joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037550
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x100ec500]
xor eax, esp
mov dword [esp + 0x14], eax
mov esi, dword [0x100ef758]
cmp byte [esi + 0x4145], 0
jne 0x1003757e
cmp byte [esi + 0x4146], 0
je 0x1003772d
movss xmm0, dword [esi + 0x3848]
unpcklps xmm0, xmm0
mulps xmm0, xmmword [0x10074420]
movsd xmm1, qword [esi + 0xdb0]
addps xmm1, xmm0
movlps qword [esi + 0x3f04], xmm1
mov dword [esi + 0x3f0c], 0
mov dword [esi + 0x3f10], 0
mov dword [esi + 0x3ef8], 1
movss xmm0, dword [esi + 0x38a4]
or byte [esi + 0x3ef4], 0x41
mulss xmm0, dword [0x10074480]
movss dword [esi + 0x3f48], xmm0
mov ebx, 1
mov ebp, dword [esp + 0x30]
movsx eax, word [esi + 0x51b2]
lea edi, [esp + 4]
push eax
push str.Tooltip__02d
push 0x10
push edi
call fcn.10021ca0
add esp, 0x10
test bl, 1
je 0x10037708
movzx ecx, byte [esp + 4]
test cl, cl
je 0x10037663
mov edx, 0xffffffff
lea ebp, [esp + 6]
mov eax, 0xffffffff
jmp 0x10037647
movzx ebx, ch
movzx edi, al
shr eax, 8
xor edi, ebx
xor eax, dword [edi*4 + 0x1007362c]
inc ebp
test cl, cl
je 0x1003765f
mov ch, cl
mov cl, byte [ebp - 1]
cmp ch, 0x23
jne 0x10037630
cmp cl, 0x23
jne 0x10037630
cmp byte [ebp], 0x23
cmove eax, edx
jmp 0x10037630
not eax
jmp 0x10037665
xor eax, eax
mov ecx, dword [0x100ef758]
mov edi, dword [ecx + 0x3df8]
mov ebp, dword [ecx + 0x3e00]
mov ecx, ebp
mov edx, edi
mov dword [esp], edi
test edi, edi
je 0x100376ad
mov ecx, ebp
mov edx, dword [esp]
nop word [eax + eax]
mov ebx, edx
shr ebx, 1
mov edi, ebx
not edi
add edi, edx
cmp dword [ecx + ebx*8], eax
lea edx, [ecx + ebx*8 + 8]
cmovae edi, ebx
cmovb ecx, edx
mov edx, edi
test edi, edi
jne 0x10037690
mov edx, dword [esp]
lea edx, [edx*8]
add edx, ebp
cmp ecx, edx
lea edi, [esp + 4]
mov ebp, dword [esp + 0x30]
je 0x10037708
cmp dword [ecx], eax
jne 0x10037708
mov eax, dword [ecx + 4]
test eax, eax
je 0x10037708
cmp byte [eax + 0x8e], 0
je 0x10037708
mov byte [eax + 0x95], 1
mov byte [eax + 0xb0], 1
movzx eax, word [esi + 0x51b2]
inc eax
mov word [esi + 0x51b2], ax
cwde
push eax
push str.Tooltip__02d
push 0x10
push edi
call fcn.10021ca0
add esp, 0x10
or ebp, 0x20c0347
push ebp
push 0
push edi
call fcn.1002d410
add esp, 0xc
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1006a0d8
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [esp + 0x2c]
jmp 0x100375e4
Function at 0x10038470
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x100ec500]
xor eax, esp
mov dword [esp + 4], eax
mov ebx, dword [0x100ef758]
cmp byte [ebx + 0x5238], 0
je 0x10038585
mov eax, dword [esp + 0x1c]
lea ebp, [esp + 0x20]
mov dword [esp], ebp
lea esi, [ebx + 0x5244]
cmp dword [ebx + 0x5240], 0
je 0x1003857c
cmp dword [ebx + 0x5248], 0
jns 0x10038536
mov eax, dword [0x100ef758]
test eax, eax
je 0x100384cb
inc dword [eax + 0xa8]
push dword [0x100ef760]
push 0
call dword [0x100e7c10]
add esp, 8
mov edi, eax
mov eax, dword [ebx + 0x524c]
test eax, eax
je 0x10038522
push dword [ebx + 0x5244]
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebx + 0x524c]
test eax, eax
je 0x10038512
mov ecx, dword [0x100ef758]
test ecx, ecx
je 0x10038512
dec dword [ecx + 0xa8]
push dword [0x100ef760]
push eax
call dword [0x100e7c14]
add esp, 8
mov dword [ebx + 0x524c], edi
mov dword [ebx + 0x5248], 0
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0x5244], 0
mov ecx, esi
push ebp
push eax
call fcn.10022640
mov eax, dword [ebx + 0x5244]
xor ecx, ecx
sub eax, 1
cmovb eax, ecx
mov ecx, dword [ebx + 0x524c]
test ecx, ecx
mov edx, 0x100ef75c
cmovne edx, ecx
push dword [ebx + 0x5240]
push eax
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
jmp 0x10038585
mov ecx, esi
push ebp
push eax
call fcn.10022640
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.1006a0d8
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100385c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x24]
mov ebp, dword [0x100ef758]
push 0x100e3689
push esi
call sub.VCRUNTIME140.dll_strstr
add esp, 8
mov ebx, eax
test eax, eax
cmove ebx, esi
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov esi, eax
and esi, 0xfffffffc
mov edi, dword [ebp + 0x5210]
mov ecx, dword [ebp + 0x5214]
lea edx, [esi + edi]
add edx, 0x18
add esi, 0x18
cmp ecx, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
jge 0x10038626
test ecx, ecx
je 0x10038631
mov ebx, ecx
shr ebx, 0x1f
add ebx, ecx
sar ebx, 1
add ebx, ecx
jmp 0x10038636
mov ecx, dword [ebp + 0x5218]
jmp 0x100386b9
mov ebx, 8
cmp ebx, edx
mov dword [esp], edx
cmovle ebx, edx
inc dword [ebp + 0xa8]
push dword [0x100ef760]
push ebx
call dword [0x100e7c10]
add esp, 8
mov ecx, eax
mov eax, dword [ebp + 0x5218]
test eax, eax
je 0x100386a2
push dword [ebp + 0x5210]
push eax
mov dword [esp + 0x14], ecx
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x5218]
test eax, eax
je 0x1003868e
mov ecx, dword [0x100ef758]
test ecx, ecx
je 0x1003868e
dec dword [ecx + 0xa8]
push dword [0x100ef760]
push eax
call dword [0x100e7c14]
add esp, 8
mov ecx, dword [esp + 0xc]
mov dword [ebp + 0x5218], ecx
mov dword [ebp + 0x5214], ebx
mov ebx, dword [esp + 8]
mov eax, dword [esp + 4]
mov edx, dword [esp]
mov dword [ebp + 0x5210], edx
mov dword [ecx + edi], esi
mov ecx, dword [ebp + 0x5218]
lea ebp, [ecx + edi]
lea edx, [ecx + edi]
add edx, 4
xorps xmm0, xmm0
movups xmmword [ecx + edi + 4], xmm0
test eax, eax
mov dword [esp], edx
je 0x10038737
lea ecx, [eax - 1]
lea edx, [ebx + 2]
mov esi, 0xffffffff
mov ebx, 0xffffffff
jmp 0x1003871c
movzx eax, al
mov edi, ebx
shr edi, 8
movzx ebx, bl
xor ebx, eax
xor edi, dword [ebx*4 + 0x1007362c]
inc edx
mov ebx, edi
add ecx, 0xffffffff
jae 0x10038787
movzx eax, byte [edx - 2]
cmp ecx, 2
jb 0x10038700
cmp al, 0x23
jne 0x10038700
cmp byte [edx - 1], 0x23
jne 0x10038700
cmp byte [edx], 0x23
cmove ebx, esi
jmp 0x10038700
movzx ecx, byte [ebx]
test cl, cl
je 0x10038782
lea edx, [ebx + 2]
mov esi, 0xffffffff
mov ebx, 0xffffffff
jmp 0x1003876b
movzx eax, al
mov edi, ebx
shr edi, 8
movzx ebx, bl
xor ebx, eax
xor edi, dword [ebx*4 + 0x1007362c]
inc edx
mov ebx, edi
test cl, cl
je 0x10038787
mov eax, ecx
movzx ecx, byte [edx - 1]
cmp al, 0x23
jne 0x10038750
cmp cl, 0x23
jne 0x10038750
cmp byte [edx], 0x23
cmove ebx, esi
jmp 0x10038750
mov edi, 0xffffffff
not edi
mov dword [ebp + 4], edi
add ebp, 0x14
mov eax, dword [esp + 4]
inc eax
push eax
push dword [esp + 0xc]
push ebp
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp]
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1003b4d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [ecx + 8]
test eax, eax
je 0x1003b4f7
mov dword [esi + 4], 0
mov dword [esi], 0
push eax
call fcn.10021ba0
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1003b51c
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
push eax
call fcn.10021ba0
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1003b541
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
push eax
call fcn.10021ba0
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1003b582
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
push eax
call fcn.10021ba0
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x1003b5a7
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
push eax
call fcn.10021ba0
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1003b5cc
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
push eax
call fcn.10021ba0
add esp, 4
mov dword [esi + 0x5c], 0
add esi, 0x78
mov ecx, esi
pop esi
jmp fcn.1003b5e0
Function at 0x10040620
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [esp + 0x18], ecx
mov esi, dword [esp + 0x34]
mov dword [esp], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, 4
mov ecx, 0x66666667
imul ecx
mov eax, edx
shr eax, 0x1f
shr edx, 1
add edx, eax
shl edx, 2
mov dword [esp], edx
call fcn.10021b70
mov dword [esp + 0x14], eax
movzx eax, byte [esi]
test al, al
je 0x100406ef
add esi, 5
mov edi, dword [esp + 0x14]
nop dword [eax + eax]
movsx ecx, al
cmp al, 0x5c
mov eax, 0
setge al
xor eax, 0xffffffdd
add eax, ecx
mov dword [esp + 0x1c], eax
movsx eax, byte [esi - 4]
xor edx, edx
cmp eax, 0x5c
setge dl
xor edx, 0xffffffdd
add edx, eax
movsx eax, byte [esi - 3]
xor ecx, ecx
cmp eax, 0x5c
setge cl
xor ecx, 0xffffffdd
add ecx, eax
movsx eax, byte [esi - 2]
xor ebx, ebx
cmp eax, 0x5c
setge bl
xor ebx, 0xffffffdd
add ebx, eax
movsx ebp, byte [esi - 1]
xor eax, eax
cmp ebp, 0x5c
setge al
xor eax, 0xffffffdd
add eax, ebp
imul eax, eax, 0x55
add eax, ebx
imul eax, eax, 0x55
add eax, ecx
imul eax, eax, 0x55
add eax, edx
imul eax, eax, 0x55
add eax, dword [esp + 0x1c]
mov dword [edi], eax
add edi, 4
movzx eax, byte [esi]
add esi, 5
test al, al
jne 0x10040670
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], eax
movss xmm0, dword [esp + 0x38]
movss dword [esp + 8], xmm0
mov edi, dword [esp + 0x14]
mov dword [esp], edi
mov ecx, dword [esp + 0x18]
call fcn.10040870
sub esp, 0x14
mov esi, eax
mov dword [esp], edi
call fcn.10021ba0
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x100605e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [0x100ec500]
xor ecx, ebp
mov dword [esp + 0x80], ecx
movzx ecx, byte [eax]
jmp 0x10060620
xor edx, edx
cmp cl, 0x25
sete dl
movzx ecx, byte [eax + edx + 1]
add eax, edx
inc eax
test cl, cl
je 0x1006074e
cmp cl, 0x25
jne 0x10060610
cmp byte [eax + 1], 0x25
je 0x10060610
lea edx, [eax + 1]
mov cl, 0x25
mov ebx, 0x25
mov edi, 0x900
jmp 0x10060664
dec bl
movzx ecx, bl
bt edi, ecx
jae 0x10060688
movsx ebx, byte [edx]
inc edx
mov ecx, ebx
test ebx, ebx
je 0x10060687
mov ch, cl
add ch, 0xbf
cmp ch, 0x19
jbe 0x10060650
add cl, 0x9f
cmp cl, 0x19
ja 0x1006065a
dec bl
movzx ecx, bl
mov ebx, 0x2480a80
bt ebx, ecx
jb 0x1006065a
jmp 0x10060688
dec edx
lea ebx, [esp + 0x60]
mov ecx, edx
mov edi, ebx
sub ecx, eax
jbe 0x100606ba
mov edi, eax
not edi
add edi, edx
mov dword [esp + 0x14], edi
lea edi, [esp + 0x60]
and ecx, 3
jne 0x10060778
cmp dword [esp + 0x14], 3
lea ebx, [esp + 0x60]
jae 0x1006079b
mov byte [edi], 0
lea eax, [esp + 0x20]
push esi
push dword [ebp + 0x10]
push ebx
push 0x40
push eax
call fcn.10021ca0
add esp, 0x14
lea eax, [esp + 0x1f]
nop word cs:[eax + eax]
cmp byte [eax + 1], 0x20
lea eax, [eax + 1]
je 0x100606e0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
add esp, 4
fstp qword [esp + 0x18]
movsd xmm0, qword [esp + 0x18]
movsd xmm1, qword [0x1007c140]
ucomisd xmm0, xmm1
jae 0x1006070f
xorpd xmm1, xmm1
subsd xmm0, xmm1
movsd qword [esp + 8], xmm0
setae al
fld qword [esp + 8]
fnstcw word [esp + 4]
movzx ecx, word [esp + 4]
or ecx, 0xc00
mov word [esp + 6], cx
fldcw word [esp + 6]
fistp qword [esp + 8]
fldcw word [esp + 4]
movzx esi, al
shl esi, 0x1f
xor esi, dword [esp + 0xc]
mov edi, dword [esp + 8]
mov ecx, dword [esp + 0x80]
xor ecx, ebp
call fcn.1006a0d8
mov eax, edi
mov edx, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
inc eax
dec ecx
je 0x100606ab
movzx ebx, byte [eax]
cmp ebx, 0x24
je 0x10060770
cmp ebx, 0x27
je 0x10060770
cmp ebx, 0x5f
je 0x10060770
mov byte [edi], bl
inc edi
jmp 0x10060770
add eax, 4
cmp eax, edx
je 0x100606ba
movzx ecx, byte [eax]
cmp ecx, 0x24
je 0x100607b0
cmp ecx, 0x27
je 0x100607b0
cmp ecx, 0x5f
je 0x100607b0
mov byte [edi], cl
inc edi
movzx ecx, byte [eax + 1]
cmp ecx, 0x24
je 0x100607c6
cmp ecx, 0x27
je 0x100607c6
cmp ecx, 0x5f
je 0x100607c6
mov byte [edi], cl
inc edi
movzx ecx, byte [eax + 2]
cmp ecx, 0x24
je 0x100607dc
cmp ecx, 0x27
je 0x100607dc
cmp ecx, 0x5f
je 0x100607dc
mov byte [edi], cl
inc edi
movzx ecx, byte [eax + 3]
cmp ecx, 0x24
je 0x10060790
cmp ecx, 0x27
je 0x10060790
cmp ecx, 0x5f
je 0x10060790
mov byte [edi], cl
inc edi
jmp 0x10060790
Function at 0x10066e10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x100675b0
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
cmp eax, 1
jne 0x10066e8d
push 4
call fcn.1006a064
add esp, 4
mov esi, eax
mov dword [eax], 0x10066f30
lea eax, [ebp - 0x20]
push eax
push 0
push esi
push 0x10063c80
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x24], eax
test eax, eax
je 0x10066ea5
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x10066ec0
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x10066ed1
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, 1
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
add esp, 4
mov dword [ebp - 0x10], 1
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
add esp, 4
mov dword [ebp - 0x10], 1
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
add esp, 4
nop word cs:[eax + eax]
push ebp
sub esp, 0x18
add ebp, 0xc
push dword [ebp - 0x28]
call fcn.1006a094
add esp, 0x1c
pop ebp
ret
Function at 0x100676e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10067d20
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x20], 0
push 0x18
call fcn.1006a064
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x24], eax
mov esi, dword [0x100f6550]
mov ecx, 0x100f6550
push dword [esi + 4]
push 0x100f6550
call fcn.10001390
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov eax, dword [0x100f6550]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [0x100f6550], ecx
mov dword [ebp - 0x24], eax
mov dword [0x100f6554], edx
mov dword [ebp - 0x20], 0
lea esi, [ebp - 0x24]
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.10001390
push 0x18
push dword [ebp - 0x24]
call fcn.1006a099
add esp, 8
mov dword [ebp - 0x20], 0
push 0x18
call fcn.1006a064
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x24], eax
mov edi, dword [0x100f6558]
mov ecx, 0x100f6558
push dword [edi + 4]
push 0x100f6558
call fcn.10001390
mov dword [edi + 4], edi
mov dword [edi], edi
mov dword [edi + 8], edi
mov eax, dword [0x100f6558]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov dword [0x100f6558], ecx
mov dword [ebp - 0x24], eax
mov dword [0x100f655c], edx
mov dword [ebp - 0x20], 0
mov ecx, esi
push dword [eax + 4]
push esi
call fcn.10001390
push 0x18
push dword [ebp - 0x24]
call fcn.1006a099
add esp, 8
mov byte [0x100f6560], 0
mov byte [0x100f6561], 0
push 4
call fcn.1006a064
add esp, 4
mov esi, eax
mov dword [eax], 0x100678f0
lea eax, [ebp - 0x20]
push eax
push 0
push esi
push 0x10063c80
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x24], eax
test eax, eax
je 0x1006786c
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x10067887
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x10067898
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
add esp, 4
mov dword [ebp - 0x10], 1
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
add esp, 4
mov dword [ebp - 0x10], 1
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
add esp, 4
nop dword [eax]
push ebp
sub esp, 0x18
add ebp, 0xc
push dword [ebp - 0x28]
call fcn.1006a094
add esp, 0x1c
pop ebp
ret
Function at 0x10069c10
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x20
mov eax, dword [0x100ec500]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x10069d0f
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x10069d08
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esp + 0x10], 0x10
jb 0x10069ced
call ebx
cmp dword [esp + 0x1c], eax
jne 0x10069ced
call ebp
cmp dword [esp + 0x18], eax
je 0x10069ced
mov edx, dword [esi]
test edx, edx
jne 0x10069cb5
push 0x200
push edx
mov dword [esi + 4], 0x80
push dword [0x100f66c8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10069d08
jmp 0x10069ce0
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x10069ce0
shl eax, 3
push eax
push edx
push 0
push dword [0x100f66c8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10069d08
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10069c75
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x10069d57
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x10069d57
mov ebp, dword [esp + 0x3c]
nop
mov eax, dword [esi]
push dword [eax + ebx*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10069d51
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebp
push dword [esp + 0x3c]
push edi
call fcn.10069a90
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x10069d20
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1006a0d8
add esp, 0x20
ret

Function at 0x10069d70
Capabilities:
Resume thread

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi], 0
je 0x10069dc8
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x10069db7
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
nop word [eax + eax]
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x10069daf
push ebx
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x10069d90
pop ebp
pop ebx
push dword [edi]
push 0
push dword [0x100f66c8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
ret
Function at 0x10069dd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push esi
imul esi, dword [esp + 0xc], 0x2c
push edi
add esi, dword [0x100f66d0]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebp, [eax*2 + 5]
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10069e12
pop edi
pop esi
mov eax, 0xa
pop ebp
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x10069e38
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10069e59
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10069e59
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10069e53
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10069e59
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov byte [esi + 0x14], bl
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1006a7f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x100f6714]
test eax, eax
je 0x1006a80c
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x1006a862
mov eax, dword [eax]
test eax, eax
jne 0x1006a800
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1006a85f
push esi
push edi
xor edi, edi
mov dword [eax + 8], 0
lea edx, [eax + 0x20]
lea esi, [edi + 0x20]
mov dword [edx], edi
mov ecx, edx
mov dword [eax + 4], edx
add esi, 0x20
add edx, 0x20
mov edi, ecx
cmp esi, 0xfe0
jbe 0x1006a835
mov ecx, dword [0x100f6714]
mov dword [eax], ecx
mov dword [0x100f6714], eax
pop edi
pop esi
test eax, eax
jne 0x1006a862
xor eax, eax
ret
mov edx, dword [eax + 4]
mov ecx, dword [edx]
inc dword [eax + 8]
mov dword [eax + 4], ecx
mov eax, edx
ret
Function at 0x1006ac20
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 4]
push esi
mov cl, byte [edx]
test cl, cl
je 0x1006ac35
cmp cl, 0x90
je 0x1006ac35
cmp cl, 0xcc
jne 0x1006ac53
mov esi, dword [esp + 0xc]
mov eax, 1
cmp esi, eax
jbe 0x1006ac4c
cmp byte [eax + edx], cl
jne 0x1006ac53
inc eax
cmp eax, esi
jb 0x1006ac42
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret