joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100852b1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1008522d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10085420
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10085420
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100853d5
jg 0x1008530d
test eax, eax
je 0x100853cb
push 1
push 0x1000
call fcn.10076c4d
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10085330
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100853c2
push 0x8000
push ebx
call fcn.1008515e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10085359
jg 0x10085354
cmp ecx, 0x1000
jb 0x10085359
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10077a64
add esp, 0x10
cmp eax, 0xffffffff
je 0x1008539e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10085354
jl 0x10085385
test ecx, ecx
jne 0x10085346
push dword [ebp - 0xc]
push ebx
call fcn.1008515e
push esi
call fcn.10077dc1
add esp, 0xc
xor ebx, ebx
jmp 0x1008542e
cmp byte [edi + 0x24], 0
je 0x100853b5
cmp dword [edi + 0x20], 5
jne 0x100853b5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100853c0
mov ebx, dword [edi + 0x18]
jmp 0x100853c2
xor ebx, ebx
push esi
call fcn.10077dc1
pop ecx
jmp 0x1008542e
test ecx, ecx
jg 0x10085397
jl 0x100853d5
test eax, eax
jae 0x10085397
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1007a760
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100853f5
cmp byte [edi + 0x1c], 0
je 0x10085397
jmp 0x10085426
push ebx
call fcn.100814d6
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10085397
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1008542e
cmp byte [edi + 0x1c], 0
je 0x1008542b
mov ebx, dword [edi + 0x18]
jmp 0x1008542e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1007a760
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10085ee0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10085f0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10085f0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100224e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x100224fd
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x10022504
mov al, 1
jmp 0x100225ea
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x18], edx
call fcn.100199f0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
call fcn.100199f0
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.10024820
add esp, 8
movzx eax, al
test eax, eax
je 0x1002254a
xor al, al
jmp 0x100225ea
mov dword [ebp - 0x2c], 0x20
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x38]
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x50]
push edx
mov eax, dword [ebp - 4]
add eax, 0x40
push eax
mov ecx, dword [ebp - 0x24]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002258d
cmp dword [ebp - 8], 1
je 0x10022594
cmp dword [ebp - 8], 3
je 0x100225e4
jmp 0x100225e8
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x3d], 0
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x50]
sub edx, eax
mov dword [ebp - 0xc], edx
je 0x100225c4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x4c]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 1
lea ecx, [ebp - 0x50]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0xc], eax
je 0x100225c4
xor al, al
jmp 0x100225ea
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x3d]
test eax, eax
jne 0x100225d8
mov dword [ebp - 0x10], 1
jmp 0x100225df
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
jmp 0x100225ea
mov al, 1
jmp 0x100225ea
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x100270d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x100270fc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x100271ea
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x10027193
jg 0x10027125
cmp dword [ebp + 0xc], 0
jbe 0x10027193
cmp dword [ebp - 8], 0
jl 0x10027193
jg 0x10027133
cmp dword [ebp - 0xc], 0
jbe 0x10027193
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x10027151
jl 0x10027145
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x10027151
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.100196c0
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x100271de
jg 0x100271a1
cmp dword [ebp + 0xc], 0
jbe 0x100271de
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x100271de
mov ecx, dword [ebp - 4]
call fcn.100233f0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100271f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x1002721c
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x10027302
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x100272b3
jg 0x10027245
cmp dword [ebp + 0xc], 0
jbe 0x100272b3
cmp dword [ebp - 8], 0
jl 0x100272b3
jg 0x10027253
cmp dword [ebp - 0xc], 0
jbe 0x100272b3
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 8]
jg 0x10027271
jl 0x10027265
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jae 0x10027271
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const]
push eax
call fcn.100196c0
add esp, 0xc
mov eax, dword [ebp - 0xc]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
sbb edx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int_]
cmp dword [ebp + 0x10], 0
jl 0x100272f6
jg 0x100272c1
cmp dword [ebp + 0xc], 0
jbe 0x100272f6
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x4c], 0
je 0x100272f6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100363b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1016597c]
mov dword [ebp - 4], eax
jmp 0x100363c8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100363de
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100363dc
mov eax, dword [ebp - 4]
jmp 0x10036459
jmp 0x100363c0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10036456
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x10036418
mov edx, dword [ebp - 4]
mov eax, dword [0x1016597c]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1016597c], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10037410
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x10165970]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10037454
mov eax, dword [ebp - 8]
sub eax, 5
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 2
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10037476
mov eax, 0xa
jmp 0x10037561
cmp dword [ebp + 0xc], 0
je 0x100374c2
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 8]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x100374c0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x14]
mov byte [edx + 1], 0xf9
jmp 0x10037502
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100374ef
mov eax, dword [ebp - 4]
add eax, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [eax]
mov dword [ecx], edx
mov dx, word [eax + 4]
mov word [ecx + 4], dx
mov al, byte [eax + 6]
mov byte [ecx + 6], al
jmp 0x10037502
mov ecx, dword [ebp - 4]
add ecx, 0xc
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov dword [edx], eax
mov cl, byte [ecx + 4]
mov byte [edx + 4], cl
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 1
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfd
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
mov al, byte [ebp + 0xc]
and al, 1
shl al, 2
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + 0x14]
and dl, 0xfb
or dl, al
mov eax, dword [ebp - 4]
mov byte [eax + 0x14], dl
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100375c0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x100376f4
mov dword [ebp - 0x24], 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100376ea
cmp dword [ebp - 0x24], 0x10
jb 0x100376ce
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x18], eax
jne 0x100376ce
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x1c], eax
je 0x100376ce
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x1003765e
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
push edx
push 0
mov eax, dword [0x101533d4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x1003765c
jmp 0x100376ea
jmp 0x100376ae
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x100376ae
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x101533d4]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10037698
jmp 0x100376ea
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x24], 0x1c
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100375f8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x10037820
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100375c0
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x100378bd
mov dword [ebp - 4], 0
jmp 0x10037869
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x100378bd
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100378bb
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.10037cc0
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10037860
mov esp, ebp
pop ebp
ret
Function at 0x100378e0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 8], 0
call fcn.10037570
cmp dword [0x101533d4], 0
je 0x10037aa0
mov eax, dword [ebp + 8]
push eax
call fcn.10036460
add esp, 4
test eax, eax
je 0x10037a97
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10036460
add esp, 4
test eax, eax
je 0x10037a97
mov edx, dword [ebp + 8]
push edx
call fcn.10037700
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x10037a8e
mov eax, dword [ebp + 8]
push eax
call fcn.100362b0
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10037a85
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.10037e70
add esp, 4
test eax, eax
je 0x10037a6a
call fcn.100370d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10037a61
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x34]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x30]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 8], ecx
mov dl, byte [ebp - 0x28]
and dl, 1
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfe
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfd
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
mov eax, dword [ebp - 0x24]
and eax, 0xf
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
and edx, 0xfffffff0
or edx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 0x20], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 0x24], edx
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x10037a3b
mov ecx, dword [ebp + 8]
sub ecx, 5
mov edx, dword [ebp - 4]
add edx, 0xc
mov eax, dword [ecx]
mov dword [edx], eax
mov ax, word [ecx + 4]
mov word [edx + 4], ax
mov cl, byte [ecx + 6]
mov byte [edx + 6], cl
jmp 0x10037a4e
mov edx, dword [ebp - 4]
add edx, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [edx], ecx
mov al, byte [eax + 4]
mov byte [edx + 4], al
cmp dword [ebp + 0x10], 0
je 0x10037a5f
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ecx], eax
jmp 0x10037a68
mov dword [ebp - 8], 9
jmp 0x10037a71
mov dword [ebp - 8], 8
cmp dword [ebp - 8], 0
je 0x10037a83
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10036300
add esp, 4
jmp 0x10037a8c
mov dword [ebp - 8], 9
jmp 0x10037a95
mov dword [ebp - 8], 3
jmp 0x10037a9e
mov dword [ebp - 8], 7
jmp 0x10037aa7
mov dword [ebp - 8], 2
call fcn.100378d0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10037df0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10037e64
mov dword [ebp - 4], 0
jmp 0x10037e10
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x10037e50
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10037e4e
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10037e07
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x101533d4]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esp, ebp
pop ebp
ret

Function at 0x10038290
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100382d9
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100382d9
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100382d9
xor eax, eax
jmp 0x1003831a
mov dword [ebp - 4], 1
jmp 0x100382eb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10038315
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x10038313
xor eax, eax
jmp 0x1003831a
jmp 0x100382e2
mov eax, 1
mov esp, ebp
pop ebp
ret