joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e6f8
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x48a310]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x48a320]
je 0x46e72d
inc eax
cmp eax, 0x13
jb 0x46e71e
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x48a320]
jne 0x46e853
mov eax, dword [0x48babc]
cmp eax, 1
je 0x46e82b
cmp eax, edx
jne 0x46e75d
cmp dword [0x489b5c], 1
je 0x46e82b
cmp ecx, 0xfc
je 0x46e853
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x46e793
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00461940
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.004617f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x46e7c7
mov eax, edi
push eax
call fcn.004617f0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x483ea8
push edi
call fcn.00470c40
add esp, 0x10
push edi
call fcn.004617f0
push dword [esi + 0x48a324]
mov ebx, eax
call fcn.004617f0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00462ba0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00461940
push edi
push ebx
call fcn.00461950
push 0x483e88
push ebx
call fcn.00461950
push dword [esi + 0x48a324]
push ebx
call fcn.00461950
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00472454
add esp, 0x2c
jmp 0x46e853
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x48a324]
push dword [esi]
call fcn.004617f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0046f32b
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x46ed1b
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x48bfcc]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x46ed64
call ebp
mov esi, eax
cmp esi, ebx
je 0x46ed4a
mov dword [0x48bfcc], 1
jmp 0x46ed69
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x78
jne 0x46ed5f
push 2
pop eax
mov dword [0x48bfcc], eax
jmp 0x46ed64
mov eax, dword [0x48bfcc]
cmp eax, 1
jne 0x46edc1
cmp esi, ebx
jne 0x46ed7c
call ebp
mov esi, eax
cmp esi, ebx
jne 0x46ed7c
xor eax, eax
jmp 0x46ee68
cmp word [esi], bx
mov eax, esi
je 0x46ed91
inc eax
inc eax
cmp word [eax], bx
jne 0x46ed83
inc eax
inc eax
cmp word [eax], bx
jne 0x46ed83
sub eax, esi
inc eax
inc eax
mov ebp, eax
push ebp
call fcn.004644d3
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x46edb4
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x46ee68
push ebp
push esi
push edi
call fcn.00461a50
add esp, 0xc
jmp 0x46eda6
cmp eax, 2
je 0x46edca
cmp eax, ebx
jne 0x46ed75
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x46ed75
cmp byte [ebp], bl
mov esi, ebp
je 0x46ee00
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
cmp eax, ebx
je 0x46ed75
push esi
add edi, eax
call fcn.004617f0
lea esi, [esi + eax + 1]
cmp byte [esi], bl
pop ecx
jne 0x46eddd
inc edi
lea eax, [edi + edi]
push eax
mov dword [esp + 0x18], edi
call fcn.004644d3
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x46ee79
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x46ee5a
mov ecx, dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x10]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
test eax, eax
je 0x46ee6f
push edi
call fcn.004617f0
push esi
lea edi, [edi + eax + 1]
call fcn.0046176a
cmp byte [edi], bl
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x46ee20
push ebp
mov word [esi], bx
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x10]
call fcn.004643b1
pop ecx
push ebp
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsA]
jmp 0x46ed75
Function at 0x46ee85
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x48bfd0]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
jne 0x46eec5
call esi
test eax, eax
je 0x46eeaa
mov dword [0x48bfd0], 1
jmp 0x46eeca
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x78
jne 0x46eec1
mov dword [0x48bfd0], 2
jmp 0x46eed3
xor eax, eax
jmp 0x46ef21
cmp eax, 1
jne 0x46eece
call esi
jmp 0x46ef21
cmp eax, 2
jne 0x46eec1
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x46ef19
lea eax, [esi + esi]
push eax
call fcn.004644d3
mov ebp, eax
test ebp, ebp
pop ecx
je 0x46ef19
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x46ef1d
push ebp
call fcn.004643b1
pop ecx
xor eax, eax
jmp 0x46ef1f
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x472454
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x48c05c], ebx
push esi
push edi
jne 0x4724d4
push str.user32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x47250f
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x485954
push edi
call esi
test eax, eax
mov dword [0x48c05c], eax
je 0x47250f
push 0x485944
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x48c060], eax
call esi
cmp dword [0x48bac4], 2
mov dword [0x48c064], eax
jne 0x4724d4
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x48c06c], eax
je 0x4724d4
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x48c068], eax
mov eax, dword [0x48c068]
test eax, eax
je 0x472519
call eax
test eax, eax
je 0x472500
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x48c06c]
test eax, eax
je 0x472500
test byte [ebp - 8], 1
jne 0x472519
cmp dword [0x48bad0], 4
jb 0x472513
or byte [ebp + 0x12], 0x20
jmp 0x472538
xor eax, eax
jmp 0x472548
or byte [ebp + 0x12], 4
jmp 0x472538
mov eax, dword [0x48c060]
test eax, eax
je 0x472538
call eax
mov ebx, eax
test ebx, ebx
je 0x472538
mov eax, dword [0x48c064]
test eax, eax
je 0x472538
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x48c05c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47396c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x473b40
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x48c360]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x473b40
test cl, 0x48
je 0x4739d7
cmp byte [eax + 5], 0xa
je 0x4739d7
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x473a29
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x473a11
call fcn.00466b05
mov dword [eax], 9
call fcn.00466b0e
mov dword [eax], esi
jmp 0x473a21
cmp eax, 0x6d
je 0x473b40
push eax
call fcn.00466b17
pop ecx
or eax, 0xffffffff
jmp 0x473b42
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x473b3b
test eax, eax
je 0x473a50
cmp byte [ebx], 0xa
jne 0x473a50
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x473a59
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x473b35
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x473b25
cmp al, 0xd
je 0x473a8b
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x473b17
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x473aa5
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x473aa0
add dword [ebp + 0x10], 2
jmp 0x473af9
mov dword [ebp + 0x10], eax
jmp 0x473b13
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x473acd
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x473b13
cmp dword [ebp - 0xc], 0
je 0x473b13
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x473aee
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x473af9
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x473b16
cmp ebx, dword [ebp + 0xc]
jne 0x473afe
cmp byte [ebp - 1], 0xa
jne 0x473afe
mov byte [ebx], 0xa
jmp 0x473b16
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0046efac
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x473b17
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x473a6f
jmp 0x473b35
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x473b35
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x473b42
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47435f
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x474378
or eax, 0xffffffff
jmp 0x4743d9
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x4743d5
push 0x3d
push esi
call fcn.0047455f
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x4743d5
cmp esi, eax
je 0x4743d5
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x48bae4]
sete cl
cmp eax, dword [0x48bae8]
mov dword [ebp - 8], ecx
jne 0x4743bb
mov edi, eax
call fcn.004742fe
mov dword [0x48bae4], eax
cmp eax, ebx
jne 0x474414
cmp dword [ebp + 0xc], ebx
je 0x4743dd
cmp dword [0x48baec], ebx
je 0x4743dd
call fcn.004738dc
test eax, eax
je 0x474414
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x4743e6
xor eax, eax
jmp 0x4743d8
push 4
call fcn.004644d3
cmp eax, ebx
pop ecx
mov dword [0x48bae4], eax
je 0x4743d5
mov dword [eax], ebx
cmp dword [0x48baec], ebx
jne 0x474414
push 4
call fcn.004644d3
cmp eax, ebx
pop ecx
mov dword [0x48baec], eax
je 0x4743d5
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x48bae4]
call fcn.004742b1
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x474475
cmp dword [esi], ebx
je 0x474475
lea esi, [esi + edi*4]
push dword [esi]
call fcn.004643b1
cmp dword [ebp - 8], ebx
pop ecx
jne 0x474458
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x4744b6
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x47444f
mov eax, edi
shl eax, 2
push eax
push dword [0x48bae4]
call fcn.00464c4e
cmp eax, ebx
pop ecx
pop ecx
je 0x4744b6
jmp 0x4744b1
cmp dword [ebp - 8], ebx
jne 0x474521
cmp edi, ebx
jge 0x474484
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x48bae4]
call fcn.00464c4e
cmp eax, ebx
pop ecx
pop ecx
je 0x4743d5
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x48bae4], eax
cmp dword [ebp + 0xc], ebx
je 0x47450b
push dword [ebp - 4]
call fcn.004617f0
inc eax
inc eax
push eax
call fcn.004644d3
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x47450b
push dword [ebp - 4]
push esi
call fcn.00461940
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
test eax, eax
jne 0x474504
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.004643b1
pop ecx
cmp dword [ebp - 8], ebx
je 0x474519
push dword [ebp - 4]
call fcn.004643b1
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x4743d8
push dword [ebp - 4]
call fcn.004643b1
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x4743e2
Function at 0x413080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
jmp 0x41309a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4130a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413090
mov eax, 1
add ebx, ebx
jne 0x4130b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4130c4
jne 0x4130e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4130e3
dec eax
add ebx, ebx
jne 0x4130d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4130a8
add ebx, ebx
jne 0x4130df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x413135
xor ecx, ecx
sub eax, 3
jb 0x4130fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41316a
sar eax, 1
mov ebp, eax
jmp 0x413106
add ebx, ebx
jne 0x413106
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4130d4
inc ecx
add ebx, ebx
jne 0x413114
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4130d4
add ebx, ebx
jne 0x413121
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x413116
jne 0x413132
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413116
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x413154
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x413146
jmp 0x413096
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x413154
add edi, ecx
jmp 0x413096
pop esi
mov edi, esi
mov ecx, 0x3a6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x413172
cmp byte [edi], 7
jne 0x413172
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x413177
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x4131e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13398]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x133d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4131a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x133d8]
or eax, eax
je 0x4131e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4131c1
call dword [esi + 0x133e8]
mov ebp, dword [esi + 0x133dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41321a
sub esp, 0xffffff80
jmp 0x404912
Function at 0x100010a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10001164
cmp dword [ebp - 4], 0x50000000
jb 0x100010e1
cmp dword [ebp - 4], 0x80000000
ja 0x100010e1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100010ba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100d2b30
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10001107
jmp 0x10001164
cmp dword [ebp - 0x14], 0x10000
jne 0x1000114a
cmp dword [ebp - 0x18], 0x10000
jb 0x1000114a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000113d
mov eax, dword [ebp - 8]
jmp 0x10001166
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000115f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100010ba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10001170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000122c
cmp dword [ebp - 4], 0x50000000
jb 0x100011ac
cmp dword [ebp - 4], 0x80000000
ja 0x100011ac
mov dword [ebp - 4], 0x80010000
jmp 0x10001185
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100d2b30
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100011d2
jmp 0x1000122c
cmp dword [ebp - 0x14], 0x10000
jne 0x10001215
cmp dword [ebp - 0x18], 0x10000
jb 0x10001215
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10001208
mov eax, dword [ebp - 8]
jmp 0x1000122e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10001227
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10001185
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10549018]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret
Function at 0x10002070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10549028], eax
je 0x1000208e
mov eax, 0x10dd
jmp 0x1000216f
mov eax, dword [0x10549038]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000210c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100020ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100020ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001710
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.100d16a7
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10002096
mov dword [0x10549038], 0
call fcn.10001a30
mov ecx, dword [0x10549034]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10002159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100d16a7
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10002124
mov dword [0x10549034], 0
mov dword [0x10549028], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10002660
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1054902c], 0
je 0x10002679
mov eax, dword [0x1054902c]
jmp 0x10002719
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000268b
xor eax, eax
jmp 0x10002719
push 8
call fcn.100d097e
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100026e1
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x100026ca
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100d16a7
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1054902c], eax
mov dword [0x10549030], 0
mov eax, dword [ebp - 8]
jmp 0x10002719
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100026fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100026ab
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10549034]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10549034], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10004d10
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x10004d2b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10004d36
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10004d41
bts eax, 5
shr ecx, 1
test cl, 1
je 0x10004d4c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10004d57
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10004d62
bts eax, 2
shr ecx, 1
test cl, 1
je 0x10004d6d
bts eax, 1
test cl, 2
je 0x10004d76
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10004e12
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10004e03
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10004d20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret