joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a8a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x1012ba2b
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x103b2018]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [ecx + 8]
cmp eax, 2
jne 0x100a8ac8
push 0x10137da4
mov ecx, esi
call dword [0x10137604]
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x100a8b1f
lea ecx, [esp + 8]
call dword [0x1013762c]
mov dword [esp + 0x80], 0
push 0xd800
lea ecx, [esp + 0xc]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::LoadStringW]
mov ecx, esi
test eax, eax
je 0x100a8b0b
lea eax, [esp + 8]
push eax
call dword [0x1013761c]
lea ecx, [esp + 8]
jmp 0x100a8c03
push 0x10137d28
call dword [0x10137604]
lea ecx, [esp + 8]
jmp 0x100a8c03
fld qword [ecx]
lea edx, [esp + 0xc]
push edx
push 0
sub esp, 8
fstp qword [esp]
call dword [sym.imp.OLEAUT32.dll_GetAltMonthNames]
test eax, eax
je 0x100a8b4f
lea ecx, [esp + 8]
call dword [0x1013762c]
mov dword [esp + 0x80], 1
jmp 0x100a8ae2
movzx edx, word [esp + 0x16]
movzx ecx, word [esp + 0x18]
movzx eax, word [esp + 0x14]
mov dword [esp + 0x24], edx
movzx edx, word [esp + 0xe]
mov dword [esp + 0x20], ecx
movzx ecx, word [esp + 0x12]
dec edx
mov dword [esp + 0x28], eax
movzx eax, word [esp + 0xc]
mov dword [esp + 0x2c], ecx
movzx ecx, word [esp + 0x10]
mov dword [esp + 0x30], edx
movzx edx, word [esp + 0x1c]
sub eax, 0x76c
mov dword [esp + 0x38], ecx
dec edx
lea ecx, [esp + 4]
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], 0
call dword [0x1013762c]
push 0x100
lea ecx, [esp + 8]
mov dword [esp + 0x84], 2
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBufferSetLength]
mov edx, dword [esp + 4]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [edx - 0xc]
push 0x103800a0
push ecx
push eax
call dword [sym.imp.MSVCR90.dll_wcsftime]
add esp, 0x10
push 0xffffffffffffffff
lea ecx, [esp + 8]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
lea edx, [esp + 4]
push edx
mov ecx, esi
call dword [0x1013761c]
lea ecx, [esp + 4]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, esi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100ba980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1012d0e8
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x103b2018]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
sub esp, 0x28
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x30], esp
mov dword [esp + 0x3c], 0
mov edi, dword [esi + 8]
push eax
call sym.NirvanaBiz.dll_public:_void___thiscall_CNVUnit::constructor_class_CNVUnit_const__
mov ecx, esi
call fcn.100bae80
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret 0x28
Function at 0x100bb540
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1012d01b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push edi
mov eax, dword [0x103b2018]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0xc], edi
push 0x103c3118
mov dword [esp + 0x1c], 0x103c3118
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x30], edi
mov eax, dword [0x103c30d0]
mov ebx, 1
add eax, ebx
cmp eax, 0xa
mov dword [0x103c30d0], eax
jl 0x100bb5c7
mov dword [0x103c30d0], 0xa
cmp dword [esi + 0x98], edi
je 0x100bb693
mov eax, dword [esi + 0x98]
lea ecx, [eax + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x5c]
call edx
mov dword [eax + 0x28], ebx
mov ecx, dword [esi + 0x98]
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x5c]
add ecx, 4
call edx
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [0x103c30d0]
push eax
push str._iampw__c:_d__d
push esi
call fcn.100bbb80
mov eax, dword [esi + 0xa0]
add esp, 0x10
cmp eax, edi
je 0x100bb5ff
mov ebx, dword [eax + 0x18]
jmp 0x100bb619
push 0x10137da4
lea ecx, [esp + 0x18]
call dword [0x10137604]
mov byte [esp + 0x30], 1
mov dword [esp + 0xc], ebx
mov ebx, dword [eax]
push edi
call dword [sym.imp.MSVCR90.dll__time64]
add esp, 4
push str._H:_M:_S
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call fcn.10005710
mov edi, eax
mov dword [esp + 0x30], 2
mov eax, dword [esi + 0x98]
mov edx, dword [eax + 4]
lea ecx, [eax + 4]
mov eax, dword [edx + 0x5c]
call eax
mov ecx, dword [edi]
mov edx, dword [eax + 0x28]
mov eax, dword [0x103c30d0]
push ecx
mov ecx, dword [esi + 0x48]
push edx
push ebx
push eax
push str._iampw___c:_d__s__d__s
push ecx
call sub.NirvanaUtils.dll_public:_long_int___cdecl_GLog::WriteLogFormat_wchar_t_const__
add esp, 0x18
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
test byte [esp + 0xc], 1
je 0x100bb693
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push 0x103c3118
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100cd140
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1012e513
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x103b2018]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], vtable.regex::detail::independent_group_class_std::_String_const_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.0
mov dword [esp + 0x14], 1
call fcn.100ce140
lea ecx, [edi + 0x30]
mov byte [esp + 0x14], 0
mov dword [ecx], method.regex::detail::sub_expr_class_std::_String_const_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.virtual_0
call fcn.100ccd90
mov dword [esp + 0x14], 0xffffffff
mov dword [edi], vtable.regex::detail::match_group_base_class_std::_String_const_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.0
cmp dword [edi + 0xc], 0
je 0x100cd1af
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 4]
mov dword [edi + 0xc], ecx
test ecx, ecx
jne 0x100cd1a2
mov ecx, edi
call fcn.100ccd90
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret

Function at 0x100cd4a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1012e4e3
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x103b2018]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], vtable.regex::detail::lookbehind_assertion_class_std::_String_const_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.0
mov dword [esp + 0x14], 1
call fcn.100ce140
lea ecx, [edi + 0x30]
mov byte [esp + 0x14], 0
mov dword [ecx], method.regex::detail::sub_expr_class_std::_String_const_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.virtual_0
call fcn.100ccd90
mov dword [esp + 0x14], 0xffffffff
mov dword [edi], vtable.regex::detail::match_group_base_class_std::_String_const_iterator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.0
cmp dword [edi + 0xc], 0
je 0x100cd50f
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 4]
mov dword [edi + 0xc], ecx
test ecx, ecx
jne 0x100cd502
mov ecx, edi
call fcn.100ccd90
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret
Function at 0x100d3220
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1012ce58
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x103b2018]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov esi, dword [ebp + 0x30]
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov ebx, eax
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push ebp
mov ecx, edi
call edx
test al, al
je 0x100d3311
cmp dword [ebp + 0x18], 0
je 0x100d32ea
mov eax, dword [esi + 0x1c]
lea ecx, [eax + 8]
mov dword [esi + 0x1c], ecx
cmp dword [esi + 0x20], ecx
jae 0x100d32a5
push 8
mov dword [esi + 0x1c], eax
call fcn.100d9df0
test eax, eax
je 0x100d32ab
mov dword [eax], edi
mov dword [eax + 4], 0x103c2804
mov edi, dword [ebp + 0x18]
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push ebp
mov ecx, edi
mov dword [esp + 0x30], edi
call edx
test al, al
jne 0x100d3287
cmp ebx, dword [esi + 0x1c]
je 0x100d3311
lea eax, [esp + 0x2c]
push eax
call fcn.100e4ad0
mov edi, dword [esp + 0x2c]
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push ebp
mov ecx, edi
call eax
test al, al
je 0x100d32c7
jmp 0x100d3287
mov dword [esp + 0x24], 0xffffffff
mov ebx, dword [esp + 0x18]
call fcn.100cf7e0
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov dword [esp + 0x24], 0xffffffff
mov ebx, dword [esp + 0x18]
call fcn.100cf7e0
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x100d91a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1012e363
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x103b2018]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], vtable.regex::detail::independent_group_wchar_t_const__.0
mov dword [esp + 0x14], 1
call fcn.100ce140
lea ecx, [edi + 0x30]
mov byte [esp + 0x14], 0
mov dword [ecx], vtable.regex::detail::indestructable_sub_expr_wchar_t_const___class_regex::detail::independent_group_wchar_t_const__::end_group_.0
call fcn.100d8d00
mov dword [esp + 0x14], 0xffffffff
mov dword [edi], vtable.regex::detail::match_group_base_wchar_t_const__.0
cmp dword [edi + 0xc], 0
je 0x100d920f
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 4]
mov dword [edi + 0xc], ecx
test ecx, ecx
jne 0x100d9202
mov ecx, edi
call fcn.100d8d00
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret
Function at 0x100d93e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1012e333
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x103b2018]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 8], edi
mov dword [edi], vtable.regex::detail::lookbehind_assertion_wchar_t_const__.0
mov dword [esp + 0x14], 1
call fcn.100ce140
lea ecx, [edi + 0x30]
mov byte [esp + 0x14], 0
mov dword [ecx], vtable.regex::detail::indestructable_sub_expr_wchar_t_const___struct_regex::detail::lookbehind_assertion_wchar_t_const__::end_group_.0
call fcn.100d8d00
mov dword [esp + 0x14], 0xffffffff
mov dword [edi], vtable.regex::detail::match_group_base_wchar_t_const__.0
cmp dword [edi + 0xc], 0
je 0x100d944f
mov eax, dword [edi + 0xc]
mov ecx, dword [eax + 4]
mov dword [edi + 0xc], ecx
test ecx, ecx
jne 0x100d9442
mov ecx, edi
call fcn.100d8d00
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret
Function at 0x100f50f0
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x100f510a
pop edi
lea eax, [esi + 1]
pop esi
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x100f521a
push ebp
jmp 0x100f5120
mov eax, ebx
cmp ebx, 0x15b0
jb 0x100f512f
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x100f51db
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x100f5150
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x100f5150
test eax, eax
je 0x100f51ed
nop
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x100f51e0
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x100f5120
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret
Function at 0x100f53e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esi + 0x24]
push edi
lea esp, [esp]
mov eax, dword [esi + 0x64]
mov edi, dword [esi + 0x34]
mov ecx, dword [esi + 0x6c]
sub edi, eax
sub edi, ecx
mov dword [esp + 0xc], edi
jne 0x100f5414
test eax, eax
jne 0x100f5423
test ecx, ecx
jne 0x100f5423
mov dword [esp + 0xc], ebp
jmp 0x100f5494
cmp edi, 0xffffffff
jne 0x100f5423
mov dword [esp + 0xc], 0xfffffffe
jmp 0x100f5494
mov ecx, dword [esi + 0x24]
lea edx, [ecx + ebp - 0x106]
cmp eax, edx
jb 0x100f5494
mov eax, dword [esi + 0x30]
push ebp
lea ecx, [eax + ebp]
push ecx
push eax
call sub.MSVCR90.dll_memcpy
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], ebp
sub dword [esi + 0x64], ebp
add esp, 0xc
sub dword [esi + 0x54], ebp
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x100f5463
sub eax, ebp
jmp 0x100f5465
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x100f5454
mov ecx, dword [esi + 0x38]
mov edx, ebp
lea ecx, [ecx + ebp*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebp
jb 0x100f5484
sub eax, ebp
jmp 0x100f5486
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x100f5475
add edi, ebp
mov dword [esp + 0xc], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x100f5536
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x64]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x30]
mov edx, dword [esp + 0xc]
mov ebx, ecx
mov dword [esp + 0x10], eax
cmp ebx, edx
jbe 0x100f54bc
mov ebx, edx
test ebx, ebx
je 0x100f54f7
mov edx, dword [edi + 0x1c]
sub ecx, ebx
mov dword [edi + 4], ecx
cmp dword [edx + 0x18], 0
jne 0x100f54e5
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.100f50f0
mov dword [edi + 0x30], eax
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov edx, dword [edi]
push ebx
push edx
push eax
call sub.MSVCR90.dll_memcpy
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x6c], ebx
mov edi, dword [esi + 0x6c]
cmp edi, 3
jb 0x100f5522
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x40], eax
movzx edx, byte [edx + 1]
shl eax, cl
xor eax, edx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp edi, 0x106
jae 0x100f5536
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x100f53f0
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100f7750
Capabilities:
Create thread

Disassembly:
sub esp, 8
push ebp
push esi
push edi
push 0x14
call sub.mfc90u.dll_new
xor ecx, ecx
add esp, 4
cmp eax, ecx
je 0x100f7775
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov esi, eax
jmp 0x100f7777
xor esi, esi
mov dword [esp + 0x10], esi
cmp esi, ecx
je 0x100f77c4
lea eax, [esi + 4]
push eax
push ecx
push esi
push 0x100f7cf0
push ecx
mov dword [esi + 0xc], ebx
push ecx
mov dword [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
mov ebp, dword [ebx + 0x18]
mov esi, dword [ebp + 0x14]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x10]
push ecx
push edx
push esi
call fcn.100cf000
mov ecx, ebp
mov edi, eax
call fcn.100f8510
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
inc dword [ebx + 0x10]
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x100f7910
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x1012cc62
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebp
push esi
push edi
mov eax, dword [0x103b2018]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x100f7aab
mov eax, dword [eax]
test eax, eax
je 0x100f7aab
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
jne 0x100f79bc
cmp dword [ebx + 0x54], eax
je 0x100f7aab
push str._H:_M:_S
push ecx
lea esi, [esp + 0x18]
call fcn.1000d160
add esp, 4
push eax
lea ecx, [esp + 0x44]
call fcn.10005710
mov dword [esp + 0x34], 0
mov edx, dword [eax]
mov eax, dword [ebx + 0x54]
push edx
push str._TP___kill_fa___s
push eax
call sub.NirvanaUtils.dll_public:_long_int___cdecl_GLog::WriteLogFormat_wchar_t_const__
add esp, 0xc
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
cmp dword [ebx + 0x54], 0
je 0x100f7a04
push str._H:_M:_S
push ecx
lea esi, [esp + 0x28]
call fcn.1000d160
add esp, 4
push eax
lea ecx, [esp + 0x18]
call fcn.10005710
mov dword [esp + 0x34], 1
mov ecx, dword [eax]
mov edx, dword [ebx + 0x54]
push ecx
push str._s_t__TP__KillThread
push edx
call sub.NirvanaUtils.dll_public:_long_int___cdecl_GLog::WriteLogFormat_wchar_t_const__
add esp, 0xc
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, dword [ebx + 0x18]
mov ecx, dword [eax + 0x14]
mov ebp, dword [ecx]
mov esi, dword [eax]
mov edi, edi
mov eax, dword [ebx + 0x18]
mov edi, dword [eax + 0x14]
mov eax, dword [eax]
test esi, esi
je 0x100f7a20
cmp esi, eax
je 0x100f7a26
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
cmp ebp, edi
je 0x100f7a76
mov edi, dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
test esi, esi
jne 0x100f7a5c
call edi
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x100f7a3f
call edi
mov edx, dword [esp + 0x3c]
cmp dword [ebp + 8], edx
je 0x100f7a64
test esi, esi
jne 0x100f7a60
call edi
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x100f7a57
call edi
mov ebp, dword [ebp]
jmp 0x100f7a10
mov eax, dword [esi]
jmp 0x100f7a38
mov eax, dword [esi]
jmp 0x100f7a50
mov edi, dword [ebx + 0x18]
push ebp
push esi
lea eax, [esp + 0x28]
push eax
call fcn.100f8310
dec dword [ebx + 8]
mov esi, dword [esp + 0x3c]
mov edx, dword [esi]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call sub.mfc90u.dll_delete
add esp, 4
inc dword [ebx + 0x14]
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x100f7f50
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1012cbf9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x103b2018]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [ebx + 0x24]
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [ebx + 0x54], edi
je 0x100f7fdf
push edi
call dword [sym.imp.MSVCR90.dll__time64]
add esp, 4
mov dword [esp + 0x14], eax
push str._H:_M:_S
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], edx
call fcn.10005710
mov dword [esp + 0x28], edi
mov ecx, dword [eax]
mov edx, dword [ebx + 0x54]
push ecx
push str._s__TP__StopAllThread
push edx
call sub.NirvanaUtils.dll_public:_long_int___cdecl_GLog::WriteLogFormat_wchar_t_const__
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, dword [ebx + 0x18]
cmp dword [eax + 0x18], edi
je 0x100f8083
jmp 0x100f7ff0
mov ecx, dword [eax + 0x14]
mov eax, dword [eax]
mov esi, dword [ecx]
cmp eax, edi
jne 0x100f80c5
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x100f8012
call dword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov esi, dword [esi + 8]
cmp esi, edi
je 0x100f8077
mov edx, dword [esi]
push 0xea60
push edx
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x100f8056
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [esp + 0xc]
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebx + 0x18]
mov edx, dword [edi + 0x14]
mov eax, dword [edx]
mov ecx, dword [edi]
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
call fcn.100f8310
push esi
call sub.mfc90u.dll_delete
add esp, 4
xor edi, edi
mov eax, dword [ebx + 0x18]
cmp dword [eax + 0x18], edi
jne 0x100f7ff0
mov esi, dword [ebx + 0x20]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx + 4]
push edx
mov ecx, esi
call fcn.100f84b0
mov eax, dword [esi + 0x18]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], edi
mov dword [eax], eax
mov eax, dword [esp + 0x10]
mov esi, dword [esi + 0x18]
push eax
mov dword [esi + 8], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [eax]
jmp 0x100f8007