl 0x10011d45
cmp esi, eax
jae 0x10011d4f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x10011d85
mov ecx, dword [ebp + 8]
jmp 0x10011d8f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10011da9
jg 0x10011d8f
test esi, esi
je 0x10011da9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10011da9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011dc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x10011de4
jl 0x10011dd9
test ecx, ecx
jne 0x10011de4
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10011dfe
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x10011e4a
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x10011e50
mov edi, dword [ebp + 8]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp + 8], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10011e50
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x10011ec6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10011e7c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10011eb4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10011ec6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10011e90
test edi, edi
je 0x10011ec6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10012230
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1001a010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10012260
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001276f
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10012290
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10012290
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001276f
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10012368
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x100122b9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100122c5
movsx eax, bl
jmp 0x100122fd
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10012327
sub eax, 1
je 0x10012327
sub eax, 2
jne 0x10012368
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001276f
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10012345
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10012368
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001276f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001276f
mov esp, ebp
pop ebp
ret 4
Function at 0x10012510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1001a010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x100125cc
cmp byte [esi + 0x3d], 0
je 0x100125cc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100125ba
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10012581
sub eax, 1
je 0x10012585
sub eax, 2
jne 0x100125ba
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001276f
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100125a3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100125ba
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001276f
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001276f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1001276f
mov esp, ebp
pop ebp
ret
Function at 0x10009550
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [eax + 0x54]
mov edx, dword [eax + 4]
cmp edx, 0xffffffff
je 0x1000958e
mov dword [esp], edx
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [ebx + 0x54]
sub esp, 8
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx + 0x48]
test edx, edx
je 0x10009668
test byte [0x1001903c], 8
jne 0x10009630
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
mov dword [esp], eax
call edx
mov eax, dword [ebx + 0x54]
sub esp, 4
mov edx, dword [eax + 0x70]
test edx, edx
je 0x100095d3
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov edx, dword [eax + 0x74]
test edx, edx
je 0x100095e9
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov eax, dword [eax + 0x10]
mov dword [esp], eax
call fcn.10016db0
mov eax, dword [ebx + 0x54]
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [eax + 0x5c]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x1c]
mov dword [esp], eax
call esi
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebx + 0x54]
sub esp, 4
mov dword [esp], eax
call esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0xc], str.Calling_SP_ShutdownEx_n
mov dword [esp + 8], str.DP_DestroyDirectPlay2
mov dword [esp + 4], 0x1001903c
mov dword [esp], 3
call fcn.10003740
mov eax, dword [ebx + 0x54]
mov edx, dword [eax + 0x30]
mov edx, dword [edx + 0x48]
jmp 0x100095a9
mov edx, dword [ecx + 0x40]
test edx, edx
je 0x100095bd
test byte [0x1001903c], 8
jne 0x10009690
call edx
mov eax, dword [ebx + 0x54]
jmp 0x100095bd
mov dword [esp + 0xc], str.Calling_obsolete_SP_Shutdown_n
mov dword [esp + 8], str.DP_DestroyDirectPlay2
mov dword [esp + 4], 0x1001903c
mov dword [esp], 3
call fcn.10003740
mov eax, dword [ebx + 0x54]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 0x40]
jmp 0x1000967c
Function at 0x10011310
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x2c
movd xmm0, dword [ecx + 8]
movd xmm1, dword [ecx + 4]
mov edi, dword [ecx]
mov esi, dword [ecx + 0xc]
punpckldq xmm1, xmm0
movq qword [ebp - 0x20], xmm1
mov dword [esp], 0x10
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x1001140a
mov ebx, eax
test edi, edi
je 0x10011396
lea eax, [eax + 0xc]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], edi
mov dword [esp], 0xffffffff
call dword [sym.imp.kernel32.dll_DuplicateHandle]
sub esp, 0x1c
test eax, eax
je 0x100113f8
movq xmm2, qword [ebp - 0x20]
lea eax, [ebp - 0x14]
mov dword [ebx + 8], esi
movq qword [ebx], xmm2
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x10011150
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
test eax, eax
je 0x10011420
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
test byte [0x1001907c], 2
jne 0x10011450
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
test byte [0x1001907c], 2
je 0x10011401
mov dword [esp + 0xc], str.Unable_to_create_msg_thread_n
mov dword [esp + 8], str.CreateLobbyMessageReceptionThread
mov dword [esp + 4], 0x1001907c
mov dword [esp], 1
call fcn.10010f50
jmp 0x10011401
mov dword [esp + 0xc], str.Unable_to_duplicate_event_handle_n
mov dword [esp + 8], str.CreateLobbyMessageReceptionThread
mov dword [esp + 4], 0x1001907c
mov dword [esp], 1
call fcn.10010f50
jmp 0x10011401