joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100027e1
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x100027a2
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x407458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x407467
pop dword [ebp - 0x3c]
mov eax, 0x13d071fc
add eax, 0xec70026b
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x87e0f138
add dword [ebp - 0x4c], 0xc6715413
mov dword [ebp - 0x48], 0xad11b6bb
sub dword [ebp - 0x48], 0x7ade6a76
mov dword [ebp - 0x44], 0x4660692c
sub dword [ebp - 0x44], 0xfa1424fe
mov dword [ebp - 0x40], 0xf41baf27
add dword [ebp - 0x40], 0xbe450d9
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x897a4bf8
add eax, 0x76c63480
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xa7517279
add dword [ebp - 0x4c], 0xcd20f6dd
mov dword [ebp - 0x48], 0x91df1109
add dword [ebp - 0x48], 0xaf8d506c
mov dword [ebp - 0x44], 0x4e657747
add dword [ebp - 0x44], 0x1509f525
mov dword [ebp - 0x40], 0x8ff5ecfc
sub dword [ebp - 0x40], 0x8ff5ecfc
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xd0a6a06a
sub eax, 0xd0661fee
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x375c0
push 0
call eax
mov ecx, 0xbfbc4473
sub ecx, 0xbfbbfb6b
mov edi, eax
mov ebx, 0x451400
add ebx, dword [ebp - 0x3c]
mov esi, 0x4f9be539
sub esi, 0x55320aff
xor dword [ebp - 0x18], ecx
mov edx, dword [ebx]
sub dword [ebp - 0x2c], 0x73f034bb
add edx, esi
mov dword [ebp - 0x18], 0x91615fbe
mov dword [edi], edx
sub dword [ebp - 0x38], ecx
add edi, 4
add ebx, 0xe3dd1390
add ebx, 0x1c22ec74
loop 0x407583
add eax, 0x116f3
mov ebx, eax
add eax, 5
mov ecx, 0xb02a450c
add ecx, 0x5015baf4
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10002100
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0x20006
push 0
mov esi, ecx
mov dword [ebp - 8], 0
push esi
push 0x80000001
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000216a
lea eax, ds:[ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1000218b
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002c661
mov esp, ebp
pop ebp
ret

Function at 0x100021a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x118]
movss dword [ebp - 0x11c], xmm2
push eax
push 0x20006
push 0
push 0x10067790
push 0x80000001
mov esi, edx
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10002228
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x10067790
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
nop
test eax, eax
jne 0x100022a8
push 0x104
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.1002e140
movss xmm0, dword [ebp - 0x11c]
lea eax, [ebp - 0x110]
cvtps2pd xmm0, xmm0
add esp, 4
movsd qword [esp], xmm0
push 0x100513a8
push 0xffffffffffffffff
push 0x104
push eax
call fcn.100013e0
lea ecx, [ebp - 0x110]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002272
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x110]
push eax
push 1
push 0
push esi
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword ds:[ebp - 0x118]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1002c661
mov esp, ebp
pop ebp
ret

Function at 0x100022c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, dword [ebp + 0xc]
push 0x104
push 0
push eax
call fcn.1002e140
add esp, 0xc
mov dword [ebp - 0x110], 1
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 2
push esi
push 0x10067790
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov esi, eax
lea eax, [ebp - 0x108]
push eax
call fcn.1003a642
mov ecx, dword [ebp - 4]
add esp, 4
fstp dword [edi]
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.1002c661
mov esp, ebp
pop ebp
ret
Function at 0x10002e60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push edi
push eax
push 0
push dword [ebp + 0xc]
push 0
push 0
call fcn.10001280
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.100352b3
mov edi, eax
add esp, 0x1c
or eax, 0xffffffff
mov ecx, 2
test edi, edi
cmovs edi, eax
xor ebx, ebx
add edi, 2
mov eax, edi
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.1002cbce
add esp, 4
mov dword [esp + 0xc], eax
push ebx
push 0
push eax
call fcn.1002e140
add esp, 0xc
lea eax, [ebp + 0x10]
mov edx, edi
push eax
push dword [ebp + 0xc]
push ecx
mov ecx, dword [esp + 0x18]
call fcn.100012e0
add esp, 0xc
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10002f2c
nop
test edi, edi
je 0x10002f25
mov esi, dword [esp + 0xc]
cmp word [esi], 0
je 0x10002f1c
push 0
push 0
push 1
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, 2
sub edi, 1
jne 0x10002f08
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0xc]
call fcn.1002c674
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007c20
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100664c6], 1
push ebx
push esi
push edi
mov edi, ecx
jne 0x10007c90
cmp dword [0x10072ba0], 0
je 0x10007c90
push dword [0x10067cb4]
call dword [0x10067cb8]
add esp, 4
cmp dword [0x10067cb4], 2
jne 0x10007c69
mov dword [0x10067cb4], 3
cmp eax, 0x4d2
jne 0x10007c78
cmp edx, 0x1100001
je 0x10007c90
mov dword [edi], eax
mov eax, edi
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002c661
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10067bac]
test ecx, ecx
jne 0x10007e03
push ecx
push 0x80
push 3
push ecx
push 1
push 0x80000000
push 0x10066af0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10007d06
push str.ISteamUser::GetSteamID_____Reading_SteamID_from_ticket_file__r_n
call fcn.10002360
add esp, 4
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10007d33
push str.ISteamUser::GetSteamID_____Unable_to_get_ticket_size__r_n
call fcn.10002360
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0x4d2
mov ecx, dword [ebp - 4]
mov byte [ebp - 9], 1
xor ecx, ebp
mov eax, dword [ebp - 0xc]
and eax, 0xff100001
or eax, 0x100001
mov dword [edi + 4], eax
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.1002c661
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x10]
push esi
call fcn.1002cbce
add esp, 4
mov dword [ebp - 0x18], eax
push esi
mov esi, eax
push 0
push esi
call fcn.1002e140
add esp, 0xc
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push dword [ebp - 0x10]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10007d94
push str.ISteamUser::GetSteamID_____Unable_to_read_ticket_file__r_n
call fcn.10002360
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.1002c674
add esp, 4
jmp 0x10007d06
cmp dword [ebp - 0x14], 0x30
jae 0x10007da2
push str.ISteamUser::GetSteamID_____Ticket_struct_is_too_big__r_n
nop
jmp 0x10007d71
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
jne 0x10007dcd
push str.ISteamUser::GetSteamID_____Ticket_length_is_0__r_n
call fcn.10002360
add esp, 4
push esi
call fcn.1002c674
add esp, 4
jmp 0x10007d06
mov eax, dword [esi + 8]
test eax, eax
jne 0x10007def
push str.ISteamUser::GetSteamID_____SteamID_is_0__r_n
call fcn.10002360
add esp, 4
push esi
call fcn.1002c674
add esp, 4
jmp 0x10007d06
push esi
mov dword [0x10067bac], eax
call fcn.1002c674
mov ecx, dword [0x10067bac]
add esp, 4
mov dword [edi], ecx
jmp 0x10007d0c
Function at 0x10008540
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x10063040]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0x10063d24], 1
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x1000858b
mov eax, dword [0x10063ad0]
test eax, eax
je 0x1000858b
cmp eax, 0x3e7
je 0x1000857a
dec eax
mov dword [0x10063ad0], eax
test ebx, ebx
jne 0x1000859f
push str.GetStat_int32_Failed_____pchName_is_nullptr__r_n
call fcn.10002360
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002c661
mov esp, ebp
pop ebp
ret
nop
test edi, edi
jne 0x100085ab
push str.GetStat_int32_Failed_____pData_is_nullptr__r_n
jmp 0x10008583
cmp dword [edi], 0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push 0x10067790
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x24], 4
push 0x80000001
jne 0x10008661
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008628
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [eax + eax]
test esi, esi
je 0x100086ac
push dword [edi]
mov edx, ebx
mov ecx, 0x10067790
call fcn.10002100
add esp, 4
test eax, eax
je 0x100086b2
push dword [edi]
push ebx
push str.GetStat_int32_Failed______s______d_r_n
call fcn.10002360
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002c661
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008697
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x100086ac
push 0
mov edx, ebx
mov ecx, 0x10067790
call fcn.10002100
add esp, 4
test eax, eax
jne 0x1000863d
mov eax, dword [esp + 0x10]
mov dword [edi], eax
mov ecx, dword ds:[esp + 0x1c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002c661
mov esp, ebp
pop ebp
ret
Function at 0x100087e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x10063040]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0x10063d24], 1
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x10008831
cmp byte [ebp + 8], 0
jne 0x10008820
mov eax, dword [0x10063ad4]
test eax, eax
je 0x10008831
cmp eax, 0x3e7
je 0x10008820
dec eax
mov dword [0x10063ad4], eax
test ebx, ebx
jne 0x10008849
push str.GetAchievement_Failed_____pchName_is_nullptr__r_n
call fcn.10002360
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002c661
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x10008854
push str.GetAchievement_Failed_____pbAchieved_is_nullptr__r_n
jmp 0x10008829
cmp byte [edi], 0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push 0x10067898
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x24], 4
push 0x80000001
jne 0x1000890b
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100088ce
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword ds:[esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10008959
movzx eax, byte [edi]
mov edx, ebx
push eax
mov ecx, 0x10067898
call fcn.10002100
add esp, 4
test eax, eax
je 0x10008963
movzx eax, byte [edi]
push eax
push ebx
push str.GetAchievement_Failed______s______d_r_n
call fcn.10002360
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1002c661
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008944
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [eax]
test esi, esi
je 0x10008959
push 0
mov edx, ebx
mov ecx, 0x10067898
call fcn.10002100
add esp, 4
test eax, eax
jne 0x100088e5
cmp dword [esp + 0x10], 0
setne al
mov byte [edi], al
mov ecx, dword [esp + 0x1c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002c661
mov esp, ebp
pop ebp
ret
Function at 0x10008ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x10063040]
xor eax, esp
mov dword [esp + 0x120], eax
cmp dword [0x10063d24], 1
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
je 0x10008bf4
mov eax, dword [0x10063ad4]
test eax, eax
je 0x10008bf4
cmp eax, 0x3e7
je 0x10008be3
dec eax
mov dword [0x10063ad4], eax
test esi, esi
jne 0x10008c0b
push str.GetAchievementAndUnlockTime_Failed_____pchName_is_nullptr__r_n
call fcn.10002360
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.1002c661
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x10008c16
push str.GetAchievementAndUnlockTime_Failed_____pbAchieved_is_nullptr__r_n
jmp 0x10008bec
test edi, edi
jne 0x10008c22
push str.GetAchievementAndUnlockTime_Failed_____prtTime_is_nullptr__r_n
nop
jmp 0x10008bec
push esi
push str.GetAchievementAndUnlockTime______s_r_n
call fcn.10002360
push 0x104
lea eax, [esp + 0x2c]
mov byte [ebx], 0
push 0
push eax
mov dword [edi], 0
call fcn.1002e140
add esp, 0x14
lea eax, [esp + 0x20]
push esi
push str._s_Time
push 0xffffffffffffffff
push 0x104
push eax
call fcn.100013e0
add esp, 0x14
mov byte [esp + 0xf], 0
lea edx, [esp + 0xf]
mov ecx, esi
push 1
call fcn.100087e0
add esp, 4
cmp byte [esp + 0xf], 1
jne 0x10008d10
push esi
push str.GetAchievementAndUnlockTime______s_r_n
call fcn.10002360
add esp, 8
mov byte [ebx], 1
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], 4
push eax
push 0x20019
push 0
push 0x10067898
push 0x80000001
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10008d10
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
push 0
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword ds:[esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10008d10
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov ecx, dword ds:[esp + 0x12c]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002c661
mov esp, ebp
pop ebp
ret
Function at 0x10025200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
cmp eax, 1
jne 0x100253d8
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlImageNtHeader
push eax
mov dword [0x10067ecc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100666d0], eax
lea eax, [ebp - 8]
push eax
push 0
push 2
mov dword [0x10066ae8], edi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x10025286
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_exe_path___1_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
push 0x100679a0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x100252b8
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_exe_path___2_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
nop
call esi
cmp eax, 0x7a
jne 0x100252e6
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_exe_path___3_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x104
push 0x100662b8
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10025316
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_dll_path___1_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call esi
cmp eax, 0x7a
jne 0x10025339
push 0x10
push str.GreenLuma_2024
push str.Unable_to_get_dll_path___2_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100679a0
push 0x104
push 0x100682f0
call fcn.1003691d
push 0x100662b8
push 0x104
push 0x10072998
call fcn.1003691d
add esp, 0x18
mov edx, str.user32.dll
mov ecx, 0x10072998
call fcn.10001d80
cmp al, 1
jne 0x100253cf
push str.steamclient.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x100253c8
push esi
call dword [0x100666d0]
push str.xxx____x____x____
push 0x1005bae8
mov ecx, esi
mov edx, dword [eax + 0x50]
call fcn.10001fc0
add esp, 8
mov dword [0x10072bb0], eax
test eax, eax
je 0x100253c8
push ecx
lea edx, [ebp - 0xc]
mov word [ebp - 0xc], 0x18eb
call fcn.10002040
add esp, 4
mov byte [0x10065e96], 1
xor ecx, ecx
call fcn.100234c0
jmp 0x10025425
test eax, eax
jne 0x10025425
nop dword [eax]
cmp byte [0x10065e95], al
jne 0x10025425
xor edx, edx
xor ecx, ecx
call fcn.10027a40
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateUserProcess
push dword [0x10067ecc]
call esi
mov ecx, eax
call fcn.10027900
push str.NtResumeThread
push dword [0x10067ecc]
call esi
mov ecx, eax
call fcn.10027900
nop
call fcn.10027500
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1002c661
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10027000
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
je 0x10027178
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
xorps xmm0, xmm0
push eax
push edi
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_Thread32First]
nop dword [eax + eax]
test eax, eax
je 0x10027171
mov ebx, 1
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x100270ff
nop word [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x100270ff
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100270ff
mov edx, dword [esi]
test edx, edx
jne 0x100270c3
push 0x200
push 8
push dword [0x10072fdc]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10027125
lea edi, [esi + 8]
jmp 0x100270f2
mov eax, dword [esi + 4]
lea edi, [esi + 8]
cmp dword [edi], eax
jb 0x100270f2
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 8
push dword [0x10072fdc]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1002718b
mov dword [esi], edx
mov ecx, dword [edi]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [edi]
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10027070
call dword [sym.imp.KERNEL32.dll_GetLastError]
nop
cmp eax, 0x12
je 0x10027171
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x10027171
push eax
push ebx
push dword [0x10072fdc]
call dword [sym.imp.KERNEL32.dll_HeapSize]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x1002715b
test ecx, ecx
je 0x1002715b
mov eax, dword [esi]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10027150
push dword [esi]
push 0
push dword [0x10072fdc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002c661
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x24]
jmp 0x10027125
Function at 0x100271a0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10027000
test eax, eax
jne 0x100271d3
mov eax, 9
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [edi], 0
je 0x1002722e
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x10027226
push ebx
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1002721d
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.10026e60
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x100271e6
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10027240
Capabilities:
Resume thread

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x100272c6
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x10027286
push ebx
mov eax, dword ds:[edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1002727a
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x10027251
pop ebx
push dword [edi]
push 0
push dword [0x10072fdc]
call dword [sym.imp.KERNEL32.dll_HeapSize]
pop esi
cmp eax, 0xffffffff
je 0x100272b1
nop dword [eax]
test eax, eax
je 0x100272b1
mov ecx, dword [edi]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x100272a6
push dword ds:[edi]
push 0
push dword [0x10072fdc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
ret