joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10046040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1017f77b
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x101c6444]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x90], ebx
lea ecx, [esp + 0xc]
call fcn.10043cb0
mov cl, byte [esp + 0x9c]
mov al, byte [esp + 0x98]
mov edx, dword [esp + 0xa0]
mov byte [esp + 0xd], cl
mov cx, word [esp + 0xa8]
mov byte [esp + 0xc], al
mov eax, dword [esp + 0xa4]
mov word [esp + 0x18], cx
mov ecx, dword [esp + 0xb4]
mov dword [esp + 0x10], edx
mov dx, word [esp + 0xac]
mov dword [esp + 0x14], eax
mov al, byte [esp + 0xb0]
mov dword [esp + 0x20], ecx
mov cl, byte [esp + 0xc0]
mov word [esp + 0x1a], dx
mov dx, word [esp + 0xb8]
mov byte [esp + 0x1c], al
mov al, byte [esp + 0xbc]
mov byte [esp + 0x27], cl
mov cl, byte [esp + 0xcc]
mov word [esp + 0x24], dx
mov dl, byte [esp + 0xc4]
mov byte [esp + 0x26], al
mov al, byte [esp + 0xc8]
mov byte [esp + 0x2a], cl
mov ecx, dword [esp + 0xd8]
mov byte [esp + 0x28], dl
mov edx, dword [esp + 0xd0]
mov byte [esp + 0x29], al
mov al, byte [esp + 0xd4]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0xe4]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0xdc]
mov byte [esp + 0x30], al
mov eax, dword [esp + 0xe0]
push 0xffffffffffffffff
mov dword [esp + 0x44], ecx
push ebx
lea ecx, [esp + 0xf8]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0xf0]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0xf4]
push ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0x9c], 2
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], eax
call fcn.10001a10
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x114]
push edx
lea ecx, [esp + 0x74]
call fcn.10001a10
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 4]
call fcn.10045ef0
mov esi, 0x10
cmp dword [esp + 0x80], esi
jb 0x100461d7
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.10157f3b
add esp, 4
cmp dword [esp + 0x64], esi
mov dword [esp + 0x80], 0xf
mov dword [esp + 0x7c], ebx
mov byte [esp + 0x6c], bl
jb 0x100461fd
mov edx, dword [esp + 0x50]
push edx
call fcn.10157f3b
add esp, 4
cmp dword [esp + 0x108], esi
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
jb 0x10046226
mov eax, dword [esp + 0xf4]
push eax
call fcn.10157f3b
add esp, 4
cmp dword [esp + 0x124], esi
mov dword [esp + 0x108], 0xf
mov dword [esp + 0x104], ebx
mov byte [esp + 0xf4], bl
jb 0x10046258
mov ecx, dword [esp + 0x110]
push ecx
call fcn.10157f3b
add esp, 4
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.101586e7
add esp, 0x88
ret 0x90
Function at 0x10046280
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1017f7c0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101c6444]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x54], 1
call fcn.10001a10
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
mov dword [esp + 0x28], ecx
movzx ecx, byte [esp + 0x78]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
mov dl, byte [esp + 0x7c]
lea eax, [esp + 0xc]
mov dword [esp + 0x34], ecx
push eax
lea ecx, [esi + 4]
mov byte [esp + 0x3c], dl
call fcn.10045fa0
mov esi, 0x10
cmp dword [esp + 0x24], esi
jb 0x1004633c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.10157f3b
add esp, 4
cmp dword [esp + 0x68], esi
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
jb 0x1004635f
mov edx, dword [esp + 0x54]
push edx
call fcn.10157f3b
add esp, 4
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.101586e7
add esp, 0x40
ret 0x30
Function at 0x1004c720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1017fd90
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 4]
mov ebp, dword [esp + 0x70]
xor ebx, ebx
cmp byte [eax + 0x31], bl
jne 0x1004c773
mov edx, dword [ebp]
lea ecx, [ecx]
cmp dword [eax + 0xc], edx
jae 0x1004c76a
mov eax, dword [eax + 8]
jmp 0x1004c76e
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0x31], bl
je 0x1004c760
cmp ecx, dword [esi + 4]
mov edi, ecx
je 0x1004c786
mov eax, dword [ebp]
cmp eax, dword [ecx + 0xc]
jae 0x1004c80d
lea ecx, [esp + 0x1c]
call fcn.100482e0
mov ecx, dword [ebp]
mov dword [esp + 0x3c], ecx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x6c], ebx
call fcn.10049780
lea edx, [esp + 0x3c]
push edx
push edi
push esi
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov byte [esp + 0x78], 1
call fcn.1004b800
mov esi, dword [eax]
mov edi, dword [eax + 4]
lea ecx, [esp + 0x54]
call fcn.10046d10
mov eax, dword [esp + 0x44]
cmp eax, ebx
je 0x1004c7db
push eax
call fcn.10157f3b
add esp, 4
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
call fcn.10046d10
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x1004c801
push eax
call fcn.10157f3b
add esp, 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
cmp esi, ebx
jne 0x1004c816
call fcn.1015828d
cmp edi, dword [esi + 4]
jne 0x1004c820
call fcn.1015828d
lea eax, [edi + 0x10]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 4
Function at 0x100502b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
cmp eax, dword [esi + 0x34]
ja 0x100502c2
or eax, 0xffffffff
pop esi
ret 4
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
sub eax, dword [esi + 0x58]
cmp eax, 0x20
jbe 0x100502d7
add dword [esi + 0x54], 1
push edi
call ebp
mov ecx, esi
mov dword [esi + 0x58], eax
call fcn.10050040
mov edi, eax
cmp edi, 0xffffffff
jne 0x100502f3
pop edi
pop ebp
or eax, eax
pop esi
ret 4
push ebx
lea ebx, [esi + 0x40]
push edi
mov ecx, ebx
call fcn.1004ff20
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
call ebp
push edi
mov ecx, ebx
mov ebp, eax
call fcn.1004ff20
push edi
mov ecx, ebx
mov dword [eax + 0x10], ebp
call fcn.1004ff20
mov ebp, 1
push edi
mov ecx, ebx
mov dword [eax + 0x14], ebp
call fcn.1004ff20
mov edx, dword [esi + 0x54]
pop ebx
mov dword [eax + 0x18], edx
add dword [esi + 0x34], ebp
mov eax, edi
pop edi
pop ebp
pop esi
ret 4
Function at 0x100537a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1017dcf8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
mov dword [esi + 0xc8], eax
call fcn.10052d10
push 0xffffffffffffffff
push 0
lea edi, [esi + 0x78]
push eax
mov ecx, edi
mov dword [esp + 0x3c], 0
call fcn.10001a10
cmp dword [esp + 0x24], 0x10
mov dword [esp + 0x30], 0xffffffff
jb 0x1005380e
mov edx, dword [esp + 0x10]
push edx
call fcn.10157f3b
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.100d6fc0
mov edx, dword [eax]
push 1
push edi
add esi, 0x38
mov ecx, eax
mov eax, dword [edx + 0x30]
push esi
call eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret

Function at 0x100595d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101806c6
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [edi], 0x10198504
mov eax, dword [edi + 0x34]
mov ecx, dword [eax]
lea esi, [edi + 0x30]
push eax
push esi
push ecx
push esi
lea eax, [esp + 0x24]
push eax
mov ecx, esi
mov dword [esp + 0x38], 1
call fcn.10058ed0
mov eax, dword [esi + 4]
push eax
call fcn.10157f3b
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov eax, dword [edi + 0x28]
mov ecx, dword [eax]
add esp, 4
lea esi, [edi + 0x24]
push eax
push esi
push ecx
push esi
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
mov byte [esp + 0x38], bl
call fcn.10055840
mov edx, dword [esi + 4]
push edx
call fcn.10157f3b
add esp, 4
lea eax, [edi + 0xc]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
push eax
mov dword [edi + 8], 0x101975e4
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [edi + 8], 0x101975e0
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x1005bc80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101809a6
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea eax, [esi + 0xc]
mov dword [esi], 0x10198504
push eax
mov dword [esi + 8], 0x101975e4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea edi, [esi + 0x24]
mov ecx, edi
mov dword [esp + 0x18], 0
call fcn.10054870
mov dword [edi + 4], eax
mov byte [eax + 0xb9], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], 0
lea edi, [esi + 0x30]
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.100548b0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [edi + 4], eax
mov byte [eax + 0xc1], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], 0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x1005c730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10180a5b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x24]
mov dword [esi], 0x10199ce8
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0xc], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x10], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x14], edx
mov eax, dword [eax + 0x10]
mov edx, dword [esp + 0x30]
xor ebx, ebx
push ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
call fcn.1015812a
add esp, 4
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x28]
push 0xffffffffffffffff
lea ecx, [esi + 0x2c]
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.10001a10
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov dword [esi + 0x48], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x4c], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x50], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x38]
push 0xffffffffffffffff
lea ecx, [esi + 0x58]
mov dword [esi + 0x54], edx
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov dword [esp + 0x24], ebx
mov byte [ecx + 4], bl
call fcn.10001a10
mov cl, byte [esp + 0x3c]
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov byte [esi + 0x74], cl
mov ecx, dword [esp + 0x48]
mov dword [esi + 0x7c], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x78], edx
mov edx, dword [esp + 0x4c]
mov dword [esi + 0x80], ecx
mov ecx, dword [esp + 0x50]
mov dword [esi + 0x88], eax
mov dword [esi + 0x84], edx
mov dword [esi + 0x8c], ecx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 0x34
Function at 0x10066700
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor eax, eax
cmp byte [esi + eax + 0x244], 0
jne 0x1006672d
add eax, 1
cmp eax, 0x14
jb 0x10066711
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x23c]
call fcn.10133f1e
test al, al
jne 0x10066723
mov ecx, dword [esi + 0x240]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
cmp al, 2
je 0x10066723
movzx ebp, byte [esi + 0x1f0]
mov edi, dword [esi + 0x3b4]
cmp ebp, edi
jae 0x10066723
lea ecx, [esi + 0x2c]
call fcn.10046610
sub edi, ebp
add edi, edi
cmp eax, edi
jae 0x10066723
cmp dword [esi + 0x11dc], 0
jne 0x10066783
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x11dc], eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
lea edi, [esi + 8]
mov ebx, eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
test edi, edi
mov ebp, dword [esi + 0xc]
lea eax, [esi + 8]
je 0x100667a3
cmp edi, eax
je 0x100667a8
call fcn.1015828d
cmp ebx, ebp
je 0x1006682b
test edi, edi
jne 0x100667b5
call fcn.1015828d
cmp ebx, dword [edi + 4]
jne 0x100667bf
call fcn.1015828d
cmp dword [ebx + 0x74], 0
je 0x10066815
lea ecx, [esp + 0x10]
call fcn.10065c60
add eax, 0x60
mov eax, dword [eax + 8]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
call eax
test eax, eax
jne 0x10066815
lea ecx, [esp + 0x10]
call fcn.10065c60
add eax, 0x60
mov eax, dword [eax + 8]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x70]
call eax
test al, al
je 0x10066815
lea ecx, [esp + 0x10]
call fcn.10065c60
add eax, 0x60
mov eax, dword [eax + 8]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
lea ecx, [esp + 0x10]
call fcn.100653c0
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
jmp 0x10066795
mov eax, dword [esi + 0x30]
test eax, eax
je 0x10066848
mov ecx, dword [esi + 0x34]
sub ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx ecx, byte [esi + 0x1f0]
mov edx, dword [esi + 0x3b4]
sub edx, ecx
add edx, 0xa
cmp eax, edx
jae 0x100668d3
cmp dword [esi + 0xfa0], 0
jne 0x100668a3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x234]
mov dword [esi + 0x204], eax
mov eax, dword [esi + 0x268]
mov edx, dword [ecx]
mov edx, dword [edx + 0x54]
push eax
mov eax, dword [esi + 0xfa0]
push eax
lea eax, [esi + 0x244]
push eax
lea eax, [esi + 0x26c]
push eax
call edx
add dword [esi + 0xfa0], 1
mov eax, dword [esi + 0x268]
mov ecx, dword [esi + 0x234]
mov edx, dword [ecx]
mov edx, dword [edx + 0x54]
push eax
mov eax, dword [esi + 0xfa0]
push eax
lea eax, [esi + 0x244]
push eax
lea eax, [esi + 0x26c]
push eax
call edx
add dword [esi + 0xfa0], 1
pop edi
mov al, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006d120
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x54
cmp dword [esp + 0x58], 0
jne 0x1006d132
xor eax, eax
add esp, 0x54
ret 8
push ebp
lea ebp, [ecx + 0x8c]
push esi
mov esi, dword [ebp + 4]
cmp esi, dword [ebp + 8]
jbe 0x1006d147
call fcn.1015828d
push edi
mov edi, ebp
push ebx
jmp 0x1006d150
mov ebx, dword [ebp + 8]
cmp dword [ebp + 4], ebx
jbe 0x1006d15d
call fcn.1015828d
test edi, edi
je 0x1006d165
cmp edi, ebp
je 0x1006d16a
call fcn.1015828d
cmp esi, ebx
je 0x1006d1bb
test edi, edi
jne 0x1006d177
call fcn.1015828d
cmp esi, dword [edi + 8]
jb 0x1006d181
call fcn.1015828d
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x68]
cmp eax, dword [ecx]
je 0x1006d19b
cmp esi, dword [edi + 8]
jb 0x1006d196
call fcn.1015828d
add esi, 0x2c
jmp 0x1006d150
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, dword [edi + 8]
mov ebx, eax
jb 0x1006d1ad
call fcn.1015828d
mov dword [esi], ebx
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x54
ret 8
mov eax, dword [esp + 0x68]
mov edx, dword [eax]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 0xc]
xor ecx, ecx
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x6c]
cmp eax, ecx
mov dword [esp + 0x28], ecx
mov word [esp + 0x2c], cx
mov byte [esp + 0x2e], cl
mov word [esp + 0x2f], cx
mov dword [esp + 0x31], ecx
mov dword [esp + 0x20], edx
je 0x1006d21e
mov ecx, dword [eax]
mov dx, word [eax + 4]
mov al, byte [eax + 6]
mov dword [esp + 0x28], ecx
mov word [esp + 0x2c], dx
mov byte [esp + 0x2e], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x38], eax
mov ecx, 9
lea esi, [esp + 0x10]
lea edi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x38]
push ecx
mov ecx, ebp
movsb byte es:[edi], byte [esi]
call fcn.1006a4e0
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x54
ret 8
Function at 0x1006db10
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x40]
lea eax, [esp + 0x18]
mov esi, ecx
push eax
mov ecx, edi
call fcn.10014320
cmp dword [esp + 0x30], 0x10
jb 0x1006db3d
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.10157f3b
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x234]
test ecx, ecx
mov dword [esi + 0x200], eax
je 0x1006dba4
cmp byte [esp + 0x48], 0
jne 0x1006dba4
mov edx, dword [ecx]
mov edx, dword [edx + 0x60]
lea eax, [esp + 0x13]
push eax
call edx
mov ecx, dword [eax]
mov ebx, dword [esi]
mov dword [esi + 0x113c], ecx
mov dl, byte [eax + 4]
mov ecx, dword [esi + 0x234]
mov byte [esi + 0x1140], dl
movzx eax, byte [esi + 0x113d]
mov dword [esi + 0x3b4], eax
mov dword [esi + 0x122c], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x64]
call edx
mov ecx, esi
push eax
mov eax, dword [ebx + 0x9c]
call eax
mov ebp, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [esi + 0x10f0]
push ebx
mov byte [esi + 0xf9c], 1
call ebp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [esi + 0x1108], 0
call ebx
mov eax, dword [esp + 0x44]
mov ecx, dword [eax]
mov dword [esi + 0x258], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x25c], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x260], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xf54], ecx
mov dword [esi + 0x264], edx
mov dword [esi + 0xf50], eax
mov edx, dword [edi]
mov dword [esi + 0x244], edx
mov eax, dword [edi + 4]
mov dword [esi + 0x248], eax
mov ecx, dword [edi + 8]
mov dword [esi + 0x24c], ecx
mov edx, dword [edi + 0xc]
mov cl, byte [esp + 0x48]
mov dword [esi + 0x250], edx
mov eax, dword [edi + 0x10]
lea edi, [esi + 0x1114]
push edi
mov dword [esi + 0x254], eax
mov byte [esi + 0x1141], cl
call ebp
mov dl, byte [esi + 0x112c]
push edi
mov byte [esp + 0x44], dl
call ebx
cmp byte [esp + 0x40], 1
je 0x1006dc88
lea edi, [esi + 0x1114]
push edi
call ebp
mov al, byte [esi + 0x112c]
push edi
mov byte [esp + 0x44], al
call ebx
cmp byte [esp + 0x40], 2
je 0x1006dc88
lea edi, [esi + 0x1114]
push edi
call ebp
push edi
mov byte [esi + 0x112c], 3
call ebx
cmp byte [esp + 0x48], 0
jne 0x1006dcee
mov ecx, esi
call fcn.10066700
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [esi + 0xa8]
push edi
mov dword [esp + 0x4c], eax
call ebp
mov ecx, dword [esp + 0x48]
push edi
mov dword [esi + 0xc0], ecx
call ebx
mov edx, dword [esi + 0x1f4]
push 1
push edx
push 2
push 0
mov ecx, esi
call fcn.10064f20
push 0
push 0x1f4
push 5
push 0
mov ecx, esi
call fcn.10064f20
push 0
push 0xea60
push 0x10
push 0
mov ecx, esi
call fcn.10064f20
push 0
push 0x3e8
push 0
push 0
mov ecx, esi
mov dword [esi + 0x1f8], 0x4e20
call fcn.10064f20
push 0
push 0x2710
push 0x12
push 0
mov ecx, esi
call fcn.10064f20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x14
Function at 0x100766d0
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x101825b7
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x68]
lea edx, [esi + 0x10]
mov dword [esi], 0x10198b2c
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
push edx
mov dword [esi + 0xc], 0x101975e4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebx, ebx
mov dword [esp + 0x5c], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov eax, dword [esp + 0x6c]
push 0x1019777d
push ebx
push eax
lea ecx, [esi + 0x3c]
mov byte [esp + 0x68], 1
call fcn.100755b0
push ebx
push ebx
push ebx
lea ecx, [esi + 0x44]
mov byte [esp + 0x68], 2
call fcn.10030590
push ebx
push ebx
push ebx
lea ecx, [esi + 0x50]
mov byte [esp + 0x68], 3
call fcn.10030590
lea ecx, [esp + 0x64]
push ecx
push ebx
push esi
push 0x10076620
push ebx
push ebx
mov byte [esp + 0x74], 4
call fcn.10158ba9
add esp, 0x18
cmp eax, ebx
mov dword [esi + 0x5c], eax
jne 0x100767ca
push 0x14
push str.create_thread_failed
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
call fcn.10001b80
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x30]
mov byte [esp + 0x60], 5
call fcn.10007ea0
push eax
mov byte [esp + 0x60], 6
call fcn.10075580
mov eax, esi
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x54
ret 0xc

Function at 0x100767e1
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
push edi
push eax
mov dword [esi], 0x10198b2c
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 0x5c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10076814
mov edx, dword [esi + 0x5c]
push 0xff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x5c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esi + 0x54]
push ecx
mov dword [esi + 0x50], 0x10198180
call edi
mov ebx, 0x101975e0
mov dword [esi + 0x50], ebx
mov edx, dword [esi + 0x48]
push edx
mov dword [esi + 0x44], 0x10198180
call edi
mov dword [esi + 0x44], ebx
mov eax, dword [esi + 0x40]
push eax
mov dword [esi + 0x3c], 0x10198180
call edi
lea ecx, [esi + 0x28]
mov dword [esi + 0x3c], ebx
call fcn.100376d0
lea ecx, [esi + 0x10]
push ecx
mov dword [esi + 0xc], 0x101975e4
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
mov dword [esi + 0xc], ebx
pop esi
pop ebx
ret
Function at 0x10088360
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x1017ba28
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x3c]
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.100d8fb0
mov ecx, dword [esp + 0x50]
push ecx
lea ecx, [esp + 0x28]
call fcn.1000dc00
push eax
lea ecx, [esi + 0x44]
mov dword [esp + 0x34], 0
call fcn.100136c0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x18], 0x101995c0
mov dword [esp + 0x1c], 0x10199578
call fcn.10006f60
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 8