joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009310
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0xc8], 0
jg 0x10009338
push 0x708
push str.C:UsersNicuDesktopcheatcheatimguiimgui.h
push str.Size___0
call fcn.100491c7
add esp, 0xc
mov eax, dword [ebx + 0xc8]
lea edx, [ebp + 8]
mov ebx, dword [ebx + 0xd0]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10068c10]
sub esi, 1
jne 0x10009352
mov eax, dword [0x1007692c]
not ebx
cmp dword [eax + 0x3e50], ebx
jne 0x1000938c
push ecx
push dword [ebp + 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.1001a8f0
add esp, 8
pop esi
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x1000d7c0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [0x1007692c]
push ebx
push esi
push edi
mov esi, dword [eax + 0x3e20]
mov edi, ecx
mov eax, dword [eax + 0x3e18]
lea ebx, [esi + eax*8]
test eax, eax
je 0x1000d79e
nop dword [eax]
mov edx, eax
shr edx, 1
cmp dword [esi + edx*8], edi
lea ecx, [esi + edx*8]
jae 0x1000d798
lea esi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add eax, ecx
jmp 0x1000d79a
mov eax, edx
test eax, eax
jne 0x1000d780
cmp esi, ebx
je 0x1000d7ad
cmp dword [esi], edi
jne 0x1000d7ad
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x1000d7fd
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1000d7e3
cmp byte [esi], bl
jne 0x1000d7e3
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x10068c10]
test bl, bl
jne 0x1000d7d4
pop edi
pop esi
not ecx
pop ebx
jmp 0x1000d760
Function at 0x10019b60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1007692c]
lea edx, [ecx + 1]
push ebx
mov dword [ebp - 4], eax
or ebx, 0xffffffff
mov al, byte [ecx]
push esi
push edi
test al, al
je 0x10019ba7
or esi, 0xffffffff
nop
cmp al, 0x23
jne 0x10019b8e
cmp byte [edx], al
jne 0x10019b8e
cmp byte [edx + 1], al
cmove ebx, esi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10068c10]
test al, al
jne 0x10019b80
mov ecx, dword [ebp - 4]
xor esi, esi
not ebx
mov eax, dword [ecx + 0x5230]
test eax, eax
jle 0x10019bfc
xor edi, edi
nop word [eax + eax]
test esi, esi
js 0x10019bc8
cmp esi, eax
jl 0x10019be2
push 0x6ff
push str.C:UsersNicuDesktopcheatcheatimguiimgui.h
push str.i___0__i___Size
call fcn.100491c7
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ecx + 0x5238]
cmp dword [eax + edi + 4], ebx
je 0x10019c05
mov eax, dword [ecx + 0x5230]
inc esi
add edi, 0x24
cmp esi, eax
jl 0x10019bc0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x10019c11
cmp esi, dword [ecx + 0x5230]
jl 0x10019c28
push 0x6ff
push str.C:UsersNicuDesktopcheatcheatimguiimgui.h
push str.i___0__i___Size
call fcn.100491c7
add esp, 0xc
mov eax, dword [ebp - 4]
lea ecx, [esi + esi*8]
pop edi
pop esi
pop ebx
mov eax, dword [eax + 0x5238]
lea eax, [eax + ecx*4]
mov esp, ebp
pop ebp
ret
Function at 0x10023540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10023576
mov eax, dword [0x1007692c]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x10023566
dec dword [eax + 0xa8]
push ecx
call fcn.10043cb5
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100235aa
mov eax, dword [0x1007692c]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x1002359a
dec dword [eax + 0xa8]
push ecx
call fcn.10043cb5
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100235de
mov eax, dword [0x1007692c]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x100235ce
dec dword [eax + 0xa8]
push ecx
call fcn.10043cb5
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1002362e
mov eax, dword [0x1007692c]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1002361e
dec dword [eax + 0xa8]
push ecx
call fcn.10043cb5
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10023662
mov eax, dword [0x1007692c]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x10023652
dec dword [eax + 0xa8]
push ecx
call fcn.10043cb5
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x10023696
mov eax, dword [0x1007692c]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x10023686
dec dword [eax + 0xa8]
push ecx
call fcn.10043cb5
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10025e20
Function at 0x1002fba0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x10075368]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.1003c170
add esp, 0xc
lea ecx, [ebp + 0x20]
cmp dword [0x10075cc4], 0x10
lea eax, [ebp + 8]
mov edx, 0x10075cb0
cmovae edx, dword [0x10075cb0]
cmp dword [ebp + 0x34], 0x10
push edx
cmovae ecx, dword [ebp + 0x20]
lea edx, [ebp - 0x104]
cmp dword [ebp + 0x1c], 0x10
push 0x100
cmovae eax, dword [ebp + 8]
push edx
push 0x10064fe2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push 0x100686ac
push eax
call fcn.100058d0
mov ecx, dword [ebp + 0x1c]
add esp, 0xc
mov esi, dword [ebp - 0x108]
cmp ecx, 0x10
jb 0x1002fc5e
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002fc54
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002fcb1
push ecx
push edx
call fcn.1003993d
add esp, 8
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp ecx, 0x10
jb 0x1002fca0
mov edx, dword [ebp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002fc96
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002fcb1
push ecx
push edx
call fcn.1003993d
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100398ff
mov esp, ebp
pop ebp
ret
call fcn.1004950d
int3

Function at 0x1002fcc0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10075368]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.1003c170
add esp, 0xc
lea ecx, [ebp + 0x20]
cmp dword [0x10075cc4], 0x10
lea eax, [ebp + 8]
mov edx, 0x10075cb0
cmovae edx, dword [0x10075cb0]
cmp dword [ebp + 0x34], 0x10
push edx
cmovae ecx, dword [ebp + 0x20]
lea edx, [ebp - 0x104]
cmp dword [ebp + 0x1c], 0x10
push 0x100
cmovae eax, dword [ebp + 8]
push edx
push 0x10064fe2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push 0x1006cdc4
push eax
call fcn.100058d0
movss xmm0, dword [ebp - 0x108]
add esp, 0xc
mov ecx, dword [ebp + 0x1c]
movss dword [ebp - 0x10c], xmm0
cmp ecx, 0x10
jb 0x1002fd87
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002fd7d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002fddf
push ecx
push edx
call fcn.1003993d
add esp, 8
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp ecx, 0x10
jb 0x1002fdc9
mov edx, dword [ebp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002fdbf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002fddf
push ecx
push edx
call fcn.1003993d
add esp, 8
mov ecx, dword [ebp - 4]
movss xmm0, dword [ebp - 0x10c]
xor ecx, ebp
call fcn.100398ff
mov esp, ebp
pop ebp
ret
call fcn.1004950d
int3
Function at 0x1002fdf0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005c4d5
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x10075368]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100
lea eax, [ebp - 0x110]
mov dword [ebp - 4], 1
push 0
push eax
call fcn.1003c170
add esp, 0xc
lea ecx, [ebp + 0x20]
cmp dword [0x10075cc4], 0x10
lea eax, [ebp + 8]
mov edx, 0x10075cb0
cmovae edx, dword [0x10075cb0]
cmp dword [ebp + 0x34], 0x10
push edx
cmovae ecx, dword [ebp + 0x20]
lea edx, [ebp - 0x110]
cmp dword [ebp + 0x1c], 0x10
push 0x100
cmovae eax, dword [ebp + 8]
push edx
push 0x10064fe2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xorps xmm0, xmm0
mov dword [ebp - 0x118], 0
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x114], 0
movups xmmword [ebp - 0x128], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002fea2
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.10033ba0
mov edx, str.true
lea ecx, [ebp - 0x128]
call fcn.10031d40
mov ecx, dword [ebp - 0x114]
mov byte [ebp - 0x129], al
cmp ecx, 0x10
jb 0x1002ff0e
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002ff04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ff9f
push ecx
push edx
call fcn.1003993d
add esp, 8
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x1002ff3e
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002ff34
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ff9f
push ecx
push edx
call fcn.1003993d
add esp, 8
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp ecx, 0x10
jb 0x1002ff80
mov edx, dword [ebp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002ff76
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ff9f
push ecx
push edx
call fcn.1003993d
add esp, 8
mov al, byte [ebp - 0x129]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100398ff
mov esp, ebp
pop ebp
ret
call fcn.1004950d
int3

Function at 0x10031c70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10031c97
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10031b50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10032100
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005c7ad
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10075368]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 0x110
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0xf
call fcn.10033f40
push 0x104
mov esi, eax
mov dword [ebp - 0x18], 0x104
push 0
push esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], 0x10f
call fcn.1003c170
add esp, 0xc
mov byte [esi + 0x104], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0x104
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1003221a
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
ja 0x100321b3
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
cmovae ecx, dword [ebp - 0x28]
mov byte [ecx + eax], 0
jmp 0x100321bf
push ecx
sub eax, ecx
lea ecx, [ebp - 0x28]
push eax
call fcn.10032560
push 9
push str.d3d9.dll
lea ecx, [ebp - 0x28]
call fcn.10033830
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
lea eax, [esi + 0x128000]
cmp esi, eax
jae 0x10032212
mov edx, 0x6c7
mov ecx, 0x8689
inc esi
cmp word [esi], dx
jne 0x10032208
cmp word [esi + 6], cx
jne 0x10032208
cmp word [esi + 0xc], cx
je 0x10032215
lea eax, [esi + 0x128000]
cmp esi, eax
jb 0x100321f6
inc esi
jmp 0x1003221c
add esi, 2
jmp 0x1003221c
xor esi, esi
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x1003224c
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10032242
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1003226a
push ecx
push edx
call fcn.1003993d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100398ff
mov esp, ebp
pop ebp
ret 4
call fcn.1004950d
int3
Function at 0x100362f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov bl, dl
call fcn.10036670
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.100363c0
mov dword [ebp - 0x14], 1
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], bl
cmp byte [ebp - 0xc], 0
je 0x1003634e
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10036360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
call fcn.10036670
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.100363c0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x100363b9
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10036440
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov bl, byte [esi]
test eax, eax
je 0x10036487
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036490
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov ecx, 0x401000
call fcn.10036670
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.100363c0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x100364ee
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x53ec8b55
jne 0x10036500
mov eax, 0x3e9
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x401000
call fcn.10036360
cmp eax, 0x16197be9
jne 0x1003651b
mov eax, 0x3ea
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8245bc
call fcn.10036360
cmp eax, 0x94bf
jne 0x10036536
mov eax, 0x3f3
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8252fc
call fcn.10036360
cmp eax, 0x94bf
jne 0x10036551
mov eax, 0x44d
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x82533c
call fcn.10036360
cmp eax, 0x94bf
jne 0x1003656c
mov eax, 0x457
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858d51
call fcn.10036360
cmp eax, 0x3539f633
jne 0x10036587
mov eax, 0xc80
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858c61
call fcn.10036360
xor ecx, ecx
mov edx, 0xc8a
cmp eax, 0x3539f633
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x100375d0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10037390
add esp, 4
test eax, eax
jne 0x1003762c
mov dword [ebp - 4], 9
jmp 0x100376b9
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x100376b9
mov dword [ebp - 8], 0
jmp 0x1003764a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x100376b9
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1003a425
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100376b7
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.1003a425
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.100371b0
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1003a425
jmp 0x10037641
mov eax, dword [ebp - 4]
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.1003a425
mov esp, ebp
pop ebp
ret

Function at 0x100376d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1003777b
mov dword [ebp - 4], 0
jmp 0x10037703
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x1003775e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1003a425
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003775c
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.1003a425
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1003a425
jmp 0x100376fa
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x10075ec4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.1003a425
pop esi
add esp, 8
cmp ebp, esp
call fcn.1003a425
mov esp, ebp
pop ebp
ret
Function at 0x10037790
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x10076ab0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100377f3
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1003a425
test eax, eax
jne 0x1003781e
mov eax, 0xa
jmp 0x10037920
cmp dword [ebp + 0xc], 0
je 0x1003786a
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x10037868
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x100378a6
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10037891
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.1003bbf0
add esp, 0xc
jmp 0x100378a6
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.1003bbf0
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1003a425
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1003a425
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.1003a425
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x10037944]
call fcn.1003a3d1
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.1003a425
mov esp, ebp
pop ebp
ret