joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a4d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2e000]
push edi
jmp 0x44a4ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44a4f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44a4e0
mov eax, 1
add ebx, ebx
jne 0x44a503
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44a514
jne 0x44a533
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44a533
dec eax
add ebx, ebx
jne 0x44a520
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x44a4f8
add ebx, ebx
jne 0x44a52f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x44a585
xor ecx, ecx
sub eax, 3
jb 0x44a54b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44a5ba
sar eax, 1
mov ebp, eax
jmp 0x44a556
add ebx, ebx
jne 0x44a556
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44a524
inc ecx
add ebx, ebx
jne 0x44a564
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44a524
add ebx, ebx
jne 0x44a571
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44a566
jne 0x44a582
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44a566
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44a5a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44a596
jmp 0x44a4e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44a5a4
add edi, ecx
jmp 0x44a4e6
pop esi
mov edi, esi
mov ecx, 0xe85
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44a5c2
cmp byte [edi], 0x16
jne 0x44a5c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44a5c7
lea edi, [esi + 0x47000]
mov eax, dword [edi]
or eax, eax
je 0x44a636
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5034c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x50388]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44a5f4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5038c]
or eax, eax
je 0x44a630
mov dword [ebx], eax
add ebx, 4
jmp 0x44a611
call dword [esi + 0x5039c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x44a667
cmp al, 0xef
ja 0x44a65a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x44a63c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x44a649
mov ebp, dword [esi + 0x50390]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44a69b
sub esp, 0xffffff80
jmp 0x409aff
Function at 0x403a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov esp, dword [edi + 0x5614ec83]
mov esi, dword [ebp + 0x26]
push edi
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x403ac4
mov eax, dword [esi + 0x824]
test eax, eax
je 0x403ac4
mov eax, dword [0xfe4102b4]
test eax, eax
je 0x403c25
in eax, 0xc6
mov ah, 0x61
inc ecx
add cl, ch
popal
push ebp
add byte [eax], al
lcall 0x100, 0x41fce13d
inc ecx
add byte [ecx], al
jne 0x403ad7
cld
inc esi
xor eax, 0xf0648ca3
add bl, ch
and al, 0x8b
dec esi
adc byte [esi + 0x9a028c], dl
cmp ecx, eax
xor al, 0x98
mov esi, dword [ecx + 0x61]
mov ecx, dword [esi + 0x10]
xchg esi, eax
mov word [edx], es
lcall 0x8b98, 0x34c83b00
jno 0x403b47
add al, byte [ecx]
mov eax, dword [0x4102c0]
inc ecx
inc eax
inc edi
or eax, 0x413cb8
cmpsb byte [esi], byte es:[edi]
add ch, ah
add byte [ebx - 0x54], dl
add ch, al
add byte [ebx + 0x4028100d], cl
idiv dword [ebx]
ror byte [edi], 0xba
pop ss
adc cl, byte [eax]
nop
xor cl, al
or esp, dword [eax]
add byte [ebx + 0x5ca54f8], cl
add edi, edx
inc eax
mov dword [0xd94102ac], eax
call fcn.00406a00
jno 0x403ac8
or eax, dword [ecx]
mov dword [0x410ba4], edx
cmc
xchg byte [eax + 8], dl
add byte [eax], al
mov edx, dword [0x410da4]
mov eax, dword [esi + 0x169e0830]
mov dword [esi + 0x8554], edx
add byte [eax], al
mov dword [esi - 0x1e], esp
out dx, eax
xor al, 8
add byte [eax], al
mov dword [edi + 4], ecx
mov ecx, dword [esi + 0x740838]
mov eax, dword [esi + 0x530830]
mov edx, dword [esi + 0x4f0834]
sub ecx, eax
mov eax, dword [esi + 0x83c]
sbb eax, dword [edx + 0xa7f0985]
jl 0x403b7a
test dword [edx + 0x73], esi
add al, 0x33
xor ebp, dword [eax - 0x63b06da9]
xor esi, dword [ebx]
test al, 0x57
xchg edx, eax
dec edi
pushfd
mov dword [edi + 0x14], eax
jb 0x403be0
push eax
or byte [eax], al
add dl, cl
xchg byte [eax], dh
or byte [eax], al
add byte [ebx + 0x8ae96], cl
test al, 0x2b
wait
mov eax, dword [esi + 0x3ff954]
sbb eax, edx
test eax, eax
jg 0x403b54
jl 0x403baa
test ecx, ecx
jae 0x403bae
mov ch, 0xc9
xor eax, eax
mov dword [eax + ebx], ebx
mov dword [edi + 0x1c], eax
mov ecx, dword [esi - 0x5ffff7af]
mov eax, dword [esi + 0x840]
mov edx, dword [esi - 0x11fff7bc]
sub ecx, eax
mov edx, dword [esi + 0x4c]
or byte [eax], al
stosb byte es:[edi], al
sbb eax, edx
test dword [edx + 0x47c0a27], ebx
test ecx, ecx
jae 0x403bde
xor ecx, ecx
xor eax, eax
mov dword [edi + 8], ecx
mov dword [0xd8b0c47], eax
or byte [ebx + 0xd8b0c47], ah
adc al, 0xd0
inc eax
xchg esi, eax
test ecx, ecx
je 0x403c25
adc eax, 0x419dac3d
mov eax, edi
cdq
idiv ecx
test dword [ebx - 0x56], ebp
sub byte [ebx + 0x40c0c815], cl
add byte [edi - 0x7d], dl
ret 0x6840
mov eax, dword [0x4117a4]
mov ecx, dword [esi + 4]
lea edx, [ebp - 0x14]
pop ds
in al, dx
add dword ss:[eax], eax
add byte [eax], al
push edx
fisttp word [ecx - 0x40170fb3]
push es
add byte [eax], al
mov edx, dword [edx]
adc dword [ecx - 0x18], 0x5c
sub eax, dword [eax]
add byte [esi - 0x39], dl
inc esi
or byte [eax], al
fst st(7)
add al, ch
invalid
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x33920aa8
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..rsrc_1
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x72612ea6
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x100023d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x18], 0
jne 0x10002404
push str.plugin.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x18], eax
jmp 0x100023ee
push str.sub.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000242a
push str.INITIAL
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
mov ecx, 1
test ecx, ecx
je 0x10002599
push str.executeAPI
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10002599
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx]
cmp ecx, 0xe9
jne 0x10002488
mov edx, dword [ebp - 4]
mov eax, dword [edx + 1]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 5]
mov dword [ebp - 4], eax
jmp 0x10002459
cmp dword [0x10058004], 0
je 0x10002509
cmp dword [ebp - 0x1c], 0
je 0x100024d6
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push 0x10
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 8]
add ecx, 5
mov edx, dword [ebp - 0x1c]
sub edx, ecx
mov eax, dword [ebp - 8]
mov dword [eax + 1], edx
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x10
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10002509
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push 0x10
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
mov byte [eax], 0xc3
mov ecx, dword [ebp - 8]
mov byte [ecx + 1], 0xc3
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0x10
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xc], 0
jmp 0x1000251b
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0x1000
jge 0x10002599
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
cmp ecx, 0x75
jne 0x10002594
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
movzx eax, byte [edx + 1]
cmp eax, 2
jne 0x10002594
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + 2]
cmp edx, 0xeb
jne 0x10002594
lea eax, [ebp - 0x10]
push eax
push 0x40
push 0x10
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov byte [edx], 0x90
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov byte [eax + 1], 0x90
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x10
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10002599
jmp 0x10002512
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000bbf0
Capabilities:
Allocate or change rwx memory
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
jmp 0x1000bc12
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x10
jge 0x1000bd1a
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx*4 + 0x10058008]
mov dword [ebp - 0x18], edx
push 8
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.10043eb0
add esp, 0xc
mov edx, 1
shl edx, 3
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0x10
jae 0x1000bc4e
jmp 0x1000bc53
call fcn.1001ca83
mov eax, dword [ebp - 0x28]
mov byte [ebp + eax - 0x14], 0
push str.MaiHook:
lea ecx, [ebp - 0x14]
push ecx
call fcn.100437a0
add esp, 8
test eax, eax
jne 0x1000bd15
mov edx, dword [ebp - 0x18]
add edx, 8
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.10043a70
add esp, 4
mov ecx, dword [ebp - 0x20]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1000bcf9
lea edx, [ebp - 0x2c]
push edx
push 0x40
push 0x10
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 0x18]
mov byte [eax + edx], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 0x24]
sub edx, ecx
mov eax, dword [ebp - 0x18]
mov dword [eax + 1], edx
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0x10
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000bd15
push 0
push 0x1004b68c
push str.Load_Error
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x1000bc09
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret
Function at 0x1000d3e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x8b
mov byte [ebp - 0x17], 0x4c
mov byte [ebp - 0x16], 0x24
mov byte [ebp - 0x15], 4
mov byte [ebp - 0x14], 0x8b
mov byte [ebp - 0x13], 0x1c
mov byte [ebp - 0x12], 0x24
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0xe8
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0xc3
push 0x14
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.10043eb0
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x1000d48b
push 0x1004b93c
push 0x1004b948
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0x1c]
add eax, 0xe
mov ecx, dword [ebp + 8]
sub ecx, eax
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0xa], ecx
mov eax, dword [ebp - 0x1c]
push eax
push 0x1004b950
push 0x1004b96c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.10044060
add esp, 8
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0xf], edx
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret
Function at 0x1000d7d0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x1000d831
xor eax, eax
jmp 0x1000d8ab
mov dword [ebp - 0x20], 0x1c
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1000d897
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x34]
jne 0x1000d87d
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x18]
je 0x1000d87d
mov edx, dword [ebp - 0x18]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x1000d87d
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1000d849
mov dword [ebp - 0x28], 1
jmp 0x1000d89e
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret
Function at 0x1000d8c0
Capabilities:
Check for hardware breakpoints
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2ec], 0x1c
xor eax, eax
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2d4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2f8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x2fc], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0xffffffff
je 0x1000da60
lea ecx, [ebp - 0x2ec]
push ecx
mov edx, dword [ebp - 0x2f0]
push edx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1000da53
mov eax, dword [ebp - 0x2e0]
cmp eax, dword [ebp - 0x2f8]
jne 0x1000da38
mov ecx, dword [ebp - 0x2e4]
cmp ecx, dword [ebp - 0x2fc]
je 0x1000da38
mov dword [ebp - 0x2d0], 0
push 0x2c8
push 0
lea edx, [ebp - 0x2cc]
push edx
call fcn.1001d8d0
add esp, 0xc
mov dword [ebp - 0x2d0], 0x10010
mov eax, dword [ebp - 0x2e4]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0xffffffff
je 0x1000da38
lea ecx, [ebp - 0x2d0]
push ecx
mov edx, dword [ebp - 0x2f4]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1000da2b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x2cc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [ebp - 0x2c8], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x2c4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x2c0], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x2b8], eax
lea ecx, [ebp - 0x2d0]
push ecx
mov edx, dword [ebp - 0x2f4]
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [ebp - 0x2f4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2ec]
push ecx
mov edx, dword [ebp - 0x2f0]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1000d952
mov eax, dword [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret
Function at 0x1000e030
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0xc], 0xe8
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov eax, dword [ebp + 8]
add eax, 5
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov dword [ebp - 0xb], ecx
lea edx, [ebp - 0x20]
push edx
push 0x40
push 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
sub edx, 5
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 5
jae 0x1000e0bc
mov eax, dword [ebp - 0x10]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x1000e0ab
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.10043eb0
add esp, 0xc
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x10]
mov byte [ecx], 0xe9
push 4
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax + 1]
push edx
call fcn.10043eb0
add esp, 0xc
push 5
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10043eb0
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
sub eax, 5
push eax
push 0x90
mov ecx, dword [ebp - 0x1c]
add ecx, 5
push ecx
call fcn.10043f30
add esp, 0xc
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x20]
push eax
push 0x10
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret
Function at 0x1000e150
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0xc], 0xe9
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov byte [ebp - 8], 0
mov eax, dword [ebp + 8]
add eax, 5
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov dword [ebp - 0xb], ecx
lea edx, [ebp - 0x20]
push edx
push 0x40
push 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
sub edx, 5
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 5
jae 0x1000e1dc
mov eax, dword [ebp - 0x10]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
jmp 0x1000e1cb
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.10043eb0
add esp, 0xc
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x10]
mov byte [ecx], 0xe9
push 4
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax + 1]
push edx
call fcn.10043eb0
add esp, 0xc
push 5
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10043eb0
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
sub eax, 5
push eax
push 0x90
mov ecx, dword [ebp - 0x1c]
add ecx, 5
push ecx
call fcn.10043f30
add esp, 0xc
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x20]
push eax
push 0x10
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret
Function at 0x1000e940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x3c]
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax + 0xf8]
mov dword [ebp - 0x34], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x18]
cmp dword [edx + ecx + 0x78], 0
jne 0x1000e990
xor eax, eax
jmp 0x1000ea63
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 0x1c], 0
jne 0x1000e9bb
xor eax, eax
jmp 0x1000ea63
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0
jne 0x1000e9cb
xor eax, eax
jmp 0x1000ea63
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x24], 0
jne 0x1000e9db
xor eax, eax
jmp 0x1000ea63
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
jmp 0x1000ea18
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [eax + 0x18]
jae 0x1000ea60
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.100437a0
add esp, 8
test eax, eax
jne 0x1000ea5e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x2c]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x1c], edx
jmp 0x1000ea60
jmp 0x1000ea0f
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret