joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424b44
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 1
pop edi
xor ebx, ebx
cmp dword [0x4342bc], edi
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
jne 0x424bc0
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00423e31
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x4342bc], eax
jne 0x424bc0
mov eax, 0x7532
jmp 0x424c77
cmp dword [0x4342ac], ebx
jne 0x424c1d
xor esi, esi
push dword [ebp + 0x10]
push 0x4342bc
push dword [ebp + 8]
call fcn.00424cd9
add esp, 0xc
cmp eax, ebx
je 0x424bf9
cmp eax, 0x6688
jne 0x424c05
push 0x1f4
call fcn.00424c7c
inc esi
pop ecx
cmp esi, 3
jl 0x424bca
cmp esi, 3
jne 0x424c1d
mov esi, 0x4f1a
jmp 0x424c07
mov esi, eax
push dword [0x4342bc]
call fcn.00423f5a
pop ecx
mov dword [0x4342bc], edi
mov eax, esi
jmp 0x424c77
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.00421e86
lea eax, [ebp - 4]
push ebx
push eax
push 0x80
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 5
push dword [0x4342bc]
call fcn.00423ebc
add esp, 0x28
test eax, eax
je 0x424c60
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00424149
pop ecx
pop ecx
jmp 0x424c77
push dword [0x4342bc]
call fcn.00423f5a
pop ecx
mov dword [0x4342bc], edi
call fcn.00423fd3
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42504d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4342bc]
push ebx
xor ebx, ebx
cmp eax, 1
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
jne 0x4250c3
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.00423e31
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x4342bc], eax
jne 0x4250c3
mov eax, 0x7532
jmp 0x425111
lea ecx, [ebp - 4]
push ebx
push ecx
push 0x80
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 5
push eax
call fcn.00423ebc
add esp, 0x20
test eax, eax
je 0x4250f6
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00424149
pop ecx
pop ecx
jmp 0x425111
push dword [0x4342bc]
call fcn.00423f5a
pop ecx
mov dword [0x4342bc], 1
call fcn.00423fd3
pop ebx
leave
ret
Function at 0x425b7f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00421df2
and byte [ebp - 0xa], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x65
call fcn.00421e21
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x425bd7
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00421df2
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x425bf4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00421df2
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x6f
call fcn.00421e21
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x425c50
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00421df2
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x425c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 4], 0
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0x1d], 0x75
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 9], 0x6f
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 8], 0x4c
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 5], 0x74
call fcn.00425d23
test eax, eax
je 0x425d02
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x425d06
xor eax, eax
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.00421df2
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x425d23
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00421df2
and byte [ebp - 8], 0
add esp, 0xc
cmp dword [0x43429c], 1
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 9], 0x6c
jne 0x425d85
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x43429c], eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00421df2
mov eax, dword [0x43429c]
add esp, 0xc
leave
ret

Function at 0x425d9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and byte [ebp - 1], 0
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 4], 0x63
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0xb], 0x49
mov byte [ebp - 3], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 2], 0x73
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x17], 0x44
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 7], 0x72
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 5], 0x61
call fcn.00425d23
test eax, eax
je 0x425e2a
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x425e2e
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1c
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00421df2
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x425e57
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and byte [ebp - 4], 0
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x11], 0x47
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 9], 0x44
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 7], 0x76
call fcn.00425d23
test eax, eax
je 0x425ece
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, fcn.00425e57
test ecx, ecx
jne 0x425ed2
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x15
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.00421df2
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x425f8f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 4], 0
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 8], 0x61
mov byte [ebp - 0x1f], 0x44
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 6], 0x6c
mov byte [ebp - 0x1d], 0x47
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0xd], 0x63
call fcn.00425d23
test eax, eax
je 0x426031
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x426035
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x21
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.00421df2
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x420ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x420ee4
pop dword [ebp - 0x10]
mov eax, 0x3e8098b3
add eax, 0xc1c17631
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xc20d3a92
add dword [ebp - 0x20], 0x8c450ab9
mov dword [ebp - 0x1c], 0xe66ca4c7
sub dword [ebp - 0x1c], 0xb4395882
mov dword [ebp - 0x18], 0x500007b8
sub dword [ebp - 0x18], 0x3b3c38a
mov dword [ebp - 0x14], 0xae51969
add dword [ebp - 0x14], 0xf51ae697
lea eax, [ebp - 0x20]
push eax
mov eax, 0x2049631
add eax, 0xfe3d9a43
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xd31a932f
add dword [ebp - 0x20], 0xa157d627
mov dword [ebp - 0x1c], 0xc64c8289
sub dword [ebp - 0x1c], 0x84e02114
mov dword [ebp - 0x18], 0x848d2b31
add dword [ebp - 0x18], 0xdee2413b
mov dword [ebp - 0x14], 0xe998a49d
add dword [ebp - 0x14], 0x16675b63
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xbe0d943f
sub eax, 0xbdcb631b
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3ba30
push 0
call eax
mov ecx, 0xdef58ad2
sub ecx, 0xdef54b49
xor esi, esi
add esi, eax
mov edx, 0xb0d9a437
sub edx, 0xb0966037
add edx, dword [ebp - 0x10]
mov ebx, 0xc8c0c661
add ebx, 0x17420258
xor dword [ebp - 8], 0x91d63983
mov edi, dword [edx]
sub edi, ebx
xor dword [ebp - 0xc], 0xf2f66945
mov dword [esi], edi
sub dword [ebp - 0xc], 0xc160ab9b
add esi, 0xe813d201
add esi, 0x17ec2e03
add edx, 0xa9c11e92
sub edx, 0xa9c11e8e
loop 0x421008
add eax, 0xfe32a901
sub eax, 0xfe31b80a
xor ebx, ebx
add ebx, eax
add eax, 0x99130201
sub eax, 0x991301fc
mov ecx, 0xb1d30578
add ecx, 0x4e6cfa88
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10001bd0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 4], 0x210000
push dword [ebp - 4]
mov dword [ebp - 8], ecx
push 0xfffffffffffffff5
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push eax
call esi
push 0xf0
push 0xfffffffffffffff5
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push eax
call ebx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x1000c43c
call fcn.100048c0
mov dword [ebp - 4], 0x4000e
push dword [ebp - 4]
push 0xfffffffffffffff5
call edi
push eax
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x1000c478
call fcn.100048c0
push 0xf
push 0xfffffffffffffff5
call edi
push eax
call ebx
xor esi, esi
cmp dword [0x10010bbc], esi
jl 0x10001cbb
mov eax, 0xf
mov word [ebp - 4], ax
nop dword [eax + eax]
lea eax, [esi*2 + 6]
mov word [ebp - 2], ax
push dword [ebp - 4]
push 0xfffffffffffffff5
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
cmp esi, dword [ebp - 8]
jne 0x10001ca2
push 0xb
push 0xfffffffffffffff5
call edi
push eax
call ebx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x1000c32c
call fcn.100048c0
push 0xf
push 0xfffffffffffffff5
call edi
push eax
call ebx
jmp 0x10001cb2
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x1000c3e0
call fcn.100048c0
inc esi
cmp esi, dword [0x10010bbc]
jle 0x10001c60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001cd0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], 0x210041
push esi
mov esi, dword [ebp - 0xc]
push edi
lea edx, [ebx + 0x83a8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edx
jmp 0x10001cf6
mov ebx, dword [ebp - 8]
mov edi, dword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
mov ecx, edx
call fcn.10008ea0
mov ecx, dword [ebx + 0x83b0]
mov eax, 0x4ec4ec4f
sub ecx, dword [ebx + 0x83ac]
xor ebx, ebx
imul ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
dec edx
shr eax, 0x1f
add eax, edx
mov dword [0x10010bbc], eax
call fcn.10001bd0
push esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x1000c480
call fcn.100048c0
nop
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__kbhit]
test eax, eax
je case.0x10001d6e.31
call edi
movsx eax, al
add eax, 0x20
cmp eax, 0x3b
ja case.0x10001d6e.31
movzx eax, byte [eax + 0x10001e2c]
jmp dword [eax*4 + 0x10001e18]
call edi
cmp al, 0x48
je 0x10001d91
cmp al, 0x50
jne case.0x10001d6e.31
cmp ebx, dword [0x10010bbc]
je case.0x10001d6e.31
inc ebx
mov ecx, ebx
call fcn.10001bd0
jmp case.0x10001d6e.31
test ebx, ebx
je case.0x10001d6e.31
dec ebx
mov ecx, ebx
call fcn.10001bd0
jmp case.0x10001d6e.31
mov edx, dword [ebp - 4]
xor eax, eax
mov edi, dword [edx + 4]
mov ecx, dword [edx + 8]
cmp edi, ecx
je 0x10001cf3
add edi, 0x34
cmp eax, ebx
je 0x10001dc3
inc eax
cmp edi, ecx
jne 0x10001db2
jmp 0x10001cf3
cmp edi, ecx
je 0x10001de3
mov ebx, ecx
nop dword [eax]
push edi
lea ecx, [edi - 0x34]
call fcn.10009530
add edi, 0x34
cmp edi, ebx
jne 0x10001dd0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 8]
sub ecx, 0x34
call fcn.10004ed0
mov ecx, dword [ebp - 4]
add dword [ecx + 8], 0xffffffcc
call fcn.10008680
mov edx, dword [ebp - 4]
jmp 0x10001cf3
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003710
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push esi
push edi
mov dword [ebp - 4], 0x1d004c
mov esi, ecx
push dword [ebp - 4]
push 0xfffffffffffffff5
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
cmp byte [esi + 0x83d0], 0
je 0x10003753
push 0x3f
push 0xfffffffffffffff5
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push eax
call esi
mov edx, 0x1000c534
jmp 0x10003767
push 0x4f
push 0xfffffffffffffff5
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push eax
call esi
mov edx, 0x1000c540
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.100048c0
push 0xf
push 0xfffffffffffffff5
call ebx
push eax
call esi
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__kbhit]
mov ebx, dword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
call edi
test eax, eax
je 0x100037a0
call ebx
cmp al, 0x1b
je 0x100037a6
cmp al, 0x20
je 0x100037a6
push 0xa
call esi
jmp 0x10003790
mov dword [ebp - 4], 0x1d004c
push dword [ebp - 4]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x1000c54c
call fcn.100048c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004430
Capabilities:
Execute command
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
push 0x1000c300
mov dword [ebp - 0xc], esi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add esp, 4
add esi, 0x4c
mov dword [ebp - 8], 0x1d
nop dword [eax]
mov ebx, 0x1d
push dword [esi + 8]
push 0xfffffffffffffff5
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx eax, word [esi]
add ax, ax
mov word [ebp - 4], ax
movzx eax, word [esi + 4]
mov word [ebp - 2], ax
push dword [ebp - 4]
push 0xfffffffffffffff5
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
cmp dword [esi - 4], 0xf
lea edx, [esi - 0x18]
jbe 0x1000449e
mov edx, dword [edx]
push dword [esi - 8]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.10004b80
add esp, 4
push 0xf
push 0xfffffffffffffff5
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
add esi, 0x28
sub ebx, 1
jne 0x10004465
sub dword [ebp - 8], 1
jne 0x10004460
mov esi, dword [ebp - 0xc]
push dword [esi + 0x20]
push 0xfffffffffffffff5
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push eax
call ebx
movzx eax, word [esi + 0x18]
add ax, ax
mov word [ebp - 8], ax
movzx eax, word [esi + 0x1c]
mov word [ebp - 6], ax
push dword [ebp - 8]
push 0xfffffffffffffff5
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
cmp dword [esi + 0x14], 0xf
mov edx, esi
jbe 0x10004508
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.10004b80
add esp, 4
push 0xf
push 0xfffffffffffffff5
call edi
push eax
call ebx
mov eax, dword [esi + 0x2c]
mov esi, dword [esi + 0x28]
mov dword [ebp - 4], eax
cmp esi, eax
je 0x10004587
nop
push dword [esi + 0x20]
push 0xfffffffffffffff5
call edi
push eax
call ebx
movzx eax, word [esi + 0x18]
add ax, ax
mov word [ebp - 8], ax
movzx eax, word [esi + 0x1c]
mov word [ebp - 6], ax
push dword [ebp - 8]
push 0xfffffffffffffff5
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
cmp dword [esi + 0x14], 0xf
mov edx, esi
jbe 0x10004565
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.10004b80
add esp, 4
push 0xf
push 0xfffffffffffffff5
call edi
push eax
call ebx
add esi, 0x30
cmp esi, dword [ebp - 4]
jne 0x10004530
mov ecx, dword [ebp - 0xc]
call fcn.100037e0
mov ecx, dword [ebp - 0xc]
call fcn.10003b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004f80
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
imul eax, dword [ebp + 8], 0x1d
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
add eax, dword [ebp + 0xc]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x20]
lea esi, [ecx + eax*8]
push 0xfffffffffffffff5
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx eax, word [esi + 0x18]
add ax, ax
mov word [ebp + 8], ax
movzx eax, word [esi + 0x1c]
mov word [ebp + 0xa], ax
push dword [ebp + 8]
push 0xfffffffffffffff5
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
cmp dword [esi + 0x14], 0xf
mov edx, esi
jbe 0x10004fd2
mov edx, dword [esi]
push dword [esi + 0x10]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.10004b80
add esp, 4
push 0xf
push 0xfffffffffffffff5
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
pop edi
pop esi
pop ebp
ret 8