joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100987d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 8], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x10098801
push str.invalid_hash_bucket_count
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, 1
mov dword [ebp - 0xc], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.100319a0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x1009890c
nop word [eax + eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x10098891
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10098902
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x100988cb
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x100988c3
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x100988ff
cmp edi, edx
je 0x100988dc
nop
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10098915
cmp edi, edx
jne 0x100988d0
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 8]
mov eax, ecx
cmp ecx, esi
jne 0x10098840
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 0xc]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100988ff

Function at 0x10099f80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10099fab
push 0
push 0
push 0
push 0x1002db60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10099fab
mov eax, 1
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x100a2360
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cffdb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x40
mov eax, dword [0x100e1040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1010b840]
mov dword [ebp - 0x38], ecx
test al, 1
jne 0x100a24be
or eax, 1
mov dword [0x1010b840], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100d6840]
xorps xmm0, xmmword [0x100d6300]
mov dword [ebp - 0x24], 0x5f4f3c5f
mov dword [ebp - 0x20], 0x4e5f394f
mov dword [ebp - 0x1c], 0x49475f4e
mov byte [ebp - 0x18], 0x7f
movups xmmword [ebp - 0x34], xmm0
nop dword [eax + eax]
xor byte [ebp + eax - 0x34], 0x7f
inc eax
cmp eax, 0x1d
jb 0x100a23f0
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x3c], 0
movups xmmword [ebp - 0x50], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100a2416
sub ecx, edx
lea eax, [ebp - 0x34]
push ecx
push eax
lea ecx, [ebp - 0x50]
call fcn.100244e0
mov byte [ebp - 4], 1
mov edx, dword [0x101063e4]
test edx, edx
je 0x100a243f
mov edx, dword [edx + 0x50]
jmp 0x100a2441
xor edx, edx
mov eax, dword [0x101063dc]
test eax, eax
je 0x100a244f
mov eax, dword [eax + 0x18]
jmp 0x100a2451
xor eax, eax
lea ecx, [ebp - 0x50]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.1001b500
mov eax, dword [ebp - 0x14]
add esp, 8
test eax, eax
je 0x100a2478
mov ecx, dword [eax + 1]
test ecx, ecx
jne 0x100a2473
xor eax, eax
jmp 0x100a2478
add eax, 5
add eax, ecx
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x3c]
mov dword [0x1010b844], eax
cmp ecx, 0xf
jbe 0x100a24b7
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100a24ad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100a24ad
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100c65b7
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [0x1010b844], 0
je 0x100a24dc
push 0
mov ecx, dword [ebp - 0x38]
movss xmm1, dword [ebx + 0xc]
movss xmm2, dword [ebx + 8]
call dword [0x1010b844]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100b19d0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d07fd
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x100e1040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x10106490]
mov edi, dword [esi + 0x174]
test edi, edi
setg byte [ebp - 0x14]
cmp dword [0x100e1458], 4
jne 0x100b1a39
mov edx, dword [esi + 0x4cb0]
add edx, dword [esi + 0x4cac]
mov ecx, dword [0x10106438]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push dword [ebp - 0x14]
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x1010b858], 0
jne 0x100b1b6f
movaps xmm0, xmmword [0x100d6450]
xor eax, eax
movaps xmm2, xmmword [0x100d6840]
movups xmmword [ebp - 0x3c], xmm0
mov word [ebp - 0x1c], 0x3c39
movaps xmm0, xmmword [0x100d6540]
movups xmmword [ebp - 0x2c], xmm0
mov byte [ebp - 0x1a], 0x7f
nop
movups xmm0, xmmword [ebp + eax - 0x3c]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x3c], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100b1a70
cmp eax, 0x23
jae 0x100b1a9b
nop dword [eax]
xor byte [ebp + eax - 0x3c], 0x7f
inc eax
cmp eax, 0x23
jb 0x100b1a90
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x40], 0
movups xmmword [ebp - 0x54], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100b1ab6
sub ecx, edx
lea eax, [ebp - 0x3c]
push ecx
push eax
lea ecx, [ebp - 0x54]
call fcn.100244e0
mov dword [ebp - 4], 0
mov edx, dword [0x101063f0]
test edx, edx
je 0x100b1ae2
mov edx, dword [edx + 0x50]
jmp 0x100b1ae4
xor edx, edx
mov eax, dword [0x101063e8]
test eax, eax
je 0x100b1af2
mov eax, dword [eax + 0x18]
jmp 0x100b1af4
xor eax, eax
lea ecx, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.100479c0
mov edi, dword [ebp - 0x18]
add esp, 8
mov ecx, dword [ebp - 0x40]
inc edi
cmp ecx, 0xf
jbe 0x100b1b3e
mov edx, dword [ebp - 0x54]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100b1b34
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100b1b34
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100c65b7
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x14], 0
call esi
lea eax, [ebp - 0x14]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x14]
push 4
push edi
call esi
mov byte [0x1010b858], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c613c
mov esp, ebp
pop ebp
ret
Function at 0x100c03b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
and ecx, eax
mov eax, dword [esi + 0xc]
lea edx, [eax + ecx*8]
mov eax, dword [edx + 4]
cmp eax, dword [esi + 4]
je 0x100c041d
mov ecx, dword [edi]
mov edx, dword [edx]
cmp ecx, dword [eax + 8]
je 0x100c0414
cmp eax, edx
je 0x100c041d
mov eax, dword [eax + 4]
cmp ecx, dword [eax + 8]
jne 0x100c0408
pop edi
add eax, 0xc
pop esi
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
int3

Function at 0x100c04c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, byte [edx]
push ebx
push esi
xor eax, 0x811c9dc5
push edi
mov edi, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push edx
push eax
call fcn.100c0ba0
mov esi, dword [eax + 4]
test esi, esi
je 0x100c0575
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x100c053c
cmp eax, esi
jne 0x100c0534
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100c0544
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x100c0544
cmp eax, esi
jne 0x100c0544
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x50]
call fcn.10031630
push 0x5c
push esi
call fcn.100c65b7
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100c0580
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100c06ef
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.10031630
push 0x5c
push edi
call fcn.100c65b7
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100c064d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100c0600
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100c06e5
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100c0661
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x100c0664
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100c06e5
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.10031630
push 0x5c
push edi
call fcn.100c65b7
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100c06f6
cmp esi, eax
jne 0x100c06b5
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100c0670
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0xfe34946
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1ad9523a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10001672
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x1000167f
mov eax, dword [ebp - 0x10]
mov ecx, esp
mov dword [ecx], 0x39
mov ecx, dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov dword [ebp - 0x14], eax
call ecx
sub esp, 4
xor ecx, ecx
mov word [ebp - 0x16], ax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, 0xaaaaaaab
mov dword [ebp - 0x20], eax
mul ecx
shr edx, 3
imul eax, edx, 0xc
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x24], ecx
je 0x100016cd
jmp 0x100016c0
mov eax, dword [ebp - 0x24]
sub eax, 0xb
mov dword [ebp - 0x28], eax
jne 0x100016e2
jmp 0x100016cd
mov eax, esp
mov dword [eax], 0x97e
mov eax, dword [sym.imp.ADVAPI32.dll_NotifyBootConfigStatus]
call eax
sub esp, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x60
mov dword [ebp - 0x1c], eax
jne 0x100016a1
mov dword [ebp - 4], 0xf17a94
mov dword [ebp - 8], 0x929
mov eax, esp
lea ecx, [ebp - 8]
mov dword [eax + 0x10], ecx
lea ecx, [ebp - 4]
mov dword [eax + 0xc], ecx
mov dword [eax + 8], 0xdbb
mov dword [eax + 4], 0xee7
mov dword [eax], 0xee7
mov eax, dword [sym.imp.ole32.dll_CoWaitForMultipleHandles]
call eax
sub esp, 0x14
mov ecx, dword [ebp - 0x14]
sub ecx, 0x12
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
je 0x1000174b
jmp 0x1000173e
mov eax, dword [ebp - 0x14]
sub eax, 0x25
mov dword [ebp - 0x38], eax
jne 0x10001793
jmp 0x1000174b
mov eax, 0xa04969
mov dword [ebp - 0xc], eax
mov eax, esp
lea ecx, [ebp - 0xc]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x18], 0xf5
mov dword [eax + 0x14], 0x1bf
mov dword [eax + 0x10], 0xb1
mov dword [eax + 8], 0xc9c998
mov dword [eax + 4], 0xf9c655
mov dword [eax], 0xc9c998
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
mov dword [ebp - 0x3c], eax
jmp 0x10001793
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
call eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
cmp ecx, 0x3c
mov word [ebp - 0x3e], ax
mov dword [ebp - 0x10], ecx
jne 0x1000167f
add esp, 0x5c
pop ebp
ret

Function at 0x1015e69a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101b38b0]
jne 0x1015e6a4
repz ret
jmp fcn.1016138c
Function at 0x10162e6f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1015e79c
and dword [ebp - 4], 0
cmp dword [0x101b520c], 0
mov ebx, eax
jne 0x10162f20
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10162fd1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10162fd1
push eax
call fcn.1015e72a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101b520c], eax
call esi
push eax
call fcn.1015e72a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101b5210], eax
call esi
push eax
call fcn.1015e72a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101b5214], eax
call esi
push eax
call fcn.1015e72a
pop ecx
mov dword [0x101b521c], eax
test eax, eax
je 0x10162f20
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1015e72a
pop ecx
mov dword [0x101b5218], eax
mov eax, dword [0x101b5218]
cmp eax, ebx
je 0x10162f78
cmp dword [0x101b521c], ebx
je 0x10162f78
push eax
call fcn.1015e7a5
push dword [0x101b521c]
mov esi, eax
call fcn.1015e7a5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10162f78
test edi, edi
je 0x10162f78
call esi
test eax, eax
je 0x10162f6f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10162f6f
test byte [ebp - 0xc], 1
jne 0x10162f78
or dword [ebp + 0x10], 0x200000
jmp 0x10162fb1
mov eax, dword [0x101b5210]
cmp eax, ebx
je 0x10162fb1
push eax
call fcn.1015e7a5
pop ecx
test eax, eax
je 0x10162fb1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10162fb1
mov eax, dword [0x101b5214]
cmp eax, ebx
je 0x10162fb1
push eax
call fcn.1015e7a5
pop ecx
test eax, eax
je 0x10162fb1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101b520c]
call fcn.1015e7a5
pop ecx
test eax, eax
je 0x10162fd1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10162fd3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10163cfd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [0x101b3334], 0xaa5
mov ecx, dword [0x101b3338]
add ecx, 0xffffd942
mov dword [0x101b3338], ecx
mov dword [ebp - 0x10], eax
call fcn.1016513a
xor ecx, ecx
mov dword [0x101b3338], 0x1d70
mov edx, eax
mov esi, dword [eax + 0x3c]
mov dword [0x101b3334], 0x9d6
mov dword [0x101b3338], 0x84a
mov esi, dword [eax + esi + 0x78]
mov dword [0x101b3334], 0x13d1
mov dword [0x101b3338], 0x1706
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x10163e7e
jmp 0x10163dde
xor eax, eax
mov dword [0x101b3334], 0xd28
mov ecx, dword [ebp - 0x28]
add ecx, 2
mov edx, dword [ebp - 0x2c]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], eax
jae 0x10163e7e
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edx
jmp 0x10163df2
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
jmp 0x10163dc2
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
je 0x10163e43
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x10163df2
mov al, byte [ebp - 0x42]
test al, 1
jne 0x10163e4f
jmp 0x10163d90
mov eax, dword [ebp - 0x28]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x101b3334], 0x547
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [0x101b3338], 0x1a0f
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10163e89
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101b3334]
add eax, 0xfffffadd
mov dword [0x101b3334], eax
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x101b3338], 0x15f7
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], eax
jmp 0x10163f0f
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x1c], eax
je 0x10163fc2
jmp 0x10163f07
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], eax
jl 0x10163f0f
jmp 0x10163f25
mov eax, dword [ebp - 0x1c]
add esp, 0x2c
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
jne 0x10163eee
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [0x101b3334], 0x28a1
mov dword [0x101b3338], 0x2cb8
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
jne 0x10163f07
mov dword [0x101b3334], 0x7d9
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x1c], eax
jne 0x10163f07
xor eax, eax
mov dword [0x101b3334], 0x3dce
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x1c], eax
jne 0x10163f07
mov dword [0x101b3334], 0x20ef
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dx, word [eax + ecx*2 - 0x14]
mov word [ebp - 0x26], dx
xor eax, eax
mov cx, word [ebp - 0x26]
cmp cx, 0x64
mov dword [ebp - 0x1c], eax
je 0x10163ed4
jmp 0x10163f07
xor eax, eax
mov dword [0x101b3334], 0x1c90
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x10163f07
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff9
mov dword [ebp - 0x2c], eax
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
cmp word [ecx + edx*2], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x10163f07
mov eax, 1
mov dword [0x101b3334], 0x8a6
mov dword [ebp - 0x1c], eax
jmp 0x10163f07