joyce8/EMBER2024-capa huggingface dataset:
Function at 0x702f9e97
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.702ea2d0
and dword [ebp - 4], 0
cmp dword [0x70358ca4], 0
mov ebx, eax
jne 0x702f9f48
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x702f9ff9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x702f9ff9
push eax
call fcn.702ea25e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x70358ca4], eax
call esi
push eax
call fcn.702ea25e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x70358ca8], eax
call esi
push eax
call fcn.702ea25e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x70358cac], eax
call esi
push eax
call fcn.702ea25e
pop ecx
mov dword [0x70358cb4], eax
test eax, eax
je 0x702f9f48
push 0x7031fe38
push edi
call esi
push eax
call fcn.702ea25e
pop ecx
mov dword [0x70358cb0], eax
mov eax, dword [0x70358cb0]
cmp eax, ebx
je 0x702f9fa0
cmp dword [0x70358cb4], ebx
je 0x702f9fa0
push eax
call fcn.702ea2d9
push dword [0x70358cb4]
mov esi, eax
call fcn.702ea2d9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x702f9fa0
test edi, edi
je 0x702f9fa0
call esi
test eax, eax
je 0x702f9f97
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x702f9f97
test byte [ebp - 0xc], 1
jne 0x702f9fa0
or dword [ebp + 0x10], 0x200000
jmp 0x702f9fd9
mov eax, dword [0x70358ca8]
cmp eax, ebx
je 0x702f9fd9
push eax
call fcn.702ea2d9
pop ecx
test eax, eax
je 0x702f9fd9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x702f9fd9
mov eax, dword [0x70358cac]
cmp eax, ebx
je 0x702f9fd9
push eax
call fcn.702ea2d9
pop ecx
test eax, eax
je 0x702f9fd9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x70358ca4]
call fcn.702ea2d9
pop ecx
test eax, eax
je 0x702f9ff9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x702f9ffb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x441217
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x441226
pop dword [ebp - 0x28]
mov eax, 0x441226
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x5332b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0xf36c05a0
add ecx, 0xc944fa3
mov ebx, eax
mov edx, 0x487e00
add edx, dword [ebp - 0x28]
mov edi, 0xf4c8abbb
add edi, 0xb9967b1d
add dword [ebp - 0x18], 0x27482f1f
mov esi, dword [edx]
xor dword [ebp - 0x1c], 0x2ff72688
add esi, edi
mov dword [ebp - 4], 0x93c6c9b1
mov dword [ebx], esi
xor dword [ebp - 0x14], eax
add ebx, 0xa93ef5ac
sub ebx, 0xa93ef5a8
add edx, 0xa8c06ebb
sub edx, 0xa8c06eb7
loop 0x441275
add eax, 0x147df
xor ebx, ebx
add ebx, eax
add eax, 0xeb1685f8
add eax, 0x14e97a0d
mov ecx, 0x874738df
sub ecx, 0x870738df
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10004350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [ebp + 8]
mov word [ebp - 6], 0x7274
mov dword [ebp - 0xb], 0x20657479
mov byte [ebp - 4], 0
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x70
mov word [ebp - 0x15], 0x2064
mov word [ebp - 0x12], 0x7274
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x10], 0
mov word [ebp - 0x17], 0x726f
mov byte [ebp - 0x18], 0x77
mov dword [ebp - 0x22], 0x2064726f
mov word [ebp - 0x1d], 0x7274
mov byte [ebp - 0x1b], 0
mov word [ebp - 0x24], 0x7764
mov byte [ebp - 0x1e], 0x70
mov dword [ebp - 0x41], 0x727470
mov word [ebp - 0x44], 0x6574
mov word [ebp - 0x47], 0x625f
mov byte [ebp - 0x42], 0x20
mov byte [ebp - 0x48], 0x36
mov byte [ebp - 0x45], 0x79
mov word [ebp - 0x2a], 0x7470
mov word [ebp - 0x2d], 0x6472
mov word [ebp - 0x30], 0x7771
mov word [ebp - 0x28], 0x72
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2e], 0x6f
mov dword [ebp - 0x51], 0x65747962
mov dword [ebp - 0x4d], 0x72747020
mov word [ebp - 0x53], 0x5f30
mov byte [ebp - 0x49], 0
mov byte [ebp - 0x54], 0x31
mov word [ebp - 0x5a], 0x2044
mov dword [ebp - 0x60], 0x41564e49
mov word [ebp - 0x57], 0x5254
mov byte [ebp - 0x55], 0
mov word [ebp - 0x5c], 0x494c
mov byte [ebp - 0x58], 0x50
mov dword [ebp - 0x66], 0x54502044
mov dword [ebp - 0x6c], 0x41564e49
mov word [ebp - 0x68], 0x494c
mov word [ebp - 0x62], 0x52
mov dword [ebp - 0x36], 0x727470
mov word [ebp - 0x3b], 0x6f77
mov word [ebp - 0x38], 0x2064
mov byte [ebp - 0x3c], 0x6f
mov byte [ebp - 0x39], 0x72
cmp eax, 8
ja case.default.0x10004461
jmp dword [eax*4 + 0x100044a8]
lea eax, [ebp - 0xc]
jmp 0x10004493
lea eax, [ebp - 0x18]
jmp 0x10004493
lea eax, [ebp - 0x24]
jmp 0x10004493
lea eax, [ebp - 0x48]
jmp 0x10004493
lea eax, [ebp - 0x30]
jmp 0x10004493
lea eax, [ebp - 0x54]
jmp 0x10004493
lea eax, [ebp - 0x60]
jmp 0x10004493
lea eax, [ebp - 0x6c]
jmp 0x10004493
lea eax, [ebp - 0x3c]
push eax
push 0x104
push dword [ebp + 0xc]
call fcn.1000eb53
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x100044d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov word [ebp - 3], 0x73
mov byte [ebp - 4], 0x65
mov word [ebp - 8], 0x7363
mov byte [ebp - 6], 0
mov word [ebp - 0xc], 0x7373
mov byte [ebp - 0xa], 0
mov word [ebp - 0x10], 0x7364
mov byte [ebp - 0xe], 0
mov word [ebp - 0x13], 0x73
mov byte [ebp - 0x14], 0x66
mov word [ebp - 0x17], 0x73
mov byte [ebp - 0x18], 0x67
mov word [ebp - 0x1d], 0x524f
mov word [ebp - 0x20], 0x5245
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1b], 0
mov dword [ebp - 0x26], 0x524f52
mov word [ebp - 0x28], 0x5245
cmp eax, 7
ja case.default.0x1000453b
jmp dword [eax*4 + 0x10004580]
lea eax, [ebp - 4]
jmp 0x10004568
lea eax, [ebp - 8]
jmp 0x10004568
lea eax, [ebp - 0xc]
jmp 0x10004568
lea eax, [ebp - 0x10]
jmp 0x10004568
lea eax, [ebp - 0x14]
jmp 0x10004568
lea eax, [ebp - 0x18]
jmp 0x10004568
lea eax, [ebp - 0x20]
jmp 0x10004568
lea eax, [ebp - 0x28]
push eax
push 0x104
push dword [ebp + 0xc]
call fcn.1000eb53
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1000a060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x506c6175
push eax
mov dword [ebp - 0x14], 0x74726956
mov dword [ebp - 0xb], 0x6365746f
mov byte [ebp - 0xc], 0x72
mov dword [ebp - 7], 0x784574
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a0af
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov word [ebp - 0x10], 0x6956
push eax
mov dword [ebp - 0xd], 0x6c617574
mov dword [ebp - 7], 0x797265
mov word [ebp - 9], 0x7551
mov byte [ebp - 0xe], 0x72
call fcn.10009580
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000a107
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.100095f0
test eax, eax
je 0x1000a1e1
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xa], 0x57657669
push ecx
push eax
mov dword [ebp - 0x10], 0x41746553
mov dword [ebp - 5], 0x776f646e
mov word [ebp - 0xc], 0x7463
mov byte [ebp - 6], 0x69
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a1f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.100095f0
test eax, eax
je 0x1000a236
lea ecx, [ebp - 0x14]
mov dword [ebp - 6], 0x6f646e69
push ecx
push eax
mov dword [ebp - 0x14], 0x46746553
mov word [ebp - 2], 0x77
mov dword [ebp - 0xc], 0x6e756f72
mov dword [ebp - 0x10], 0x6765726f
mov word [ebp - 8], 0x5764
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.100095f0
test eax, eax
je 0x1000a283
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xb], 0x776f646e
push ecx
push eax
mov word [ebp - 0x10], 0x6553
mov word [ebp - 6], 0x736f
mov word [ebp - 0xd], 0x6957
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 4], 0
mov byte [ebp - 7], 0x50
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1001b6d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.100095f0
test eax, eax
je 0x1001b713
lea ecx, [ebp - 0x14]
mov word [ebp - 0xb], 0x776f
push ecx
push eax
mov dword [ebp - 0x10], 0x6e695767
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 9], 0x6f546f54
mov word [ebp - 5], 0x70
mov byte [ebp - 0xc], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1001b720
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x114
cmp eax, 1
jne 0x1001b7e5
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call fcn.10009990
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x70707573
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0xd], 0x746e6174
push eax
mov dword [ebp - 4], 0x74726f
mov byte [ebp - 9], 0x20
mov word [ebp - 0x10], 0x6e69
mov byte [ebp - 0xe], 0x73
call fcn.10009e60
add esp, 0x14
test eax, eax
jne 0x1001b814
push sym.drvhlp.dll_xage11
push 0x1004a080
call fcn.1000a4d0
add esp, 8
test eax, eax
je 0x1001b814
push sym.drvhlp.dll_ds05wd
push 0x1004a03c
call fcn.1000a4d0
add esp, 8
test eax, eax
je 0x1001b814
push sym.drvhlp.dll_i82uq5
push 0x1004a05c
call fcn.1000a4d0
add esp, 8
test eax, eax
je 0x1001b814
push sym.drvhlp.dll_fz6ywr
push 0x1004a058
call fcn.1000a4d0
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1001b814
push 0x1004a080
call fcn.1001bb60
push 0x1004a03c
call fcn.1001bb60
push 0x1004a05c
call fcn.1001bb60
push 0x1004a058
call fcn.1001bb60
add esp, 0x10
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1001bd80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 0x104
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x10], 0
push 0
push eax
call fcn.1000c1a0
lea eax, [ebp - 0x28]
mov word [ebp - 2], 0x73
push eax
mov dword [ebp - 0xb], 0x5754464f
mov dword [ebp - 7], 0x5c455241
mov byte [ebp - 3], 0x25
mov byte [ebp - 0xc], 0x53
call fcn.1000aab0
add esp, 0x10
mov ecx, eax
call fcn.1000b0e0
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x12c]
push 0x104
push eax
call fcn.1000b270
add esp, 0x14
lea ecx, [ebp - 0x28]
call fcn.1000aa90
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x12c]
push eax
call fcn.1000aa60
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0xd70ff8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xd71002
pushal
call 0xd71008
pop ebp
sub ebp, 0x10
sub ebp, 0x970ff8
jmp 0xd7101e
mov eax, 0x970ff8
add eax, ebp
add eax, 0x4c
mov ecx, 0x578
mov edx, 0x793f36a6
xor byte [eax], dl
inc eax
dec ecx
jne 0xd71035
jmp 0xd71048
sub eax, 0x9a2f2d6b
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
daa
pop esi
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
movsd dword es:[edi], dword [esi]
imul ebx, dword [esi], 0xffffffa0
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
sbb al, 0x8e
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
push ecx
inc esp
movsd dword es:[edi], dword [esi]
outsb dx, byte [esi]
sub eax, 0xa6a6aa27
cmpsb byte [esi], byte es:[edi]
movsd dword es:[edi], dword [esi]
arpl si, si
test dh, 0x52
stosd dword es:[edi], eax
xchg byte [esi - 0x2e5b5d32], ah
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
mov al, byte [edx + 0x75a2d5ce]
sbb dword [esi - 0x5d], ecx
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
dec edi
mov fs, word [esi - 0xd0c595a]
sti
sub eax, 0xa6a6ae23
cmpsb byte [esi], byte es:[edi]
sub eax, 0xa6a6aa33
cmpsb byte [esi], byte es:[edi]
sub eax, 0xa6a6b62b
cmpsb byte [esi], byte es:[edi]
dec edi
movsb byte es:[edi], byte [esi]
xchg edi, eax
movsb byte es:[edi], byte [esi]
and eax, 0xa9efa264
and edx, dword [edx + 0x59]
pop ecx
pop ecx
sti
stosb byte es:[edi], al
cmpsb byte [esi], byte es:[edi]
sub eax, 0xa6a2822a
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
into
push edx
stosd dword es:[edi], eax
xchg byte [esi - 0x2e5b5d32], ah
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
mov al, byte [edx - 0x595cb109]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
dec edi
xchg ebp, eax
movsb byte es:[edi], byte [esi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
sub eax, 0xaad3594a
pop ecx
shr dword [esi - 0x59593fb2], cl
cmpsb byte [esi], byte es:[edi]
sub eax, 0xa6a6ae1b
cmpsb byte [esi], byte es:[edi]
xchg ebp, eax
outsd dx, dword [esi]
xchg ebp, eax
je 0xd71111
dec esi
mov dword [0xe822a9ee], eax
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
test eax, 0xa6a6ee2e
cmpsb byte [esi], byte es:[edi]
shr byte [0x5d269fba], 0x4e
test eax, 0xa6a6bc22
cmpsb byte [esi], byte es:[edi]
pop ebp
dec edi
test eax, 0xa6a6b722
cmpsb byte [esi], byte es:[edi]
shl byte [edi], 0x5d
pop ecx
sub dword [ecx - 0x59594cde], 0xffffffa6
out 0x4f, eax
push 0x59
pop ecx
pop ecx
invalid
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x414d3e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x414d4d
pop dword [ebp - 0x38]
mov eax, 0x6d3b83cd
sub eax, 0x6cfa3680
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x70128a3e
add dword [ebp - 0x48], 0xde3fbb0d
mov dword [ebp - 0x44], 0xfd2772cb
sub dword [ebp - 0x44], 0xcaf42686
mov dword [ebp - 0x40], 0xea9d5d9e
sub dword [ebp - 0x40], 0x9e511970
mov dword [ebp - 0x3c], 0xaac14f38
sub dword [ebp - 0x3c], 0xaac14f38
lea eax, [ebp - 0x48]
push eax
mov eax, 0x377d670d
sub eax, 0x373b3699
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x72a4dac9
add dword [ebp - 0x48], 0x1cd8e8d
mov dword [ebp - 0x44], 0xb0d3fe45
add dword [ebp - 0x44], 0x90986330
mov dword [ebp - 0x40], 0xb3395fd3
add dword [ebp - 0x40], 0xb0360c99
mov dword [ebp - 0x3c], 0xe9570478
add dword [ebp - 0x3c], 0x16a8fb88
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3a1aa
push 0
call eax
mov ecx, 0xe3e8285f
sub ecx, 0xe3e7eef6
mov esi, eax
mov edx, 0x70731f
add edx, 0xffd2d0e1
add edx, dword [ebp - 0x38]
mov edi, 0x1138c27e
sub edi, 0xd127187b
mov ebx, dword [edx]
xor dword [ebp - 0x28], 0xf0171cc2
add ebx, edi
add dword [ebp - 0x34], ecx
mov dword [esi], ebx
xor dword [ebp - 0xc], 0x7b19473c
add esi, 0x2ffe8edf
add esi, 0xd0017125
add edx, 0x3349c0c1
add edx, 0xccb63f43
loop 0x414e6a
add eax, 0x3b9a6344
sub eax, 0x3b998acd
xor ebx, ebx
add ebx, eax
add eax, 0xd970fd7c
sub eax, 0xd970fd77
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x10003c10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, 0x1004e92b
call fcn.1003b167
mov eax, dword [ebp + 0x10]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp + 8]
call fcn.10003b20
mov ecx, eax
call fcn.10003b90
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003c51
mov dword [ebp - 4], 1
jmp 0x10003c58
mov dword [ebp - 4], 0
movzx eax, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10004990
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1004a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x1004e22b
call fcn.1003b167
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0xc]
push eax
push 0x90
mov ecx, dword [ebp + 8]
push ecx
call fcn.10021ab0
add esp, 0xc
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001da46
mov esp, ebp
pop ebp
ret

Function at 0x10006e50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1004a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x1004e22b
call fcn.1003b167
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100214a0
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001da46
mov esp, ebp
pop ebp
ret
Function at 0x1000cfb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, 0x1004e453
call fcn.1003b167
mov eax, dword [0x1004d4dc]
mov dword [ebp - 4], eax
jmp 0x1000cfd2
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1000cfe8
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1000cfe6
mov eax, dword [ebp - 4]
jmp 0x1000d063
jmp 0x1000cfca
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000d060
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x1000d022
mov edx, dword [ebp - 4]
mov eax, dword [0x1004d4dc]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1004d4dc], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1000e140
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1004a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x1004e453
call fcn.1003b167
mov dword [ebp - 0x24], 0
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x1000e2e8
mov dword [ebp - 0x20], 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1000e2de
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x20], 0x10
jb 0x1000e27e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1000e27e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1000e27e
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x1000e209
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
push edx
push 0
mov eax, dword [0x1004d14c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x1000e207
mov dword [ebp - 0x24], 0
jmp 0x1000e29b
jmp 0x1000e25e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x1000e25e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x1004d14c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x1000e256
mov dword [ebp - 0x24], 0
jmp 0x1000e29b
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x20], 0x1c
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1000e19c
cmp dword [ebp - 0x24], 0
je 0x1000e2b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1000e2b3
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0
jne 0x1000e2de
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1000e2de
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x1004d14c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001da46
mov esp, ebp
pop ebp
ret