joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016c90
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b93b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10047650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1001f6c2
push 4
mov dword [ebp - 4], 0
call fcn.100226f1
mov edi, eax
add esp, 4
test edi, edi
je 0x10016d10
call fcn.1001f4bd
mov dword [edi], eax
call fcn.1001f27c
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.1001f683
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10016d06
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.1001f6ab
jmp 0x10016d12
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001ada0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xdd
xor ecx, ecx
jmp 0x1001adb0
mov al, byte [edi + ecx - 0x6db8ad5e]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x16
jb 0x1001adb0
mov byte [esi + 0x16], 0
mov eax, esi
ret

Function at 0x1001b080
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x82
xor ecx, ecx
jmp 0x1001b090
mov al, byte [edi + ecx + 0x2e62e9b2]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x19
jb 0x1001b090
mov byte [esi + 0x19], 0
mov eax, esi
ret

Function at 0x1001b0b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 9
xor ecx, ecx
jmp 0x1001b0c0
mov al, byte [edi + ecx - 0x7bd60ae8]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x1a
jb 0x1001b0c0
mov byte [esi + 0x1a], 0
mov eax, esi
ret

Function at 0x1001b1b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 6
xor ecx, ecx
jmp 0x1001b1c0
mov al, byte [edi + ecx - 0x58ac7a1c]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xf
jb 0x1001b1c0
mov byte [esi + 0xf], 0
mov eax, esi
ret

Function at 0x1001b1e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x34
xor ecx, ecx
jmp 0x1001b1f0
mov al, byte [edi + ecx + 0x32593faf]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xf
jb 0x1001b1f0
mov byte [esi + 0xf], 0
mov eax, esi
ret
Function at 0x1001b210
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x15
xor ecx, ecx
jmp 0x1001b220
mov al, byte [edi + ecx + 0x43f2140e]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xf
jb 0x1001b220
mov byte [esi + 0xf], 0
mov eax, esi
ret

Function at 0x1001b4a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xd9
xor ecx, ecx
jmp 0x1001b4b0
mov al, byte [edi + ecx - 0x1a2e1036]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xd
jb 0x1001b4b0
mov byte [esi + 0xd], 0
mov eax, esi
ret

Function at 0x1001b4d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 1
xor ecx, ecx
jmp 0x1001b4e0
mov al, byte [edi + ecx + 0x3ed419b4]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xb
jb 0x1001b4e0
mov byte [esi + 0xb], 0
mov eax, esi
ret

Function at 0x1001b590
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xe8
xor ecx, ecx
jmp 0x1001b5a0
mov al, byte [edi + ecx + 0x3566316e]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x2a
jb 0x1001b5a0
mov byte [esi + 0x2a], 0
mov eax, esi
ret

Function at 0x1001b750
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x37
xor ecx, ecx
jmp 0x1001b760
mov al, byte [edi + ecx - 0x2487a35d]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x2c
jb 0x1001b760
mov byte [esi + 0x2c], 0
mov eax, esi
ret

Function at 0x1001b960
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xab
xor ecx, ecx
jmp 0x1001b970
mov al, byte [edi + ecx - 0x7b84b047]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x12
jb 0x1001b970
mov byte [esi + 0x12], 0
mov eax, esi
ret

Function at 0x1001bbc0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xef
xor ecx, ecx
jmp 0x1001bbd0
mov al, byte [edi + ecx - 0x20ea7df6]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x43
jb 0x1001bbd0
mov byte [esi + 0x43], 0
mov eax, esi
ret

Function at 0x1001bbf0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x46
xor ecx, ecx
jmp 0x1001bc00
mov al, byte [edi + ecx - 0x11021866]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x1c
jb 0x1001bc00
mov byte [esi + 0x1c], 0
mov eax, esi
ret

Function at 0x1001bc20
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x59
xor ecx, ecx
jmp 0x1001bc30
mov al, byte [edi + ecx - 0xe7a4c7f]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x16
jb 0x1001bc30
mov byte [esi + 0x16], 0
mov eax, esi
ret

Function at 0x1001bc50
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xaa
xor ecx, ecx
jmp 0x1001bc60
mov al, byte [edi + ecx + 0x36b371d1]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x17
jb 0x1001bc60
mov byte [esi + 0x17], 0
mov eax, esi
ret

Function at 0x1001bc80
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x54
xor ecx, ecx
jmp 0x1001bc90
mov al, byte [edi + ecx + 0x7b8009b2]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x16
jb 0x1001bc90
mov byte [esi + 0x16], 0
mov eax, esi
ret
Function at 0x1001bee0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x1b
xor ecx, ecx
jmp 0x1001bef0
mov al, byte [edi + ecx - 0x56714f1a]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x1b
jb 0x1001bef0
mov byte [esi + 0x1b], 0
mov eax, esi
ret

Function at 0x1001dba0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x101acf1c]
push esi
xor esi, esi
cmp eax, esi
je 0x1001dbbb
lea esp, [esp]
cmp dword [eax + 4], esi
jne 0x1001dc03
mov eax, dword [eax]
cmp eax, esi
jne 0x1001dbb0
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, esi
je 0x1001dc03
lea ecx, [eax + 0x20]
mov edx, ecx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
sub edx, eax
nop
mov esi, dword [eax + 4]
mov dword [ecx], esi
mov dword [eax + 4], ecx
add edx, 0x20
add ecx, 0x20
cmp edx, 0xfe0
jbe 0x1001dbe0
mov ecx, dword [0x101acf1c]
mov dword [eax], ecx
mov dword [0x101acf1c], eax
pop esi
ret
Function at 0x1001e5a0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10047650]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1001e684
lea eax, [ebp - 0x20]
push eax
push ebx
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1001e67d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp dword [ebp - 0x20], 0x10
jb 0x1001e662
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1001e662
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1001e662
mov eax, dword [esi]
test eax, eax
jne 0x1001e627
mov ecx, dword [0x101ab894]
push 0x200
push eax
push ecx
mov dword [esi + 4], 0x80
call edi
mov dword [esi], eax
test eax, eax
je 0x1001e67c
jmp 0x1001e654
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
jb 0x1001e654
lea edx, [ecx*8]
push edx
push eax
mov eax, dword [0x101ab894]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x1001e67c
mov ecx, dword [esi + 4]
add ecx, ecx
mov dword [esi + 4], ecx
mov dword [esi], eax
mov edx, dword [esi + 8]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x18]
mov dword [eax + edx*4], ecx
inc dword [esi + 8]
lea edx, [ebp - 0x20]
push edx
push ebx
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1001e5e7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1002005a
mov esp, ebp
pop ebp
ret

Function at 0x1001e6a0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.1001e5a0
cmp dword [esi], ebx
je 0x1001e6fb
cmp dword [esi + 8], ebx
jbe 0x1001e6fb
push edi
mov eax, dword [esi]
mov ecx, dword [eax + ebx*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1001e6f4
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
push edi
call fcn.1001e440
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x1001e6c0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1001e700
Capabilities:
Resume thread

Disassembly:
cmp dword [ebx], 0
je 0x1001e74d
push edi
xor edi, edi
cmp dword [ebx + 8], edi
jbe 0x1001e73b
push esi
mov edi, edi
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x1001e734
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [ebx + 8]
jb 0x1001e710
pop esi
mov edx, dword [ebx]
mov eax, dword [0x101ab894]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
ret
Function at 0x1001e750
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
imul esi, esi, 0x2c
add esi, dword [0x101acf10]
push edi
test byte [esi + 0x14], 1
mov edi, dword [esi]
mov ebx, 5
je 0x1001e776
sub edi, ebx
mov ebx, 7
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1001e794
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov ecx, dword [esi + 4]
sub ecx, edi
sub ecx, 5
mov dword [edi + 1], ecx
test byte [esi + 0x14], 1
je 0x1001e7af
mov eax, dword [esi]
mov word [eax], 0xf9eb
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001e7e0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x101acf18]
push esi
xor edx, edx
xor esi, esi
mov dword [ebp - 4], edx
test ecx, ecx
je 0x1001e8b5
mov eax, dword [0x101acf10]
push ebx
add eax, 0x14
mov bl, 2
test byte [eax], bl
je 0x1001e81b
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x1001e807
pop ebx
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x1001e813
push edi
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
call fcn.1001e6a0
add esp, 8
cmp esi, dword [0x101acf18]
jae 0x1001e865
mov edi, esi
imul edi, edi, 0x2c
lea ecx, [ecx]
mov eax, dword [0x101acf10]
test byte [edi + eax + 0x14], bl
jne 0x1001e859
mov eax, esi
call fcn.1001e750
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001e865
inc esi
add edi, 0x2c
cmp esi, dword [0x101acf18]
jb 0x1001e840
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x1001e8ab
xor edi, edi
cmp dword [ebp - 8], edi
jbe 0x1001e89b
mov ecx, dword [ebx + edi*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x1001e895
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [ebp - 8]
jb 0x1001e873
mov edx, dword [0x101ab894]
push ebx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002005a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10047650]
jne 0x10020064
repz ret
jmp fcn.10025fe8

Function at 0x1002add5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1002adfc
call fcn.10022a43
mov dword [eax], esi
call fcn.10022a30
push 0x16
pop esi
mov dword [eax], esi
call fcn.10026664
mov eax, esi
jmp 0x1002ae51
test dword [ebp + 0xc], 0xfffffff9
jne 0x1002ade2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002ae29
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10022a56
pop ecx
call fcn.10022a30
mov eax, dword [eax]
jmp 0x1002ae51
test al, 0x10
jne 0x1002ae4f
test al, 1
je 0x1002ae4f
test byte [ebp + 0xc], 2
je 0x1002ae4f
call fcn.10022a43
mov dword [eax], 5
call fcn.10022a30
mov dword [eax], 0xd
jmp 0x1002ae20
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1003335c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10047650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100282c4
and dword [ebp - 0x14], 0
cmp dword [0x101ab090], 0
mov dword [ebp - 0x18], eax
jne 0x1003340f
push 0x1003fe6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100334b7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1003fe60
push ebx
call edi
test eax, eax
je 0x100334b7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x1003fe50
push ebx
mov dword [0x101ab090], eax
call edi
push eax
call esi
push 0x1003fe3c
push ebx
mov dword [0x101ab094], eax
call edi
push eax
call esi
push 0x1003fe20
push ebx
mov dword [0x101ab098], eax
call edi
push eax
call esi
mov dword [0x101ab0a0], eax
test eax, eax
je 0x1003340f
push 0x1003fe08
push ebx
call edi
push eax
call esi
mov dword [0x101ab09c], eax
mov eax, dword [0x101ab09c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10033468
cmp dword [0x101ab0a0], ecx
je 0x10033468
push eax
call esi
push dword [0x101ab0a0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10033468
test ebx, ebx
je 0x10033468
call edi
test eax, eax
je 0x1003345f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1003345f
test byte [ebp - 8], 1
jne 0x10033468
or dword [ebp + 0x10], 0x200000
jmp 0x1003349b
mov eax, dword [0x101ab094]
cmp eax, dword [ebp - 0x18]
je 0x1003349b
push eax
call esi
test eax, eax
je 0x1003349b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1003349b
mov eax, dword [0x101ab098]
cmp eax, dword [ebp - 0x18]
je 0x1003349b
push eax
call esi
test eax, eax
je 0x1003349b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x101ab090]
call esi
test eax, eax
je 0x100334b7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100334b9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002005a
leave
ret
Function at 0x10038de0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10038f90
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10038ead
mov edx, dword [ebp - 4]
cmp edx, dword [0x10047194]
jb 0x10038e2a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10047198]
ja 0x10038e2a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10038dfa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100239d0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10038e50
jmp 0x10038ead
cmp dword [ebp - 0x14], 0x10000
jne 0x10038e93
cmp dword [ebp - 0x18], 0x10000
jb 0x10038e93
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10038e86
mov eax, dword [ebp - 8]
jmp 0x10038eaf
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10038ea8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10038f90
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10038dfa
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10038ec0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10038fc0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10038f85
mov edx, dword [ebp - 4]
cmp edx, dword [0x10047194]
jb 0x10038f05
mov eax, dword [ebp - 4]
cmp eax, dword [0x10047198]
ja 0x10038f05
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10038ed5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100239d0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10038f2b
jmp 0x10038f85
cmp dword [ebp - 0x14], 0x10000
jne 0x10038f6e
cmp dword [ebp - 0x18], 0x10000
jb 0x10038f6e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10038f61
mov eax, dword [ebp - 8]
jmp 0x10038f87
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10038f80
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10038fc0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10038ed5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003a390
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x101aa3f4], eax
je 0x1003a3ae
mov eax, 0x10dd
jmp 0x1003a48f
mov eax, dword [0x101aa404]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003a42c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1003a40a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1003a40a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10039440
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.1002004f
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1003a3b6
mov dword [0x101aa404], 0
call fcn.10039d20
mov ecx, dword [0x101aa400]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1003a479
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1002004f
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1003a444
mov dword [0x101aa400], 0
mov dword [0x101aa3f4], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003a970
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101aa3f8], 0
je 0x1003a989
mov eax, dword [0x101aa3f8]
jmp 0x1003aa29
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1003a99b
xor eax, eax
jmp 0x1003aa29
push 8
call fcn.100226f1
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003a9f1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1003a9da
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1002004f
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x101aa3f8], eax
mov dword [0x101aa3fc], 0
mov eax, dword [ebp - 8]
jmp 0x1003aa29
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1003aa0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1003a9bb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x101aa400]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x101aa400], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x404850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x449ad9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
mov eax, dword [0x4630d0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov dword [esp + 0x10], 0
call fcn.00415160
mov ebp, eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x30], 1
call fcn.00415050
push ebp
push esi
mov ecx, eax
mov byte [esp + 0x34], 2
call fcn.004011f0
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x2c], 1
call fcn.0040ed90
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 0
call fcn.0040ed90
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x24
ret 4
Function at 0x40a790
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44978b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4630d0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 8]
mov dword [esp + 0x20], 0
mov ecx, edi
mov dword [esi], vtable.CPBasePath.0
call fcn.0040ed60
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x28]
push ecx
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x14]
mov dword [esi + 4], eax
call fcn.00401050
lea edx, [esp + 0x14]
lea ecx, [edi + 4]
push edx
mov byte [esp + 0x24], 2
call fcn.00401b30
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call fcn.0040ed90
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.0040ed90
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0xc