joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411539
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x42c668
call fcn.00411d81
push 1
call fcn.00411884
pop ecx
test al, al
jne 0x411558
push 7
call fcn.00411b88
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041184f
mov byte [ebp - 0x24], al
mov eax, dword [0x42ed34]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x411551
test eax, eax
jne 0x4115c2
mov dword [0x42ed34], ecx
push 0x4252c0
push 0x4252a4
call fcn.0041a3ca
pop ecx
pop ecx
test eax, eax
je 0x4115a5
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4116a9
push 0x4252a0
push 0x425298
call fcn.0041a36e
pop ecx
pop ecx
mov dword [0x42ed34], 2
jmp 0x4115c7
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004119e1
pop ecx
call fcn.00411b7c
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4115f7
push esi
call fcn.00411954
pop ecx
test al, al
je 0x4115f7
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00411d7b
call esi
call fcn.00411b82
mov esi, eax
cmp dword [esi], edi
je 0x411615
push esi
call fcn.00411954
pop ecx
test al, al
je 0x411615
push dword [esi]
call fcn.0041a68c
pop ecx
push edi
call fcn.00414a0f
pop ecx
call fcn.00411c9d
movzx eax, ax
push eax
call fcn.0041a31b
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call fcn.00414aab
pop ecx
call fcn.0041a59b
test al, al
jne 0x41164e
push esi
call fcn.0041a6c4
test bl, bl
jne 0x411657
call fcn.0041a667
push edi
push 1
call fcn.004119fe
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4116a9
call fcn.00411dc7
ret
call fcn.005a1000
jmp 0x411539
Function at 0x4a91d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x69000]
push edi
or ebp, 0xffffffff
jmp 0x4a91f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a91f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a91e8
mov eax, 1
add ebx, ebx
jne 0x4a920b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a921c
jne 0x4a923b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a923b
dec eax
add ebx, ebx
jne 0x4a9228
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a9200
add ebx, ebx
jne 0x4a9237
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a928d
xor ecx, ecx
sub eax, 3
jb 0x4a9253
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a92c2
sar eax, 1
mov ebp, eax
jmp 0x4a925e
add ebx, ebx
jne 0x4a925e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a922c
inc ecx
add ebx, ebx
jne 0x4a926c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a922c
add ebx, ebx
jne 0x4a9279
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a926e
jne 0x4a928a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a926e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a92ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a929e
jmp 0x4a91ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a92ac
add edi, ecx
jmp 0x4a91ee
pop esi
mov edi, esi
mov ecx, 0x3493
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a92ca
cmp byte [edi], 0x4c
jne 0x4a92ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a92cf
lea edi, [esi + 0xa5000]
mov eax, dword [edi]
or eax, eax
je 0x4a9347
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xaa030]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xaa184]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a92fc
mov ecx, edi
jns 0x4a932b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xaa188]
or eax, eax
je 0x4a9341
mov dword [ebx], eax
add ebx, 4
jmp 0x4a9319
call dword [esi + 0xaa198]
mov ebp, dword [esi + 0xaa18c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a937b
sub esp, 0xffffff80
jmp 0x417770
Function at 0x80b4a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x80b4c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x80b4c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x80b4b8
mov eax, 1
add ebx, ebx
jne 0x80b4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x80b4d0
jne 0x80b4ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80b4d0
xor ecx, ecx
sub eax, 3
jb 0x80b500
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x80b572
mov ebp, eax
add ebx, ebx
jne 0x80b50b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x80b518
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x80b53c
inc ecx
add ebx, ebx
jne 0x80b528
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x80b51d
jne 0x80b539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x80b51d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x80b55c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x80b54d
jmp 0x80b4be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x80b55c
add edi, ecx
jmp 0x80b4be
pop esi
mov edi, esi
mov ecx, 0x147
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x80b57a
cmp byte [edi], 1
jne 0x80b57a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x80b57f
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x80b5f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb514]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb58c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x80b5ac
mov ecx, edi
jns 0x80b5db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb590]
or eax, eax
je 0x80b5f1
mov dword [ebx], eax
add ebx, 4
jmp 0x80b5c9
call dword [esi + 0xb594]
popal
jmp 0x802d68

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x10008350
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x1014f594], 0x83f
lea eax, [fcn.10008350]
mov dword [ebp - 8], eax
mov dword [0x1014f594], 0x19e4
jmp 0x10008391
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov dword [0x1014f598], 0x773
jmp 0x100083ac
mov eax, dword [ebp - 8]
mov cx, word [eax]
mov word [ebp - 0xa], cx
mov ax, word [ebp - 0xa]
movzx ecx, ax
cmp ecx, 0x5a4d
je 0x100083b4
jmp 0x10008375
mov al, 1
test al, 1
jne 0x10008391
jmp 0x100083d6
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax], 0x4550
jne 0x100083d4
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x100083e7
jmp 0x10008375
mov dword [0x1014f594], 0x24f
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 0x10
pop ebp
ret
Function at 0x100083f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x1014f598], 0x3cb
mov dword [ebp - 8], 0
mov dword [0x1014f598], 0x4f5
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [0x1014f594], 0x650
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x100084b3
mov dword [0x1014f594], 0xe50
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x64
je 0x10008523
jmp 0x100084b1
jmp 0x100084b1
jmp 0x10008581
mov eax, dword [0x1014f598]
add eax, 0x20dc
mov dword [0x1014f594], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
je 0x1000843c
jmp 0x10008466
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
je 0x1000846b
jmp 0x10008581
mov dword [ebp - 4], 1
jmp 0x10008596
jmp 0x10008466
cmp dword [ebp - 0x10], 0x104
jge 0x100084f5
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
sete dl
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x15]
test al, 1
jne 0x100084da
jmp 0x100084dc
jmp 0x100084f5
mov dword [0x1014f598], 0xab6
jmp 0x100084e8
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x100084b3
mov eax, dword [0x1014f598]
sub eax, 0x21b9
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x1014f598], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
movzx ecx, word [ecx + edx*2 - 0x1a]
cmp ecx, 0x6c
je 0x1000848e
jmp 0x10008583
mov eax, dword [0x1014f594]
add eax, 0x5c9
mov dword [0x1014f594], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x10008464
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + eax*2 - 0x10]
cmp eax, 0x6c
jne 0x1000857c
mov dword [0x1014f598], 0x7a0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
je 0x100084a5
jmp 0x1000857c
jmp 0x10008464
jmp 0x10008583
mov dword [0x1014f598], 0x1280
mov dword [ebp - 4], 0
jmp 0x10008596
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ed0
nop
mov ecx, 0x6ae2520e
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x7c527fa4
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10191230
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov ecx, 0x1039e310
call fcn.100eb340
nop
mov eax, dword [0x103725c8]
mov dword [ebp - 4], eax
jmp 0x10191256
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x1019126c
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1019126a
mov eax, dword [ebp - 4]
jmp 0x101912e6
jmp 0x1019124e
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x101912e3
mov eax, dword [ebp - 4]
add eax, 0x20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 4]
cmp eax, 0xfe0
jbe 0x101912a6
mov eax, dword [ebp - 4]
mov ecx, dword [0x103725c8]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov dword [0x103725c8], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10192830
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x102ef2c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x1039e498
call fcn.100eb340
nop
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x103725d4]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 5
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1019288c
mov eax, dword [ebp - 0x14]
sub eax, 5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x101928ae
mov eax, 0xa
jmp 0x10192997
cmp dword [ebp + 0xc], 0
je 0x101928fb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x14]
add eax, 5
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
sub edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 1], edx
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x101928f9
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xeb
mov eax, dword [ebp - 0x1c]
mov byte [eax + 1], 0xf9
jmp 0x10192937
mov eax, dword [ebp - 8]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10192922
push 7
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100eac97
add esp, 0xc
jmp 0x10192937
push 5
mov eax, dword [ebp - 8]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100eac97
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
nop
mov al, byte [ebp + 0xc]
and al, 1
shl al, 1
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 0x14]
and dl, 0xfd
or dl, al
mov eax, dword [ebp - 8]
mov byte [eax + 0x14], dl
mov al, byte [ebp + 0xc]
and al, 1
shl al, 2
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 0x14]
and dl, 0xfb
or dl, al
mov eax, dword [ebp - 8]
mov byte [eax + 0x14], dl
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e6746
mov esp, ebp
pop ebp
ret
Function at 0x10192a90
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x102ef2c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x1039e498
call fcn.100eb340
nop
mov dword [ebp - 8], 0
push 0
push 4
call fcn.100e639f
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x10192c3d
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100e5cb0
test eax, eax
je 0x10192c32
mov dword [ebp - 8], 1
cmp dword [ebp - 0x28], 0x10
jb 0x10192bd1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x1c], eax
jne 0x10192bd1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x20], eax
je 0x10192bd1
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10192b5c
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
push ecx
push 0
mov edx, dword [0x103725d0]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10192b5a
mov dword [ebp - 8], 0
jmp 0x10192bed
jmp 0x10192bb1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x10192bb1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x103725d0]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x10192ba9
mov dword [ebp - 8], 0
jmp 0x10192bed
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov edx, dword [ebp - 0x20]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 8], ecx
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100e33b6
test eax, eax
jne 0x10192aee
cmp dword [ebp - 8], 0
je 0x10192c05
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x10192c05
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0
jne 0x10192c32
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10192c32
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x103725d0]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e6746
mov esp, ebp
pop ebp
ret
Function at 0x10192e70
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov ecx, 0x1039e498
call fcn.100eb340
nop
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10192a90
add esp, 4
test eax, eax
jne 0x10192ec1
mov dword [ebp - 4], 9
jmp 0x10192f31
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10192f31
mov dword [ebp - 8], 0
jmp 0x10192edb
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10192f31
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10192f2f
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
nop
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10192fa0
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x10192ed2
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101932c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov ecx, 0x1039e498
call fcn.100eb340
nop
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10193346
mov dword [ebp - 4], 0
jmp 0x101932ee
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x10193330
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1019332e
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x101932e5
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x103725d0]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
nop
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101942e0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov ecx, 0x1039e56c
call fcn.100eb340
nop
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10194337
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x90
je 0x10194337
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0xcc
je 0x10194337
xor eax, eax
jmp 0x10194378
mov dword [ebp - 4], 1
jmp 0x10194349
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x10194373
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
mov edx, 1
imul eax, edx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
cmp ecx, eax
je 0x10194371
xor eax, eax
jmp 0x10194378
jmp 0x10194340
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a4e3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001a522
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001a522
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001a522
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001a522
cmp dword [ecx + 0x74], 0xe
jbe 0x1001a522
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret