joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b1fc
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x100548b0
call fcn.100269ae
mov ebx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], edx
mov edi, ebx
mov dword [ebp - 0x20], edx
xor eax, eax
xor ecx, ecx
inc ecx
mov esi, edx
mov dword [ebp - 4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
xor eax, eax
mov dword [ebp - 0x38], ecx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x21]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 0x21], dl
call fcn.10025490
lea eax, [ebp - 0x1c]
push eax
push esi
lea ecx, [ebp + 0xc]
call fcn.100242fc
push ecx
mov ecx, esp
push eax
call fcn.100186e2
call fcn.1001b758
mov edx, dword [ebp - 0x1c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x28], eax
je 0x1001b2d3
and dword [ebp - 0x30], esi
lea eax, [ecx - 4]
mov byte [ebp - 0x20], 0
push dword [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.10017c31
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.1001858c
push ecx
lea eax, [ebp - 0x34]
mov ecx, esp
push eax
call fcn.100187b4
call fcn.1001ad42
mov edx, dword [ebp - 0x1c]
add esp, 0xc
add eax, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x28]
xor edi, edi
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
je 0x1001b30b
mov al, byte [edx + edi]
mov ecx, ebx
xor al, byte [esi + str.DUYQWJPUCTNTXTCJVGVAPLABEMXWNM]
cbw
movzx eax, ax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.10025589
mov edx, dword [ebp - 0x1c]
inc esi
xor eax, eax
cmp esi, 0x1e
cmovge esi, eax
inc edi
cmp edi, dword [ebp - 0x28]
jb 0x1001b2dd
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.10025589
lea ecx, [ebp - 0x34]
call fcn.10024142
lea ecx, [ebp - 0x1c]
call fcn.10024142
lea ecx, [ebp + 0xc]
call fcn.10024142
mov eax, ebx
call fcn.10026958
ret
Function at 0x1001b6a7
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0xc
mov eax, 0x100548dd
call fcn.100269ae
mov dword [ebp - 0x18], ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov esi, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
xor edx, edx
push edx
push edx
push ecx
push edx
push 1
push dword [eax - 0xc]
mov dword [ebp - 4], edx
push eax
call esi
test eax, eax
je 0x1001b711
push dword [ebp - 0x14]
call fcn.100263b8
push dword [ebp - 0x14]
mov ebx, eax
push 0
push ebx
call fcn.100292a0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
add esp, 0x10
push 0
push 0
push eax
push ebx
push 1
push dword [ecx - 0xc]
push ecx
call esi
test eax, eax
jne 0x1001b722
push ebx
call fcn.100263c1
pop ecx
mov ecx, edi
call fcn.1001b3f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1001b743
mov ecx, dword [ebp - 0x18]
push edi
push dword [ebp - 0x14]
push ebx
call fcn.1001b7e6
mov esi, eax
test esi, esi
je 0x1001b73c
mov ecx, edi
call fcn.1001b3f2
push ebx
call fcn.100263c1
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1001ee1f
mov eax, esi
call fcn.10026958
ret 8

Function at 0x1001b758
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0xc
mov eax, 0x100548dd
call fcn.100269ae
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax - 0xc], ebx
je 0x1001b7d3
push ebx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push ebx
push 1
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x1001b795
mov eax, dword [esi]
mov dword [esi + 4], eax
jmp 0x1001b7cb
push dword [ebp - 0x14]
mov ecx, esi
call fcn.100255e0
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push ebx
push ebx
mov esi, dword [edi - 0xc]
push eax
push ebx
call fcn.100242fc
push eax
push 1
push esi
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x1001b7d3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1001ee1f
mov eax, ebx
call fcn.10026958
ret
Function at 0x1001b7e6
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push 0x114
mov eax, 0x1005490d
call fcn.100269ae
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [edi + 1]
mov dword [ebp - 0x14], edi
push eax
call fcn.100263b8
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push 0
push eax
call fcn.100292a0
push edi
push esi
push dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
push esi
call fcn.10025980
add esp, 0x20
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 1
push 0
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x1001b860
push esi
call fcn.100263c1
pop ecx
mov ecx, dword [ebp - 0x18]
call fcn.1001b3f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001b8c6
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x120]
push 0xfde9
push esi
mov byte [esi + eax], 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], eax
call fcn.1001d64f
push dword [ebp - 0x120]
and dword [ebp - 4], 0
call fcn.10020d47
pop ecx
mov ecx, dword [ebp - 0x18]
push eax
push dword [ebp - 0x120]
call fcn.10020c7e
lea eax, [ebp - 0x11c]
cmp dword [ebp - 0x120], eax
je 0x1001b8bd
push dword [ebp - 0x120]
call fcn.1002ffb5
pop ecx
push esi
call fcn.100263c1
pop ecx
xor eax, eax
call fcn.10026958
ret 0xc
Function at 0x1001d817
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x1009572c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0xf0000040
push 0x18
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1001d84b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001d950
push edi
mov edi, 0x94
push edi
call fcn.100263b8
push edi
push ebx
push eax
mov dword [esi + 0x10], eax
call fcn.100292a0
mov eax, dword [esi + 0x10]
push 0x80
push 0x1005a470
push edi
mov dword [eax], 0x206
mov dword [eax + 4], 0xa400
mov eax, dword [esi + 0x10]
mov dword [eax + 8], 0x31415352
mov dword [eax + 0xc], 0x400
mov dword [eax + 0x10], 0x10001
mov eax, dword [esi + 0x10]
add eax, 0x14
push eax
call fcn.10025980
add esp, 0x20
lea eax, [esi + 4]
push eax
push ebx
push ebx
push edi
push dword [esi + 0x10]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1001d933
lea edi, [esi + 8]
push edi
push 0x800001
push 0x6602
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x1001d933
lea ebx, [esi + 0xc]
push ebx
push 0
push 0
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x1001d933
lea eax, [ebp - 8]
push eax
push 0
push 0
push 1
push dword [ebx]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x1001d933
push dword [ebp - 8]
call fcn.100263b8
push dword [ebp - 8]
mov dword [esi + 0x14], eax
push 0
push eax
call fcn.100292a0
add esp, 0x10
lea eax, [ebp - 8]
push eax
push dword [esi + 0x14]
push 0
push 1
push dword [ebx]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
jne 0x1001d93b
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001d94f
mov eax, dword [esi + 0x14]
add eax, 0xc
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 8]
add eax, 0xfffffff4
mov dword [esi + 0x1c], eax
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1002627a
mov esp, ebp
pop ebp
ret
Function at 0x1001f141
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x5c
mov eax, 0x10054d16
call fcn.100269ae
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x58], ebx
call fcn.1001ba7d
push eax
lea ecx, [ebp - 0x58]
call fcn.100185a9
mov eax, dword [esi]
lea ecx, [ebp - 0x5c]
push ecx
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x54], 0x3868574b
mov dword [ebp - 0x50], 0x746f6849
mov dword [ebp - 0x4c], 0x77787744
mov dword [ebp - 0x48], 0x4630684c
mov dword [ebp - 0x44], 0x77315164
mov dword [ebp - 0x40], 0x4f495744
mov dword [ebp - 0x3c], 0x354d6759
mov dword [ebp - 0x38], 0x44416865
mov dword [ebp - 0x34], 0x4c414342
mov dword [ebp - 0x30], 0x53304459
mov dword [ebp - 0x2c], 0x2b384241
mov dword [ebp - 0x28], 0x43737a4b
mov dword [ebp - 0x24], 0x7a515246
mov dword [ebp - 0x20], 0x636f7848
mov dword [ebp - 0x1c], 0x41414141
mov word [ebp - 0x18], 0x674a
call dword [eax + 4]
push dword [eax]
mov byte [ebp - 0x14], bl
lea eax, [ebp - 0x16]
push ebx
sub esp, 0xc
mov byte [ebp - 4], 1
mov ecx, esp
push dword [ebp - 0x14]
mov dword [ecx], ebx
push eax
lea eax, [ebp - 0x54]
mov dword [ecx + 4], ebx
push eax
mov dword [ecx + 8], ebx
call fcn.10017d43
lea eax, [ebp - 0x68]
push eax
call fcn.1001b1fc
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.10024345
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.1001b580
add esp, 0xc
lea ecx, [ebp - 0x68]
call fcn.100241c5
mov ecx, dword [ebp - 0x5c]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.1001ee1f
mov dword [ebp - 0x14], ebx
call fcn.1001ba7d
push eax
lea ecx, [ebp - 0x14]
call fcn.100185a9
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 3
push eax
push ecx
mov esi, esp
mov dword [ebp - 0x5c], esi
mov edi, dword [ebp - 0x58]
add edi, 0xfffffff0
push edi
call fcn.1001ae8a
pop ecx
add eax, 0x10
push ebx
mov dword [esi], eax
call fcn.1001f31f
mov ecx, dword [ebp - 0x14]
add esp, 0xc
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.1001ee1f
mov ecx, edi
call fcn.1001ee1f
mov eax, esi
call fcn.10026958
ret
Function at 0x10021cda
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push 0x9c
mov eax, 0x10054f78
call fcn.100269ae
mov ebx, ecx
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
push 0xfde9
push dword [ebp + 8]
xor edi, edi
lea eax, [ebp - 0xa4]
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xa8], eax
call fcn.1001d714
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.10018694
lea eax, [ebp - 0xa4]
mov byte [ebp - 4], 3
cmp dword [ebp - 0xa8], eax
je 0x10021d4e
push dword [ebp - 0xa8]
call fcn.1002ffb5
pop ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax - 0xc]
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
push 1
push edi
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x10021dd5
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
add eax, dword [ebx + 0x1c]
push eax
mov dword [ecx], eax
call fcn.100263b8
mov ecx, dword [ebp - 0x20]
mov dword [esi], eax
push dword [ecx]
push edi
push eax
call fcn.100292a0
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
push dword [ebx + 0x1c]
push dword [esi]
call fcn.10025980
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebx + 0x1c]
mov ecx, dword [eax - 0xc]
add esi, dword [edx]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push esi
call fcn.10025980
add esp, 0x30
lea eax, [ebp - 0x18]
push dword [ebp - 0x14]
push eax
push esi
push edi
push 1
push edi
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x10021ddd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.1001ee1f
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1001ee1f
mov eax, edi
call fcn.10026958
ret 0xc
Function at 0x10022d14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xb4
mov eax, 0x100550be
call fcn.100269ae
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xb4], eax
xor eax, eax
mov dword [ebp - 0xac], 0x7a6f544b
push eax
push eax
sub esp, 0xc
mov dword [ebp - 0xa8], 0x34356950
mov ecx, esp
mov dword [ebp - 0xa4], 0x37744243
mov dword [ebp - 0xa0], 0x6841694d
mov dword [ebp - 0x9c], 0x3263514c
mov dword [ebp - 0x98], 0x324d6a4c
mov dword [ebp - 0x94], 0x45675349
mov dword [ebp - 0x90], 0x4a457849
mov dword [ebp - 0x8c], 0x75707848
mov dword [ebp - 0x88], 0x636b444a
mov dword [ebp - 0x84], 0x754e4143
mov dword [ebp - 0x80], 0x41595241
mov dword [ebp - 0x7c], 0x6849534b
mov dword [ebp - 0x78], 0x3777444f
mov dword [ebp - 0x74], 0x4638684c
mov dword [ebp - 0x70], 0x67497766
mov dword [ebp - 0x6c], 0x456b5850
mov dword [ebp - 0x68], 0x576f694a
mov dword [ebp - 0x64], 0x7463534e
mov dword [ebp - 0x60], 0x41496749
mov dword [ebp - 0x5c], 0x654d414c
mov dword [ebp - 0x58], 0x354d414f
mov dword [ebp - 0x54], 0x324a6a59
mov dword [ebp - 0x50], 0x745a4462
mov dword [ebp - 0x4c], 0x71636944
mov dword [ebp - 0x48], 0x2f386d4c
mov dword [ebp - 0x44], 0x65776959
mov dword [ebp - 0x40], 0x6f51534e
mov dword [ebp - 0x3c], 0x67556841
mov dword [ebp - 0x38], 0x6767334c
mov dword [ebp - 0x34], 0x2f4d6945
mov dword [ebp - 0x30], 0x4d49424e
mov dword [ebp - 0x2c], 0x6949574e
mov dword [ebp - 0x28], 0x6867774d
mov dword [ebp - 0x24], 0x41415150
mov word [ebp - 0x20], 0x4741
mov byte [ebp - 0x1e], 0x4d
mov byte [ebp - 0xb0], al
push dword [ebp - 0xb0]
mov dword [ebp - 4], eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
lea eax, [ebp - 0x1d]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.10017d43
lea eax, [ebp - 0xc0]
push eax
call fcn.1001b1fc
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.10024345
push eax
lea ecx, [ebp + 0x14]
call fcn.1001b45e
cmp eax, 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc0]
setne bl
call fcn.100241c5
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x1c]
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push 0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.100242fc
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
test bl, bl
push 0x18
pop esi
push 0
pop edx
push ecx
mov ecx, dword [ebp - 0xb4]
cmovne edx, esi
push eax
add ecx, edx
push ecx
call fcn.1002af40
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.10024142
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.1001ee1f
mov al, 1
call fcn.10026958
ret
Function at 0x100256a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xcc0
mov eax, 0x100551d0
call fcn.10026a1c
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0xc7c]
push 0xc2a
xor ebx, ebx
push ebx
push eax
call fcn.100292a0
add esp, 0xc
mov dword [ebp - 0xc80], ebx
call fcn.1001ba7d
push eax
lea ecx, [ebp - 0xc80]
call fcn.100185a9
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
test edi, edi
je 0x100258f6
cmp dword [edi + 8], 0x4a
jne 0x100258f6
mov esi, dword [edi]
test esi, esi
je 0x100258f6
mov eax, dword [esi]
cmp eax, 0x4cc7c
jne 0x100258e8
mov esi, dword [esi + 8]
lea edi, [ebp - 0xc7c]
push 0x64
pop eax
mov byte [ebp - 0xc8e], al
mov ecx, 0x30a
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xb53]
mov byte [ebp - 0xc84], bl
push eax
lea eax, [ebp - 0xc7c]
mov dword [ebp - 0xcbc], 0x704d6a4a
push eax
lea eax, [ebp - 0xc57]
movsw word es:[edi], word [esi]
push eax
push ebx
sub esp, 0xc
mov dword [ebp - 0xcb8], 0x35496e44
mov ecx, esp
mov dword [ebp - 0xcb4], 0x77413344
lea eax, [ebp - 0xc85]
mov dword [ebp - 0xcb0], 0x6e733243
mov dword [ebp - 0xcac], 0x68637946
push dword [ebp - 0xc84]
mov dword [ebp - 0xca8], 0x7a743350
push eax
mov dword [ebp - 0xca4], 0x344d7849
lea eax, [ebp - 0xcbc]
mov dword [ebp - 0xca0], 0x536b694c
mov dword [ebp - 0xc9c], 0x4b454346
mov dword [ebp - 0xc98], 0x534d4343
mov dword [ebp - 0xc94], 0x6730524e
mov word [ebp - 0xc90], 0x5743
mov dword [ebp - 0xc8d], 0x4151486e
mov dword [ebp - 0xc89], 0x6b424141
push eax
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.10017d43
lea eax, [ebp - 0xccc]
push eax
call fcn.1001b0c3
add esp, 0x10
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.100242fc
push eax
lea eax, [ebp - 0xc80]
push eax
call fcn.1001b56c
add esp, 0x14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xccc]
call fcn.10024142
push 0x3c
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.100292a0
pop ecx
pop ecx
lea eax, [ebp - 0xc7c]
mov ecx, esp
push eax
call fcn.10018722
lea ecx, [ebp - 0x50]
call fcn.100187f1
lea eax, [ebp - 0xb53]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x20]
call fcn.100196b0
lea eax, [ebp - 0x17b]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100196b0
lea eax, [ebp - 0x77]
push eax
lea ecx, [ebp - 0x18]
call fcn.100196b0
mov esi, dword [ebp - 0xc80]
lea eax, [ebp - 0x50]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xc84], esp
push esi
call fcn.10018722
push ecx
lea eax, [ebp - 0x94b]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.10018694
mov byte [ebp - 4], 3
call fcn.10020407
add esp, 0xc
call fcn.1003103a
push 0x64
pop ecx
cdq
idiv ecx
cmp edx, ecx
jg 0x100258db
lea eax, [ebp - 0x50]
push eax
call fcn.1001f141
pop ecx
lea ecx, [ebp - 0x50]
call fcn.1001933a
lea ecx, [esi - 0x10]
jmp 0x1002590d
cmp eax, 0x4d835
jne 0x100258f6
push ebx
call fcn.10022bfc
pop ecx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [ebp - 0xc80]
lea ecx, [ecx - 0x10]
call fcn.1001ee1f
call fcn.10026969
ret 0xc
Function at 0x10025b9e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x1009572c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [eax]
mov dword [ebp - 0x24], eax
call fcn.10025b61
push esi
call fcn.10025ec6
mov esi, eax
push edi
mov dword [ebp - 0x14], esi
call fcn.10025ec6
push 0x58
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.100292a0
lea eax, [ebp - 0x7c]
push eax
push 5
push esi
call fcn.10025a4b
mov edi, eax
add esp, 0x20
cmp edi, 5
jb 0x10025d3c
push edi
push esi
call fcn.10025faa
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push esi
call fcn.10026136
mov ebx, eax
add esp, 0x1c
test ebx, ebx
je 0x10025d37
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
and dword [ebp - 8], 0
push ecx
push 0x40
push edi
push esi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10025d1c
lea eax, [ebp - 8]
push eax
push 0x40
push 0x6c
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10025cff
xor edx, edx
lea ecx, [ebx + 0x2c]
test edi, edi
je 0x10025c85
sub esi, ecx
mov al, byte [esi + ecx]
mov byte [ecx], al
mov byte [ebx + edx + 0x4c], al
inc edx
inc ecx
cmp edx, edi
jb 0x10025c70
mov esi, dword [ebp - 0x14]
lea ecx, [ebx + 0x2c]
lea eax, [edi + esi]
push eax
lea eax, [ecx + edi]
push eax
call fcn.10025b18
mov edx, dword [ebp - 0x18]
mov eax, edx
pop ecx
pop ecx
mov ecx, esi
sub eax, esi
sub ecx, edx
cmp edx, esi
push edx
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x10025ccb
lea esi, [ebx + 0xc]
push esi
call fcn.10025b18
pop ecx
pop ecx
sub eax, ebx
sub eax, 0xc
push eax
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push esi
mov esi, dword [ebp - 0x14]
push esi
call fcn.10025b18
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov dword [ebx + 8], eax
lea eax, [ebx + 0x2c]
push edi
push eax
push dword [ebp - 0x10]
mov dword [ebx + 4], edi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x6c
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [ebx], 0
je 0x10025d2b
mov ecx, dword [ebp - 0x24]
lea eax, [ebx + 0x2c]
mov dword [ecx], eax
jmp 0x10025d37
push 1
push ebx
call fcn.1002623d
pop ecx
pop ecx
xor ebx, ebx
call fcn.10025e48
push 0x10097990
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.1002627a
mov esp, ebp
pop ebp
ret
Function at 0x10025d5f
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1009572c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0xc], ebx
xor edi, edi
call fcn.10025b61
xor esi, esi
mov eax, dword [esi*4 + 0x100979a8]
test eax, eax
je 0x10025d97
add eax, 0x2c
cmp eax, dword [ebx]
je 0x10025e3c
inc esi
cmp esi, 0x40
jb 0x10025d81
xor esi, esi
test esi, esi
je 0x10025e1e
push dword [esi + 4]
push dword [esi]
call fcn.10025faa
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 8], edi
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10025e19
mov edx, dword [esi]
xor ecx, ecx
cmp dword [esi + 4], ecx
jbe 0x10025de6
mov al, byte [esi + ecx + 0x4c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esi + 4]
jb 0x10025dd9
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 0xc]
xor edi, edi
mov eax, dword [esi]
inc edi
push 0
push esi
mov dword [ecx], eax
call fcn.1002623d
pop ecx
pop ecx
call fcn.10025e48
push 0x10097990
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002627a
mov esp, ebp
pop ebp
ret
mov esi, dword [esi*4 + 0x100979a8]
jmp 0x10025d9f

Function at 0x10025e48
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x10097ab0], esi
jbe 0x10025e9a
mov eax, dword [0x10097aac]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x10097aac]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x10097ab0]
jb 0x10025e75
push dword [0x10097aac]
call fcn.1002ffb5
and dword [0x10097aac], 0
and dword [0x10097ab0], 0
pop ecx
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov esp, ebp
pop ebp
ret