joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010700
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10052040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x100528f0]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x3e18]
mov eax, dword [edi + 0xc8]
mov ebx, dword [edi + 0xd0]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10049288]
sub esi, 1
jne 0x10010740
mov eax, dword [0x100528f0]
not ebx
cmp dword [eax + 0x3e38], ebx
jne 0x1001077a
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.100176b0
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xc8]
call fcn.10017ce0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100446c0
mov esp, ebp
pop ebp
ret

Function at 0x10016440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x5254], 0
lea esi, [edi + 0x5258]
je 0x100164c2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1001647c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.10018400
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.10003ed0
mov edx, dword [esi]
mov ecx, 0x100528ec
push dword [edi + 0x5254]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x5260]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.10003ed0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10016980
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x100528f0]
test bl, bl
je 0x100169c6
or edi, 0xffffffff
cmp bl, 0x23
jne 0x100169a7
cmp byte [esi], bl
jne 0x100169a7
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x10049288]
test bl, bl
jne 0x10016998
mov edi, dword [0x100528f0]
mov esi, dword [edi + 0x5218]
xor ecx, ecx
not eax
test esi, esi
jle 0x100169ec
mov edi, dword [edi + 0x5220]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x100169f2
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x100169e0
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x10020090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100200ca
mov eax, dword [0x100528f0]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x100200bd
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100200fb
mov eax, dword [0x100528f0]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x100200ee
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1002012c
mov eax, dword [0x100528f0]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x1002011f
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10020179
mov eax, dword [0x100528f0]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x1002016c
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x100201aa
mov eax, dword [0x100528f0]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x1002019d
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x100201db
mov eax, dword [0x100528f0]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x100201ce
dec dword [eax + 0xb0]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100228d0
Function at 0x100278c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x10052040]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [0x100528f0]
mov dword [esp + 0x28], ebx
push esi
push edi
test ebx, ebx
je 0x100278ea
mov esi, dword [ebx + 0x78]
jmp 0x100278ec
xor esi, esi
mov ecx, dword [ebx + 0x48]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], esi
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.10022fa0
mov eax, dword [ebx + 0x48]
mov ebx, dword [esp + 0x20]
cmp byte [eax + 0x12], 0
je 0x10027995
mov eax, ebx
imul eax, dword [esp + 0x10]
mov ecx, eax
mov dword [esp + 0x1c], eax
imul ecx, dword [esp + 0x28]
mov eax, dword [0x100528f0]
test eax, eax
je 0x1002793a
inc dword [eax + 0xb0]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
mov eax, dword [esp + 0x1c]
mov esi, edi
mov dword [esp + 0x18], edi
lea eax, [edi + eax*4]
mov dword [esp + 0x2c], eax
cmp edi, eax
jae 0x1002799d
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
sub eax, edi
mov edi, eax
mov edx, dword [edi + esi]
mov eax, edx
shr eax, 0x10
movzx ecx, al
movzx eax, dl
and edx, 0xff00ff00
shl eax, 0x10
or ecx, eax
or ecx, edx
mov dword [esi], ecx
add esi, 4
cmp esi, ebx
jb 0x10027967
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
jmp 0x1002799d
mov edi, dword [esp + 0x24]
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x14]
push 0
lea esi, [eax + 0xc]
mov dword [esi], 0
mov ecx, dword [eax]
push esi
push 0
push 0x15
mov eax, dword [ecx]
push 0x200
push 1
push dword [esp + 0x28]
push ebx
push ecx
call dword [eax + 0x5c]
test eax, eax
js 0x10027a6f
mov ecx, dword [esi]
lea edx, [esp + 0x34]
push 0
push 0
push edx
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x4c]
test eax, eax
jne 0x10027a6f
xor esi, esi
cmp dword [esp + 0x10], esi
jle 0x10027a14
imul ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
imul eax, esi
push ebx
push edi
add eax, dword [esp + 0x40]
push eax
call sub.VCRUNTIME140.dll_memcpy
inc esi
add esp, 0xc
add edi, ebx
cmp esi, dword [esp + 0x10]
jl 0x100279f5
mov esi, dword [esp + 0x14]
push 0
mov eax, dword [esi + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, dword [esp + 0x30]
mov eax, dword [esi + 0xc]
mov ecx, dword [edx + 0x48]
mov dword [ecx + 4], eax
mov eax, dword [edx + 0x48]
cmp byte [eax + 0x12], 0
je 0x10027a5b
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10027a51
mov ecx, dword [0x100528f0]
test ecx, ecx
je 0x10027a51
dec dword [ecx + 0xb0]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100446c0
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x3c]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100446c0
mov esp, ebp
pop ebp
ret
Function at 0x10037290
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10052040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x28], edx
push edi
xor ebx, ebx
push ebx
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10037418
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x100373a7
mov ebx, 1
cmp dword [ebp - 0x20], 0x10
jb 0x1003736a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1003736a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1003736a
mov edx, dword [esi]
test edx, edx
jne 0x10037336
push 0x200
push edx
push dword [0x100528fc]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1003738f
jmp 0x1003735e
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1003735e
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x100528fc]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1003738f
mov dword [esi], edx
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100372f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x100373a7
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x100373a7
push eax
push ebx
push dword [0x100528fc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x10037418
cmp dword [esi], 0
je 0x10037405
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x10037405
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [esi]
push dword [eax + ecx]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x100373f6
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x28]
mov ecx, edi
call fcn.10037120
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x24]
inc ebx
add ecx, 4
mov dword [ebp - 0x24], ecx
cmp ebx, dword [esi + 8]
jb 0x100373c3
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100446c0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 9
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100446c0
mov esp, ebp
pop ebp
ret
Function at 0x10037430
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x10037494
push ebx
xor ebx, ebx
cmp dword [edi + 8], ebx
jbe 0x10037483
xor ecx, ecx
mov dword [ebp - 4], ecx
push esi
nop word [eax + eax]
mov eax, dword [edi]
push dword [eax + ecx]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x10037473
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
inc ebx
add ecx, 4
mov dword [ebp - 4], ecx
cmp ebx, dword [edi + 8]
jb 0x10037450
pop esi
push dword [edi]
push 0
push dword [0x100528fc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100374a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10052040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x10052e30]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp - 8]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100374fc
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100446c0
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10037517
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100446c0
mov esp, ebp
pop ebp
ret
Function at 0x10038260
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1003841d
sub eax, 1
jne 0x10038480
mov eax, dword [ebp + 8]
push esi
push str.send
push str.ws2_32.dll
mov dword [0x1005292c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.recv
push str.ws2_32.dll
mov dword [0x10052908], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
cmp dword [0x10052908], 0
mov dword [0x10052904], eax
je 0x100382fa
test eax, eax
je 0x100382fa
call fcn.10043500
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.100439e0
push 0x10037ff0
push 0x10052908
call fcn.10042da0
push 0x10038030
push 0x10052904
call fcn.10042da0
call fcn.10043560
jmp 0x1003830e
push 0x10
push str.Error
push str.Failed_to_get_the_address_of_send_or_recv
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x100380d0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10039370
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10039560
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10039820
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10039900
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10038ee0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10039cf0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1003a2d0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x10039a00
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1003a4b0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1003a870
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1003cc90
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1003ac40
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1003aec0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1003d010
push 0
push 0
call esi
pop esi
mov eax, 1
pop ebp
ret 0xc
cmp dword [0x10052908], 0
jne 0x1003842f
cmp dword [0x10052904], 0
je 0x10038480
call fcn.10043500
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.100439e0
push 0x10037ff0
push 0x10052908
call fcn.10043210
push 0x10038030
push 0x10052904
call fcn.10043210
call fcn.10043560
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._Unhook__Successfully_unhooked_send_and_recv_
call fcn.10038660
push 0x10038840
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, 1
pop ebp
ret 0xc
Function at 0x10038d00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10052040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.xx_xx_xx
mov edx, 0x1005232c
call fcn.10038b60
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
lea ecx, [esi + 6]
push esi
mov dword [0x1005297c], ecx
call edi
mov eax, 0x10038c30
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
mov byte [esi + 5], 0x90
push dword [ebp - 8]
push 6
push esi
call edi
push str.xx____xxx____xxx____xxx____xxx____xxx____xxxx
mov edx, 0x100522bc
call fcn.10038b60
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
lea ecx, [esi + 6]
push esi
mov dword [0x10052a80], ecx
call edi
mov eax, 0x10038c50
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
mov byte [esi + 5], 0x90
push dword [ebp - 8]
push 6
push esi
call edi
push str.xx____xxx
mov edx, 0x10052338
call fcn.10038b60
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
lea ecx, [esi + 6]
push esi
mov dword [0x10052af0], ecx
call edi
mov eax, 0x10038c70
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
mov byte [esi + 5], 0x90
push dword [ebp - 8]
push 6
push esi
call edi
push str.xxxxxx
mov edx, 0x100522ec
call fcn.10038b60
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 6
lea ecx, [esi + 6]
push esi
mov dword [0x100529d8], ecx
call edi
mov eax, 0x10038c90
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
mov byte [esi + 5], 0x90
push dword [ebp - 8]
push 6
push esi
call edi
push str.xxxxx__x_xxxxxx_xx
mov edx, 0x10052384
call fcn.10038b60
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 7
lea ecx, [esi + 7]
push esi
mov dword [0x10052ab0], ecx
call edi
mov eax, 0x10038cb0
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
mov eax, 0x90909090
mov word [esi + 5], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 7
push esi
call edi
push str.xxxx_xx____xx
mov edx, 0x1005231c
call fcn.10038b60
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
lea ecx, [esi + 5]
push esi
mov dword [0x10052dd8], ecx
call edi
mov eax, 0x10038cd0
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 5
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100446c0
mov esp, ebp
pop ebp
ret
Function at 0x1003cb10
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x10052040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10052990]
push ebx
push esi
push edi
push eax
push 0
push 0x10
mov dword [0x10052a2c], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [0x10052a2c]
mov dword [0x10052960], eax
xor edi, edi
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x220
mov esi, eax
lea eax, [ebp - 0x234]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x238], 0x224
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1003cbbf
mov ebx, dword [sym.imp.KERNEL32.dll_Module32Next]
nop dword [eax]
lea eax, [ebp - 0x218]
push str.game.exe
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
add esp, 8
test eax, eax
je 0x1003cbb9
lea eax, [ebp - 0x238]
push eax
push esi
call ebx
test eax, eax
jne 0x1003cb90
jmp 0x1003cbbf
mov edi, dword [ebp - 0x224]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x10052df4], edi
test edi, edi
jne 0x1003cbe4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100446c0
mov esp, ebp
pop ebp
ret
mov eax, dword [0x10052c74]
lea esi, [edi + 0x1ec9180]
sub eax, dword [0x10052c70]
xor edi, edi
mov ecx, dword [0x10052960]
sar eax, 2
mov dword [ebp - 0x23c], ecx
test eax, eax
je 0x1003cc6d
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push esi
push ecx
call ebx
test eax, eax
je 0x1003cc45
mov ecx, dword [0x10052c70]
mov eax, dword [0x10052c74]
sub eax, ecx
sar eax, 2
mov esi, dword [ecx + edi*4]
inc edi
add esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x23c]
cmp edi, eax
jb 0x1003cc10
jmp 0x1003cc6d
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_read_memory_at_address:
call fcn.10038660
push esi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push 0x10038840
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
xor esi, esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
mov dword [0x10052df8], esi
xor ecx, ebp
pop esi
pop ebx
call fcn.100446c0
mov esp, ebp
pop ebp
ret
Function at 0x10041c40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10041df0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10041d0d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10041c8a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10052004]
ja 0x10041c8a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10041c5a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10041cb0
jmp 0x10041d0d
cmp dword [ebp - 0x14], 0x10000
jne 0x10041cf3
cmp dword [ebp - 0x18], 0x10000
jb 0x10041cf3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10041ce6
mov eax, dword [ebp - 8]
jmp 0x10041d0f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10041d08
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10041df0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10041c5a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10041d20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10041e20
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10041de5
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10041d65
mov eax, dword [ebp - 4]
cmp eax, dword [0x10052004]
ja 0x10041d65
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10041d35
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10041d8b
jmp 0x10041de5
cmp dword [ebp - 0x14], 0x10000
jne 0x10041dce
cmp dword [ebp - 0x18], 0x10000
jb 0x10041dce
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10041dc1
mov eax, dword [ebp - 8]
jmp 0x10041de7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10041de0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10041e20
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10041d35
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x433001
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x60746362
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x303b019c
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219