joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ebb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x1001ec84
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x1001ec73
jg 0x1001ebe8
test edx, edx
je 0x1001ec73
call fcn.1000ad10
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x1001ec38
jg 0x1001ebfe
test esi, esi
je 0x1001ec38
cmp ebx, eax
jg 0x1001ec0d
jl 0x1001ec08
cmp edi, esi
jae 0x1001ec0d
mov esi, edi
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
push esi
mov eax, dword [eax + 0x1c]
push dword [eax]
push dword [ebp + 8]
call fcn.1012db10
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov eax, dword [ebp + 8]
jmp 0x1001ec5a
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x1001ec6d
mov eax, dword [ebp + 8]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
mov ecx, dword [ebp - 4]
add eax, esi
mov dword [ebp + 8], eax
test ebx, ebx
jg 0x1001ebe8
jl 0x1001ec6d
test edi, edi
jne 0x1001ebe8
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x1c]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x1001eca3
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax]
jmp 0x1001eca5
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x1001ed4d
jg 0x1001ecbf
test esi, esi
je 0x1001ed4d
test eax, eax
jl 0x1001ecfe
jg 0x1001ecc9
test ebx, ebx
je 0x1001ecfe
cmp edi, eax
jg 0x1001ecd8
jl 0x1001ecd3
cmp esi, ebx
jae 0x1001ecd8
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.1012db10
mov ecx, dword [ebp - 4]
add esp, 0xc
add dword [ebp + 8], ebx
sub esi, ebx
sbb edi, dword [ebp + 0x10]
mov eax, dword [ecx + 0x2c]
sub dword [eax], ebx
mov eax, dword [ecx + 0x1c]
add dword [eax], ebx
jmp 0x1001ed04
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test edi, edi
jl 0x1001ed4d
jg 0x1001ed0e
test esi, esi
je 0x1001ed4d
mov edx, dword [ecx + 0x4c]
test edx, edx
je 0x1001ed4d
mov ebx, dword [ecx + 0xc]
lea eax, [ecx + 0x3c]
cmp dword [ebx], eax
jne 0x1001ed39
mov edx, dword [ecx + 0x54]
mov ecx, dword [ecx + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov edx, dword [ebx + 0x4c]
push edx
push esi
push 1
push dword [ebp + 8]
call fcn.10139588
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001ee30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x1001eefe
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test esi, esi
jl 0x1001eeed
jg 0x1001ee68
test edx, edx
je 0x1001eeed
call fcn.1000b640
mov esi, eax
mov eax, edx
mov dword [ebp - 8], eax
test eax, eax
jl 0x1001eeb6
jg 0x1001ee7e
test esi, esi
je 0x1001eeb6
cmp ebx, eax
jg 0x1001ee8d
jl 0x1001ee88
cmp edi, esi
jae 0x1001ee8d
mov esi, edi
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.1012db10
mov ecx, dword [ebp - 4]
add esp, 0xc
sub edi, esi
sbb ebx, dword [ebp - 8]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x1001eeda
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x1001eee7
mov ecx, dword [ebp - 4]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [ebp + 8], esi
test ebx, ebx
jg 0x1001ee68
jl 0x1001eee7
test edi, edi
jne 0x1001ee68
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
pop edi
sbb esi, ebx
mov eax, edx
mov edx, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov eax, dword [eax]
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x1001ef1d
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x1001ef1f
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp + 0x10], eax
test edi, edi
jl 0x1001ef98
jg 0x1001ef31
test esi, esi
je 0x1001ef98
test eax, eax
jl 0x1001ef72
jg 0x1001ef3b
test ebx, ebx
je 0x1001ef72
cmp edi, eax
jg 0x1001ef4a
jl 0x1001ef45
cmp esi, ebx
jae 0x1001ef4a
mov ebx, esi
mov dword [ebp + 0x10], edi
push ebx
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.1012db10
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [ebp + 0x10]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x1001ef75
mov edx, dword [ebp + 8]
test edi, edi
jl 0x1001ef98
jg 0x1001ef7f
test esi, esi
je 0x1001ef98
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x1001ef98
push eax
push esi
push 1
push edx
call fcn.10139b9b
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100292e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x10029311
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x10029300
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1002d710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x101a4494]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x101aa428
mov dword [ebp - 0x6c], 0x4f0053
lea esi, [ebp - 0x6c]
mov dword [ebp - 0x68], 0x540046
push edi
mov dword [ebp - 0x64], 0x410057
mov edx, 0x34
mov dword [ebp - 0x60], 0x450052
sub esi, eax
mov dword [ebp - 0x5c], 0x4d005c
mov dword [ebp - 0x58], 0x630069
mov dword [ebp - 0x54], 0x6f0072
mov dword [ebp - 0x50], 0x6f0073
mov dword [ebp - 0x4c], 0x740066
mov dword [ebp - 0x48], 0x57005c
mov dword [ebp - 0x44], 0x6e0069
mov dword [ebp - 0x40], 0x6f0064
mov dword [ebp - 0x3c], 0x730077
mov dword [ebp - 0x38], 0x43005c
mov dword [ebp - 0x34], 0x720075
mov dword [ebp - 0x30], 0x650072
mov dword [ebp - 0x2c], 0x74006e
mov dword [ebp - 0x28], 0x650056
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x6f0069
mov dword [ebp - 0x1c], 0x5c006e
mov dword [ebp - 0x18], 0x6e0055
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x6c0061
mov dword [ebp - 8], 0x6c
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffca]
test ecx, ecx
je 0x1002d80e
movzx ecx, word [esi + eax]
test cx, cx
je 0x1002d80e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1002d7f0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f4dc3
mov esp, ebp
pop ebp
ret

Function at 0x1002dad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x101a4494]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x101aa4a0
mov dword [ebp - 0x6c], 0x4f0053
lea esi, [ebp - 0x6c]
mov dword [ebp - 0x68], 0x540046
push edi
mov dword [ebp - 0x64], 0x410057
mov edx, 0x34
mov dword [ebp - 0x60], 0x450052
sub esi, eax
mov dword [ebp - 0x5c], 0x4d005c
mov dword [ebp - 0x58], 0x630069
mov dword [ebp - 0x54], 0x6f0072
mov dword [ebp - 0x50], 0x6f0073
mov dword [ebp - 0x4c], 0x740066
mov dword [ebp - 0x48], 0x57005c
mov dword [ebp - 0x44], 0x6e0069
mov dword [ebp - 0x40], 0x6f0064
mov dword [ebp - 0x3c], 0x730077
mov dword [ebp - 0x38], 0x43005c
mov dword [ebp - 0x34], 0x720075
mov dword [ebp - 0x30], 0x650072
mov dword [ebp - 0x2c], 0x74006e
mov dword [ebp - 0x28], 0x650056
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x6f0069
mov dword [ebp - 0x1c], 0x5c006e
mov dword [ebp - 0x18], 0x6e0055
mov dword [ebp - 0x14], 0x6e0069
mov dword [ebp - 0x10], 0x740073
mov dword [ebp - 0xc], 0x6c0061
mov dword [ebp - 8], 0x6c
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffca]
test ecx, ecx
je 0x1002dbce
movzx ecx, word [esi + eax]
test cx, cx
je 0x1002dbce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1002dbb0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f4dc3
mov esp, ebp
pop ebp
ret
Function at 0x100359e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x101a4494]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x101aa8e0
mov dword [ebp - 0x60], 0x610070
lea esi, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x650072
push edi
mov dword [ebp - 0x58], 0x74006e
mov edx, 0x2e
mov dword [ebp - 0x54], 0x770020
sub esi, eax
mov dword [ebp - 0x50], 0x64006e
mov dword [ebp - 0x4c], 0x690020
mov dword [ebp - 0x48], 0x200073
mov dword [ebp - 0x44], 0x630069
mov dword [ebp - 0x40], 0x6e006f
mov dword [ebp - 0x3c], 0x630069
mov dword [ebp - 0x38], 0x20002e
mov dword [ebp - 0x34], 0x6f006e
mov dword [ebp - 0x30], 0x200074
mov dword [ebp - 0x2c], 0x720063
mov dword [ebp - 0x28], 0x610065
mov dword [ebp - 0x24], 0x650074
mov dword [ebp - 0x20], 0x20002e
mov dword [ebp - 0x1c], 0x720045
mov dword [ebp - 0x18], 0x6f0072
mov dword [ebp - 0x14], 0x200072
mov dword [ebp - 0x10], 0x6f0063
mov dword [ebp - 0xc], 0x650064
mov dword [ebp - 8], 0x3a
lea ecx, [edx + 0x7fffffd0]
test ecx, ecx
je 0x10035ac1
movzx ecx, word [esi + eax]
test cx, cx
je 0x10035ac1
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x10035aa3
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f4dc3
mov esp, ebp
pop ebp
ret
Function at 0x100376d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101566b3
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x101a4494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
push 0x98
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0xf8]
push 0
push eax
call fcn.1012e610
add esp, 0xc
lea ecx, [ebp - 0x59]
call fcn.10035bc0
lea ecx, [ebp - 0xf8]
mov esi, eax
call fcn.100090f0
mov edi, eax
push esi
push edi
mov dword [ebp - 4], 0
call fcn.100086f0
push str.Geeks::CPopWndMgr::ShowNewInstWindowMalwareSoft
push edi
call fcn.1000e150
push str.prepare_create_UI_wnd
push edi
call fcn.100086f0
add esp, 0x18
cmp dword [0x101aa314], 0
mov dword [ebp - 4], 1
je 0x100377a2
lea eax, [ebp - 0xf8]
push eax
call fcn.10008a90
add esp, 4
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0xf4]
push eax
call fcn.1000d2e0
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x58]
call fcn.100098e0
lea ecx, [ebp - 0xf8]
call fcn.10009fa0
mov dword [ebp - 4], 0xffffffff
call fcn.10036a80
mov edi, eax
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
push eax
push 0x10161b24
lea ecx, [ebp - 0x40]
mov word [ebp - 0x40], ax
call fcn.1000bc10
xor eax, eax
mov dword [ebp - 4], 2
push eax
push 0x10161b24
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.1000bc10
push dword [ebp - 0x60]
lea eax, [ebp - 0x40]
push 0
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x1008
sub esp, 0x28
mov esi, esp
mov dword [ebp - 0x60], esi
mov dword [esi + 0x24], 0
mov ecx, dword [ebx + 0x84]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x1003783f
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
push 0
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.1004ebf0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10037882
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037878
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100378ec
push edx
push ecx
call fcn.100f4a6f
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x100378cc
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100378c2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100378f1
push edx
push ecx
call fcn.100f4a6f
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f4dc3
mov esp, ebp
pop ebp
ret 4
call fcn.10131c3f
call fcn.10131c3f
int3
Function at 0x10037900
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101566b3
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x101a4494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
push 0x98
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0xf8]
push 0
push eax
call fcn.1012e610
add esp, 0xc
lea ecx, [ebp - 0x59]
call fcn.10035820
lea ecx, [ebp - 0xf8]
mov esi, eax
call fcn.100090f0
mov edi, eax
push esi
push edi
mov dword [ebp - 4], 0
call fcn.100086f0
push str.Geeks::CPopWndMgr::ShowNewInstWindowMoreSoft
push edi
call fcn.1000e150
push str.prepare_create_UI_wnd
push edi
call fcn.100086f0
add esp, 0x18
cmp dword [0x101aa314], 0
mov dword [ebp - 4], 1
je 0x100379d2
lea eax, [ebp - 0xf8]
push eax
call fcn.10008a90
add esp, 4
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0xf4]
push eax
call fcn.1000d2e0
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x58]
call fcn.100098e0
lea ecx, [ebp - 0xf8]
call fcn.10009fa0
mov dword [ebp - 4], 0xffffffff
call fcn.10036a80
mov edi, eax
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
push eax
push 0x10161b24
lea ecx, [ebp - 0x40]
mov word [ebp - 0x40], ax
call fcn.1000bc10
xor eax, eax
mov dword [ebp - 4], 2
push eax
push 0x10161b24
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.1000bc10
push dword [ebp - 0x60]
lea eax, [ebp - 0x40]
push 0
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x1007
sub esp, 0x28
mov esi, esp
mov dword [ebp - 0x60], esi
mov dword [esi + 0x24], 0
mov ecx, dword [ebx + 0x84]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x10037a6f
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
push 0
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.1004ebf0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10037ab2
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037aa8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037b1c
push edx
push ecx
call fcn.100f4a6f
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x10037afc
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037af2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037b21
push edx
push ecx
call fcn.100f4a6f
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f4dc3
mov esp, ebp
pop ebp
ret 4
call fcn.10131c3f
call fcn.10131c3f
int3
Function at 0x10037b30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101566b3
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x101a4494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
push 0x98
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0xf8]
push 0
push eax
call fcn.1012e610
add esp, 0xc
lea ecx, [ebp - 0x59]
call fcn.100353c0
lea ecx, [ebp - 0xf8]
mov esi, eax
call fcn.100090f0
mov edi, eax
push esi
push edi
mov dword [ebp - 4], 0
call fcn.100086f0
push str.Geeks::CPopWndMgr::ShowNewInstWindowOneSoft
push edi
call fcn.1000e150
push str.prepare_create_UI_wnd
push edi
call fcn.100086f0
add esp, 0x18
cmp dword [0x101aa314], 0
mov dword [ebp - 4], 1
je 0x10037c02
lea eax, [ebp - 0xf8]
push eax
call fcn.10008a90
add esp, 4
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0xf4]
push eax
call fcn.1000d2e0
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x58]
call fcn.100098e0
lea ecx, [ebp - 0xf8]
call fcn.10009fa0
mov dword [ebp - 4], 0xffffffff
call fcn.10036a80
mov edi, eax
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
push eax
push 0x10161b24
lea ecx, [ebp - 0x40]
mov word [ebp - 0x40], ax
call fcn.1000bc10
xor eax, eax
mov dword [ebp - 4], 2
push eax
push 0x10161b24
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.1000bc10
push dword [ebp - 0x60]
lea eax, [ebp - 0x40]
push 0
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x1006
sub esp, 0x28
mov esi, esp
mov dword [ebp - 0x60], esi
mov dword [esi + 0x24], 0
mov ecx, dword [ebx + 0x84]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x10037c9f
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
push 0
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.1004ebf0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10037ce2
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037cd8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037d4c
push edx
push ecx
call fcn.100f4a6f
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x10037d2c
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037d22
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037d51
push edx
push ecx
call fcn.100f4a6f
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f4dc3
mov esp, ebp
pop ebp
ret 4
call fcn.10131c3f
call fcn.10131c3f
int3
Function at 0x10037d60
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101566b3
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x101a4494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
push 0x98
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0xf8]
push 0
push eax
call fcn.1012e610
add esp, 0xc
lea ecx, [ebp - 0x59]
call fcn.100354a0
lea ecx, [ebp - 0xf8]
mov esi, eax
call fcn.100090f0
mov edi, eax
push esi
push edi
mov dword [ebp - 4], 0
call fcn.100086f0
push str.Geeks::CPopWndMgr::ShowRogueSoftWindow
push edi
call fcn.1000e150
push str.prepare_create_UI_wnd
push edi
call fcn.100086f0
add esp, 0x18
cmp dword [0x101aa314], 0
mov dword [ebp - 4], 1
je 0x10037e32
lea eax, [ebp - 0xf8]
push eax
call fcn.10008a90
add esp, 4
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0xf4]
push eax
call fcn.1000d2e0
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x58]
call fcn.100098e0
lea ecx, [ebp - 0xf8]
call fcn.10009fa0
mov dword [ebp - 4], 0xffffffff
call fcn.10036a80
mov edi, eax
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], 7
push eax
push 0x10161b24
lea ecx, [ebp - 0x40]
mov word [ebp - 0x40], ax
call fcn.1000bc10
xor eax, eax
mov dword [ebp - 4], 2
push eax
push 0x10161b24
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.1000bc10
push dword [ebp - 0x60]
lea eax, [ebp - 0x40]
push 0
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x1000
sub esp, 0x28
mov esi, esp
mov dword [ebp - 0x60], esi
mov dword [esi + 0x24], 0
mov ecx, dword [ebx + 0x84]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x10037ecf
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
push 0
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.1004ebf0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10037f12
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037f08
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037f7c
push edx
push ecx
call fcn.100f4a6f
add esp, 8
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp edx, 8
jb 0x10037f5c
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10037f52
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10037f81
push edx
push ecx
call fcn.100f4a6f
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100f4dc3
mov esp, ebp
pop ebp
ret 4
call fcn.10131c3f
call fcn.10131c3f
int3