joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7028f430
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x70314fe4
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
xor ebx, ebx
mov dword [esp + 0x18], ebx
cmp edi, ebp
jne 0x7028f47b
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push 0x24
call fcn.702e1f8d
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], ebp
cmp esi, ebp
je 0x7028f4bc
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.7021b390
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x2c], 1
mov ebx, 1
push esi
mov dword [esp + 0x20], ebx
call fcn.7028eb90
mov edi, eax
jmp 0x7028f4be
xor edi, edi
mov dword [esp + 0x28], 0xffffffff
test bl, 1
je 0x7028f4eb
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x7028f4eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp edi, ebp
je 0x7028f597
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push edi
call esi
push edi
call esi
lea ecx, [esp + 0x18]
push ecx
push ebp
push edi
push 0x7028f750
push ebp
push ebp
mov dword [esp + 0x30], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebp
jne 0x7028f565
push edi
call ebx
test eax, eax
jne 0x7028f58b
lea esi, [edi + 8]
call fcn.7027fc70
mov edx, dword [esi]
push edx
call fcn.702e1c24
mov eax, dword [edi + 4]
sub eax, 0x10
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x7028f55a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
call fcn.702e1c24
add esp, 4
jmp 0x7028f58b
mov ecx, dword [esp + 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
cmp eax, ebp
je 0x7028f58b
mov eax, dword [esp + 0x30]
lea ecx, [edi + 8]
call fcn.7028f780
mov ebp, 1
push edi
call ebx
test eax, eax
jne 0x7028f597
call fcn.7028ec00
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x7028f5b0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1c0]
sub esp, 0x240
mov eax, dword [0x7034b250]
xor eax, ebp
mov dword [ebp + 0x1bc], eax
push ebx
push esi
push edi
xor esi, esi
push 0x208
lea eax, [ebp - 0x4c]
mov ebx, ecx
push esi
push eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], esi
call fcn.702e95e0
lea ecx, [ebp - 0x4c]
add esp, 0xc
test ecx, ecx
je 0x7028f71f
push 0x104
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x7028f71f
push str.ws2_32.dll
lea eax, [ebp - 0x4c]
push eax
mov ecx, eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x7028f71f
lea edx, [ebp - 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [ebp - 0x5c], edi
test edi, edi
je 0x7028f71f
push 0x70330504
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x60], ecx
cmp ecx, eax
je 0x7028f718
mov ebx, dword [ebx + 4]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x7c], 2
mov dword [ebp - 0x54], eax
test ebx, ebx
je 0x7028f6ce
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x7028f693
xor eax, eax
jmp 0x7028f6cb
lea edi, [eax + eax]
mov eax, edi
call fcn.702e98d0
mov esi, esp
test esi, esi
je 0x7028f6c4
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
mov esi, dword [ebp - 0x50]
jmp 0x7028f6c8
xor eax, eax
mov esi, eax
mov edi, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x60]
lea edx, [ebp - 0x54]
push edx
lea edx, [ebp - 0x80]
push edx
push 0
push eax
call ecx
test eax, eax
jne 0x7028f718
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x7028f718
mov ebx, dword [ebp - 0x58]
add ebx, 8
lea esp, [esp]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 4]
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], ecx
call fcn.702a6090
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x54], eax
test eax, eax
jne 0x7028f6f0
mov dword [ebp - 0x50], 1
mov esi, dword [ebp - 0x50]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1bc]
xor ecx, ebp
call fcn.702e1c2f
add ebp, 0x1c0
mov esp, ebp
pop ebp
ret
Function at 0x70292f20
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x7033c060
push 0x702e96c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x7034b250]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov esi, edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
test edi, edi
je 0x7029304c
test eax, eax
je 0x7029304c
push edi
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x7029304c
test esi, esi
je 0x7029304c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x7029304c
mov dword [ebp - 4], eax
add edi, esi
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx]
cmp esi, edi
jae 0x7029301a
mov eax, edi
sub eax, esi
cmp eax, 1
jl 0x70292fbc
cmp byte [esi], 0xcc
jne 0x70292fbc
inc ecx
mov dword [ebp - 0x1c], ecx
inc esi
mov dword [ebp - 0x20], esi
jmp 0x70292fa0
cmp eax, 5
jl 0x70292fd4
cmp byte [esi], 0xe8
jne 0x70292fd4
add ecx, 5
mov dword [ebp - 0x1c], ecx
add esi, 5
mov dword [ebp - 0x20], esi
jmp 0x70292fa0
cmp eax, 6
jl 0x70293012
movzx eax, word [esi]
mov edx, 0x850f
cmp dx, ax
je 0x70293004
mov edx, 0x840f
cmp dx, ax
je 0x70293004
mov edx, 0x35ff
cmp dx, ax
je 0x70293004
mov edx, 0x15ff
cmp dx, ax
jne 0x70293012
add ecx, 6
mov dword [ebp - 0x1c], ecx
add esi, 6
mov dword [ebp - 0x20], esi
jmp 0x70292fa0
mov al, byte [ecx]
cmp al, byte [esi]
je 0x70292fb2
jmp 0x70293045
mov dword [ebp - 4], 0xfffffffe
jne 0x7029304c
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x70294250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x70310bf0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
lea ebp, [esi + 4]
xor ebx, ebx
push ebp
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x703580e4]
mov edx, dword [eax + 0xc]
mov ecx, 0x703580e4
mov dword [esp + 0x10], ebx
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x4c]
mov byte [esp + 0x40], 1
or dword [esp + 0x10], eax
lea eax, [esp + 0x48]
lea edi, [esp + 0x14]
call fcn.70208e30
lea ebx, [esi + 0x1c]
lea eax, [esp + 0x10]
call fcn.70294630
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
mov byte [esp + 0x40], bl
cmp dword [esp + 0x30], 0x10
jb 0x70294302
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.702e1c24
add esp, 4
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x70294332
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x7029435a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x34
ret 8
Function at 0x70295880
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x70310ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
lea ecx, [esp + 0x18]
push ecx
push 4
lea edx, [esp + 0x18]
push edx
xor esi, esi
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
call eax
cmp eax, esi
jne 0x702959b3
cmp dword [esp + 0x18], 4
jne 0x702959b3
call fcn.702961c0
xor ebx, ebx
mov dword [esp + 0x14], eax
cmp dword [esp + 0x10], esi
ja 0x70295945
mov esi, dword [ebp + 8]
lea edi, [esi + 8]
push edi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x38], 1
mov ecx, dword [esi]
mov edx, dword [ecx + 0x34]
push esi
call edx
mov eax, dword [esp + 0x14]
push edi
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [esp + 0x20], esi
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x3c], esi
call fcn.70299e20
mov edi, dword [esp + 0x14]
test eax, eax
je 0x7029598c
lea edx, [esp + 0x20]
push edx
add edi, 4
call fcn.70296680
lea esi, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.70299a70
inc ebx
cmp ebx, dword [esp + 0x10]
jb 0x70295940
jmp 0x702958f1
cmp edi, esi
je 0x702959a2
lea eax, [edi + 4]
push eax
call fcn.70296470
push edi
call fcn.702e1c24
add esp, 4
lea esi, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.70299a70
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x70298180
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x703120e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
cmp dword [ebp + 0x10], 0
je 0x702982ef
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x702982ef
mov edi, dword [ebp + 8]
lea esi, [edi + 8]
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x38], 0
cmp dword [edi + 4], 0
jne 0x702981e6
push esi
jmp 0x702982e9
push ebx
lea ebx, [esp + 0x20]
call fcn.70299270
mov eax, dword [esp + 0x1c]
mov ebx, dword [0x7036d900]
test eax, eax
je 0x70298206
cmp eax, dword [0x7036d8e8]
je 0x7029820b
call fcn.702e2961
cmp dword [esp + 0x20], ebx
je 0x702981e0
lea esi, [esp + 0x1c]
call fcn.70299150
cmp dword [eax + 0x18], 8
jb 0x70298225
mov eax, dword [eax + 4]
jmp 0x70298228
add eax, 4
mov dword [esp + 0x14], eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x18]
mov ecx, dword [ecx]
mov esi, dword [eax + 4]
add eax, 4
mov ebx, ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov eax, dword [edi + 4]
mov edi, dword [eax + 0x18]
add eax, 4
mov eax, dword [eax]
test esi, esi
je 0x70298257
cmp esi, eax
je 0x7029825c
call fcn.702e2961
cmp ebx, edi
je 0x702982e4
test esi, esi
jne 0x7029829c
call fcn.702e2961
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x70298279
call fcn.702e2961
mov edx, dword [esp + 0x14]
cmp dword [ebx + 8], edx
je 0x702982a0
lea edi, [esp + 0x24]
lea esi, [esp + 0x1c]
call fcn.70245490
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov edi, dword [ebp + 8]
jmp 0x70298244
mov eax, dword [esi]
jmp 0x7029826f
test esi, esi
jne 0x702982e0
call fcn.702e2961
cmp ebx, dword [esi + 0x14]
jne 0x702982b3
call fcn.702e2961
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x10]
add ebx, 0xc
push ecx
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [esi]
jmp 0x702982a9
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x7029a540
Capabilities:
Check os version

Disassembly:
sub esp, 0x128
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push 0x110
xor ebx, ebx
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.702e95e0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x7029a5f4
cmp dword [esp + 0x18], 6
jb 0x7029a60c
push ebx
lea edx, [esp + 8]
push edx
push 1
push 0x703307c4
mov dword [esp + 0x14], ebx
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x7029a5f4
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
test eax, eax
je 0x7029a5e9
mov ecx, dword [esp + 8]
push ecx
push ebx
push ebx
push ebx
push 0x10
push 6
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
test eax, eax
jne 0x7029a5e9
mov bl, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, bl
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x128
ret
mov ecx, dword [esp + 0x128]
pop ebx
xor ecx, esp
mov al, 1
call fcn.702e1c2f
add esp, 0x128
ret
Function at 0x7029b330
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x703143e6
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
xor eax, eax
push 0x208
mov edi, ecx
push eax
lea ecx, [esp + 0x52]
push ecx
mov word [esp + 0x54], ax
call fcn.702e95e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.device_item_lock
push str._s__d
mov eax, 0x20a
lea ebx, [esp + 0x54]
call fcn.7021b490
xor edx, edx
add esp, 0xc
push edx
mov eax, 0x70326328
lea esi, [esp + 0x30]
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], dx
call fcn.7020f4d0
mov dword [esp + 0x260], 0
xor bl, bl
cmp dword [esp + 0x40], 0
je 0x7029b407
lea esi, [edi + 0xc]
push 0xa
mov eax, str.CAutoLock_
call fcn.7020f4d0
push 0
lea eax, [esp + 0x30]
push eax
or eax, 0xffffffff
call fcn.7021a550
cmp dword [esp + 0x40], 0
jne 0x7029b40b
xor esi, esi
jmp 0x7029b419
cmp dword [esi + 0x18], 8
jb 0x7029b416
mov esi, dword [esi + 4]
jmp 0x7029b419
add esi, 4
push esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 8], eax
test eax, eax
je 0x7029b42f
mov bl, 1
test bl, bl
sete bl
mov dword [esp + 0x260], 0xffffffff
cmp dword [esp + 0x44], 8
jb 0x7029b453
mov ecx, dword [esp + 0x30]
push ecx
call fcn.702e1c24
add esp, 4
test bl, bl
jne 0x7029b544
xor edx, edx
lea eax, [esp + 0x48]
mov word [esp + 0x14], dx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x7029b480
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x4c]
lea esi, [esp + 0x14]
call fcn.7020f4d0
mov dword [esp + 0x260], 1
xor bl, bl
cmp dword [esp + 0x24], 0
je 0x7029b4d6
lea esi, [edi + 0x2c]
push 0xa
mov eax, str.CAutoLock_
call fcn.7020f4d0
push 0
lea eax, [esp + 0x14]
push eax
or eax, 0xffffffff
call fcn.7021a550
cmp dword [esp + 0x24], 0
jne 0x7029b4da
xor esi, esi
jmp 0x7029b4e8
cmp dword [esi + 0x18], 8
jb 0x7029b4e5
mov esi, dword [esi + 4]
jmp 0x7029b4e8
add esi, 4
push esi
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x28], eax
test eax, eax
je 0x7029b4fe
mov bl, 1
cmp dword [esp + 0x28], 8
jb 0x7029b512
mov ecx, dword [esp + 0x14]
push ecx
call fcn.702e1c24
add esp, 4
test bl, bl
je 0x7029b544
push 0
push 0
push edi
push 0x7029b0f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 4], eax
test eax, eax
je 0x7029b544
mov edi, dword [edi + 8]
test edi, edi
je 0x7029b544
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x254
ret
Function at 0x7029be10
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x7030ff88
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x3c], eax
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x5c]
mov esi, ecx
mov ecx, 7
mov dword [esp + 0x28], ecx
xor edi, edi
mov dword [esp + 0x44], ecx
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x24], edi
mov word [esp + 0x14], dx
mov dword [esp + 0x40], edi
mov word [esp + 0x30], cx
push 0xffffffffffffffff
mov dword [esp + 0x58], edi
push edi
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], edi
call fcn.7020f220
push 0xffffffffffffffff
push edi
mov eax, esi
lea ecx, [esp + 0x18]
call fcn.7020f220
push edi
push edi
lea edx, [esp + 0x14]
push edx
push 0x7029bdc0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
cmp esi, edi
je 0x7029bebe
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0xc]
lea esi, [esp + 0xc]
call fcn.7029bef0
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x4c
ret
Function at 0x7029ec50
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x70316c98
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
xor edi, edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], vtable.CDynamicStruct.0
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.7021fe10
cmp eax, edi
jge 0x7029ecbf
push eax
call fcn.702042c0
lea eax, [esp + 0x18]
mov dword [esp + 0x80], edi
push eax
mov ecx, 0x7032d108
lea ebx, [esp + 0x20]
mov dword [esp + 0x1c], 4
call fcn.702542c0
lea ecx, [esi + 0x2c]
add esp, 4
push ecx
mov ecx, str.pageid
call fcn.702542c0
lea edx, [esi + 0x30]
add esp, 4
push edx
mov ecx, str.referid
call fcn.702542c0
xor ebx, ebx
mov ebp, 0xf
add esp, 4
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
lea eax, [esp + 0x58]
push eax
lea edi, [esp + 0x20]
mov byte [esp + 0x84], 2
call fcn.7029e290
mov edi, esi
call fcn.7029ee10
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x5c]
call fcn.7029e050
cmp dword [esi + 0x20], ebx
je 0x7029ed62
lea edx, [esp + 0x3c]
push edx
push esi
call fcn.7029e7d0
jmp 0x7029ed8a
push 3
push 0x7032d214
mov eax, 3
xor ebx, ebx
lea ecx, [esp + 0x44]
call fcn.7020b440
test eax, eax
je 0x7029ed88
lea eax, [esp + 0x3c]
push eax
push esi
call fcn.7029e7d0
xor ebx, ebx
mov esi, 0x10
cmp dword [esp + 0x54], esi
jb 0x7029eda2
mov ecx, dword [esp + 0x40]
push ecx
call fcn.702e1c24
add esp, 4
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
cmp dword [esp + 0x70], esi
jb 0x7029edc1
mov edx, dword [esp + 0x5c]
push edx
call fcn.702e1c24
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
mov dword [esp + 0x80], 0xffffffff
call fcn.702970b0
mov eax, 1
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x70
ret
Function at 0x7029ff60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x70310a78
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x7034b250]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7034b250]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x88]
mov eax, dword [esp + 0x8c]
mov ecx, dword [ebp + 0x14]
sub ecx, dword [ebp + 0x10]
mov dword [esp + 0x20], eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x7029ffc4
xor eax, eax
jmp 0x702a00d1
lea edx, [esp + 0x18]
push edx
xor esi, esi
push ebp
mov dword [esp + 0x20], esi
call fcn.702a0490
test eax, eax
jne 0x7029fff6
mov ecx, dword [ebp + 0x14]
sub ecx, dword [ebp + 0x10]
mov eax, 0x6bca1af3
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
lea ecx, [edx + eax - 1]
mov dword [esp + 0x18], ecx
xor ebx, ebx
mov dword [esp + 0x1c], esi
jmp 0x702a0002
xor esi, esi
mov ecx, dword [ebp + 0x14]
sub ecx, dword [ebp + 0x10]
mov eax, 0x6bca1af3
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x702a0022
call fcn.702e2961
mov edi, dword [ebp + 0x10]
add edi, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ecx
call fcn.702a0100
lea edx, [esp + 0x24]
push edx
mov ecx, ebx
mov edx, ebp
mov dword [esp + 0x84], esi
call fcn.702a01a0
mov eax, dword [esp + 0x20]
mov esi, dword [eax + 0x14]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push edx
push esi
call fcn.702a0990
mov ecx, dword [esp + 0x20]
mov edi, eax
call fcn.702a0a30
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov esi, 0x10
mov dword [eax], edi
mov dword [esp + 0x80], 0xffffffff
cmp dword [esp + 0x58], esi
jb 0x702a0094
mov eax, dword [esp + 0x44]
push eax
call fcn.702e1c24
add esp, 4
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
cmp dword [esp + 0x3c], esi
jb 0x702a00bc
mov ecx, dword [esp + 0x28]
push ecx
call fcn.702e1c24
add esp, 4
add dword [esp + 0x1c], 0x4c
inc ebx
cmp ebx, dword [esp + 0x18]
jbe 0x702a0000
mov eax, 1
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.702e1c2f
add esp, 0x70
ret 8