joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003bcd
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x210]
push ecx
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp eax, esi
jae 0x1003dad
test eax, eax
jne 0x1003c1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1003db0
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x1003dad
lea ecx, [ebp - 0x210]
cmp eax, ecx
je 0x1003dad
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x210]
cmp ax, 0x41
jb 0x1003c4d
cmp ax, 0x5a
jbe 0x1003c56
lea ecx, [eax - 0x61]
cmp cx, 0x19
ja 0x1003c7a
cmp word [ebp - 0x20e], 0x3a
jne 0x1003c7a
cmp word [ebp - 0x20c], 0x5c
jne 0x1003dad
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], ecx
push 0x5c
pop edi
cmp ax, di
jne 0x1003cbc
cmp word [ebp - 0x20e], di
jne 0x1003cbc
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.msvcrt.dll_wcschr
pop ecx
pop ecx
test eax, eax
je 0x1003dad
add eax, 2
push edi
push eax
call sub.msvcrt.dll_wcschr
pop ecx
pop ecx
mov dword [ebp - 0x214], eax
test eax, eax
je 0x1003dad
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003ce6
and al, 0x10
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xfffffef5
add eax, 0x10b
jmp 0x1003db0
mov esi, dword [ebp - 0x218]
lea eax, [ebp - 0x210]
cmp esi, eax
jne 0x1003cfa
mov esi, eax
jmp 0x1003cfd
add esi, 0xfffffffe
cmp esi, dword [ebp - 0x214]
je 0x1003dad
cmp word [esi], di
jne 0x1003dad
cmp esi, dword [ebp - 0x214]
jbe 0x1003dad
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x210]
push 0x5c
push eax
call sub.msvcrt.dll_wcsrchr
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1003dad
movzx ebx, word [edi + 2]
xor eax, eax
mov word [edi + 2], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov word [edi + 2], bx
cmp eax, 0xffffffff
jne 0x1003d75
mov esi, edi
cmp edi, dword [ebp - 0x214]
ja 0x1003d1e
cmp esi, dword [ebp - 0x214]
jbe 0x1003dad
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
jmp 0x1003d96
test al, 0x10
jne 0x1003d63
mov eax, 0x10b
jmp 0x1003db0
cmp word [esi + 2], bx
je 0x1003da9
push 0x5c
pop eax
push esi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2]
push ebx
lea eax, [ebp - 0x210]
push eax
call edi
test eax, eax
jne 0x1003d80
jmp 0x1003c0f
xor eax, eax
jmp 0x1003db0
push 0x7b
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002c39
leave
ret 4
Function at 0x100611d
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [ebp + 0x24]
or dword [esi], 0xffffffff
mov dword [ebp - 8], eax
mov edi, 0x2000000
cmp dword [ebp + 0x20], 0xffffffff
je 0x1006192
cmp dword [ebp + 0x20], ebx
je 0x1006192
cmp dword [0x1008670], ebx
jne 0x100616c
push 0x10014a4
call fcn.010060e0
mov dword [0x100866c], eax
mov dword [0x1008670], 1
mov eax, dword [0x100866c]
cmp eax, ebx
je 0x10061ec
mov ecx, dword [ebp + 0x18]
push ebx
push ebx
push dword [ebp + 0x20]
or ecx, edi
push ebx
push ecx
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x10061ac
mov eax, dword [ebp + 0x18]
push ebx
or eax, edi
push eax
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x10061e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x10061e5
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x1c]
jae 0x10061e5
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
cmp dword [esi], 0xffffffff
mov dword [ebp - 4], eax
je 0x1006140
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x20
mov eax, 0x1a32
jmp 0x10061e5

Function at 0x1006274
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
xor edi, edi
cmp dword [ebp + 0x10], 0xffffffff
je 0x10062cc
cmp dword [ebp + 0x10], esi
je 0x10062cc
cmp dword [0x1008688], esi
jne 0x10062ab
push 0x10014d4
call fcn.010060e0
mov dword [0x1008684], eax
mov dword [0x1008688], 1
mov eax, dword [0x1008684]
cmp eax, esi
jne 0x10062bb
mov esi, 0x1a32
jmp 0x10062e6
push dword [ebp + 0x10]
push 2
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x10062d8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edi, eax
cmp edi, esi
jne 0x10062e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x43c3d0
Capabilities:
Create pipe
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x180c
call fcn.0044ca60
mov eax, dword [0x463f64]
mov ecx, dword [0x4639f0]
push ebx
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x43c503
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [0x463f64], 0x959
jne 0x43c4ec
push 0
lea eax, [ebp - 0x1008]
push eax
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push 0
lea ecx, [ebp - 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call edi
push 0
call dword [sym.imp.KERNEL32.dll_TlsFree]
lea edx, [ebp - 0x808]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0
lea eax, [ebp - 0xc08]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
push 0
push 0x4036d4
push 0
push 0
push 0
call esi
push 0
lea ecx, [ebp - 0x1808]
push ecx
push 0
call edi
mov edx, dword [ebp - 4]
push edx
call fcn.0043c140
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x43c40e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e290
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45200b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x43ac90
call fcn.0043ed9d
push 4
mov dword [ebp - 4], 0
call fcn.0043fe29
mov edi, eax
add esp, 4
test edi, edi
je 0x43e303
push ebx
call fcn.0043ea09
mov dword [edi], eax
call fcn.0043e837
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0043eb59
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x43e2f8
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0043eb81
pop ebx
jmp 0x43e305
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x440549
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4546c8]
jne 0x440553
repz ret
jmp fcn.00446bac
Function at 0x44c3ea
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00443bee
and dword [ebp - 4], 0
cmp dword [0x45afa4], 0
mov ebx, eax
jne 0x44c49b
push 0x4034bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44c54c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4034b0
push edi
call esi
test eax, eax
je 0x44c54c
push eax
call fcn.00443b7c
mov dword [esp], 0x4034a0
push edi
mov dword [0x45afa4], eax
call esi
push eax
call fcn.00443b7c
mov dword [esp], 0x40348c
push edi
mov dword [0x45afa8], eax
call esi
push eax
call fcn.00443b7c
mov dword [esp], 0x403470
push edi
mov dword [0x45afac], eax
call esi
push eax
call fcn.00443b7c
pop ecx
mov dword [0x45afb4], eax
test eax, eax
je 0x44c49b
push 0x403458
push edi
call esi
push eax
call fcn.00443b7c
pop ecx
mov dword [0x45afb0], eax
mov eax, dword [0x45afb0]
cmp eax, ebx
je 0x44c4f3
cmp dword [0x45afb4], ebx
je 0x44c4f3
push eax
call fcn.00443bf7
push dword [0x45afb4]
mov esi, eax
call fcn.00443bf7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44c4f3
test edi, edi
je 0x44c4f3
call esi
test eax, eax
je 0x44c4ea
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44c4ea
test byte [ebp - 0xc], 1
jne 0x44c4f3
or dword [ebp + 0x10], 0x200000
jmp 0x44c52c
mov eax, dword [0x45afa8]
cmp eax, ebx
je 0x44c52c
push eax
call fcn.00443bf7
pop ecx
test eax, eax
je 0x44c52c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44c52c
mov eax, dword [0x45afac]
cmp eax, ebx
je 0x44c52c
push eax
call fcn.00443bf7
pop ecx
test eax, eax
je 0x44c52c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45afa4]
call fcn.00443bf7
pop ecx
test eax, eax
je 0x44c54c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44c54e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x983130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x983140
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea esi, [esi + eax*2]
lea edi, [edi + eax*2]
cmp eax, 1
jne 0x983150
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x983710
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x228
mov eax, dword [str.lmjU]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x22c]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 4]
lea ecx, [esp + 0x14]
xor esi, esi
push ecx
mov ecx, dword [edi]
or edx, 0x2001f
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.009836a0
mov ebp, eax
cmp ebp, esi
je 0x983774
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x98376d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x98380d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
push esi
push esi
push esi
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x44]
push ecx
push esi
push edx
mov dword [esp + 0x40], 0x100
call ebx
test eax, eax
jne 0x9837da
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.00983710
mov ebp, eax
cmp ebp, esi
jne 0x98375e
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push esi
push esi
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x44]
push eax
push esi
push ecx
mov dword [esp + 0x40], 0x100
call ebx
test eax, eax
je 0x9837a0
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x9837ef
push eax
call ebp
mov dword [esp + 0x14], esi
mov ebx, dword [esp + 0x24]
mov eax, edi
mov dword [esp + 0x18], esi
call fcn.00983890
mov edi, eax
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x98380b
push eax
call ebp
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00ac8a41
add esp, 0x228
ret 4
Function at 0x9843e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0xb32ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [str.lmjU]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x414]
xor esi, esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, esi
jne 0x98445f
call fcn.00982970
mov esi, eax
jmp 0x984554
mov eax, dword [ebp - 0x14]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, esi
jne 0x98447b
call fcn.00982970
jmp 0x98454b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp eax, esi
jne 0x984494
call fcn.00982970
jmp 0x98454b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
mov dword [ebp - 0x14], ebx
cmp eax, ebx
jae 0x9844b2
mov esi, 0x8007000e
jmp 0x98454d
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
mov byte [ebp - 4], 2
cmp ecx, esi
ja 0x9844c7
cmp eax, 0xffffffff
jbe 0x9844d1
push 0x80070216
call fcn.00984db0
cmp eax, 0x400
jbe 0x9844fa
lea ecx, [ebp]
push ecx
call fcn.00983110
jmp 0x984500
lea edx, [ebp + 4]
mov dword [ebp], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp]
cmp eax, esi
jne 0x984515
mov esi, 0x8007000e
jmp 0x98454d
push ebx
push eax
mov eax, dword [ebp - 0x18]
push ebx
push eax
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
jne 0x984530
call fcn.00982970
jmp 0x98454b
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x418]
mov ecx, dword [ebp]
push eax
lea esi, [ebp - 0x24]
call fcn.00984250
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x984564
lea eax, [ebp]
call fcn.009830f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.00ac8a41
lea esp, [ebp + 0x408]
pop ebp
ret 0xc
Function at 0x986000
Capabilities:
Get common file path

Disassembly:
cmp dword [0xbbd554], 0
jne 0x9860b8
cmp byte [0xbbd450], 0
jne 0x98608d
push 0xbbd450
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 0x104
jb 0x986056
push 0x104
push 0xbbd450
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0xbbd450
call fcn.00aca2d0
add esp, 8
test eax, eax
je 0x986056
mov byte [eax + 1], 0
mov eax, 0xbbd450
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x986060
mov ecx, dword [str._debug.log]
mov edx, dword [0xb58ac8]
mov dword [eax], ecx
mov cx, word [0xb58acc]
mov dword [eax + 4], edx
mov dl, byte [0xb58ace]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
push 0xb58ad0
push 0xbbd450
call fcn.00aca19e
add esp, 8
mov dword [0xbbd554], eax
test eax, eax
jne 0x9860ab
xor al, al
ret
push 2
push 0
push eax
call fcn.00aca67f
add esp, 0xc
mov al, 1
ret
Function at 0x9860c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0xb29f2b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [str.lmjU]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [str.lmjU]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x29c]
cmp dword [ebp + 0x10], 0
je 0x98627c
xor eax, eax
push 0x208
push eax
lea ecx, [esp + 0x7e]
push ecx
mov word [esp + 0x80], ax
call fcn.00ace420
add esp, 0xc
push 0x104
lea edx, [esp + 0x78]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x74]
push 0x5c
push eax
call fcn.00aca0b4
add esp, 8
test eax, eax
je 0x986154
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [esp + 0x74]
lea edx, [eax + 2]
jmp 0x986160
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x986160
sub eax, edx
sar eax, 1
mov edx, 0x104
sub edx, eax
push edx
lea eax, [esp + 0x78]
push 0xb58ad4
push eax
call fcn.00ac9f23
xor ecx, ecx
add esp, 0xc
cmp dword [ebp + 0x14], 0x10
mov word [esp + 0x27a], cx
jb 0x98619e
mov eax, dword [ebp]
jmp 0x9861a0
mov eax, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call ebx
mov esi, eax
test esi, esi
je 0x98627c
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00ac7a7c
add esp, 4
mov edi, eax
cmp dword [ebp + 0x14], 0x10
jb 0x9861e4
mov ebp, dword [ebp]
push esi
push edi
or esi, 0xffffffff
push esi
push ebp
push 0
push 0xfde9
call ebx
test eax, eax
je 0x98626c
push 0x44
lea eax, [esp + 0x30]
push 0
push eax
call fcn.00ace420
add esp, 0xc
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push edi
lea eax, [esp + 0x98]
push eax
mov dword [esp + 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x98625c
mov ecx, dword [esp + 0x1c]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call ebx
mov eax, dword [esp + 0x1c]
push eax
call ebx
jmp 0x98626c
push 0x10
push str.Fatal_error
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
mov dword [esp + 0x298], esi
call fcn.00ac9081
add esp, 4
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.00ac8a41
add esp, 0x284
ret
Function at 0x9862d0
Capabilities:
Print debug messages
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0xb2d653
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [str.lmjU]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
mov eax, dword [str.lmjU]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x58], 0
mov eax, dword [edi]
cmp eax, dword [0xbbd448]
jl 0x9864f0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [edi + 8]
call fcn.00986f30
push 2
mov ebx, 1
push 0xb58b18
lea ecx, [esp + 0x1c]
mov byte [esp + 0x60], bl
call fcn.009878a0
cmp dword [0xbbd44c], 0
lea ebp, [ebx + 0xf]
je 0x986362
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebp
jae 0x98635b
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0xbbd44c], ebx
je 0x9863d8
call fcn.00986000
test al, al
je 0x9863d8
cmp byte [0xbbd55a], 0
jne 0x98638d
push 0xbbd3dc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0xbbd55a], bl
push 0xbbd3dc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0xbbd554]
push 2
push 0
push edx
call fcn.00aca67f
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp dword [esp + 0x28], ebp
jae 0x9863b9
lea eax, [esp + 0x14]
push eax
mov eax, dword [0xbbd554]
push 0xb58b1c
push eax
call fcn.00aca1b5
add esp, 0xc
push 0xbbd3dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [edi], 3
jne 0x9864c3
mov ecx, dword [0xbbd554]
push ecx
call fcn.00ac9ec7
add esp, 4
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x986405
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x9864c3
cmp dword [0xbbd55c], 0
je 0x98643c
lea edx, [esp + 0x30]
push edx
lea ecx, [edi + 8]
call fcn.00986f30
push eax
mov byte [esp + 0x5c], 2
call dword [0xbbd55c]
add esp, 4
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], bl
call fcn.00a40ca0
jmp 0x9864c3
mov eax, dword [0xba4e74]
cmp byte [eax], 0
jne 0x986470
lea ecx, [esp + 0x30]
push ecx
lea ecx, [edi + 8]
call fcn.00986f30
push eax
mov byte [esp + 0x5c], 3
call fcn.009860c0
add esp, 4
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], bl
call fcn.00a40ca0
jmp 0x9864b5
lea edx, [esp + 0x30]
push edx
lea ecx, [edi + 8]
call fcn.00986f30
cmp dword [eax + 0x14], ebp
jb 0x986484
mov eax, dword [eax]
push eax
push 0xb58b20
call fcn.00ac9acd
add eax, 0x40
push eax
call fcn.00aca1b5
add esp, 0xc
lea ecx, [esp + 0x30]
call fcn.00a40ca0
call fcn.00ac9acd
add eax, 0x40
push eax
call fcn.00ac9ec7
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [esp + 0x58], 0
cmp dword [esp + 0x28], ebp
jb 0x9864db
mov eax, dword [esp + 0x14]
push eax
call fcn.00ac8a36
add esp, 4
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
lea esi, [edi + 0x68]
mov ecx, esi
mov dword [esp + 0x58], 0xffffffff
call fcn.00986e90
push esi
mov dword [esi], vtable.std::ios_base.0
call fcn.00ac7cfc
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00ac8a41
add esp, 0x4c
ret
Function at 0x988ac0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0xb2aff6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [str.lmjU]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00ac812f
push 4
mov dword [esp + 0x28], 0
call fcn.00ac8a50
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
mov byte [esp + 0x24], 1
test edi, edi
je 0x988b4b
call fcn.00ac8007
mov dword [edi], eax
call fcn.00ac7dc6
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00ac80f0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x988b40
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00ac8118
jmp 0x988b4d
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x98ba00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0xb2bf58
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [str.lmjU]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
cmp dword [esi + 0x30], 0x10
jb 0x98ba41
mov eax, dword [esi + 0x1c]
push eax
call fcn.00ac8a36
add esp, 4
mov dword [esi + 0x30], 0xf
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x1c], bl
mov dword [esp + 0x18], 0xffffffff
cmp dword [esi + 0x14], 0x10
jb 0x98ba67
mov eax, dword [esi]
push eax
call fcn.00ac8a36
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret