joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a6060
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b82c3
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x100d99c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], edi
mov dword [edi], 0
push 0x10
mov dword [ebp - 0x20], ebx
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.100adfd1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [edi + 0x18], 7
mov dword [edi + 0x1c], 8
mov dword [edi], 0x3f800000
push dword [edi + 4]
mov byte [ebp - 4], 1
push 0x10
call fcn.10031810
mov dword [ebp - 4], 2
cmp esi, ebx
je 0x100a6229
nop
movzx eax, byte [esi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 1]
xor ecx, eax
movzx eax, byte [esi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x18]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push esi
push eax
call fcn.1002ec70
cmp dword [ebp - 0x14], 0
jne 0x100a621d
cmp dword [edi + 8], 0xfffffff
je 0x100a623f
lea eax, [edi + 4]
mov dword [ebp - 0x28], eax
push 0x10
mov byte [ebp - 4], 3
mov dword [ebp - 0x24], 0
call fcn.100adfd1
mov ecx, dword [esi + 4]
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
lea edx, [eax + 8]
mov eax, dword [esi]
mov dword [ebp - 0x1c], edx
mov dword [edx], eax
mov dword [edx + 4], ecx
mov eax, dword [edi + 8]
inc eax
mov byte [ebp - 4], 4
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100bb5e0]
mov eax, dword [edi + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100bb5e0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [edi]
seta al
test al, al
je 0x100a6203
mov ecx, edi
call fcn.10031df0
push ebx
push dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.1002ec70
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jmp 0x100a6206
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x10]
mov dword [ebp - 0x24], 0
push ecx
push ebx
mov ecx, edi
call fcn.10031d90
mov byte [ebp - 4], 2
add esi, 8
cmp esi, dword [ebp - 0x20]
jne 0x100a6110
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__
int3
Function at 0x10008b50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10008d20
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10008c2d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10008b9a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10023004]
ja 0x10008b9a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10008b6a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x10008bbf
jmp 0x10008c2d
cmp dword [ebp - 0x14], 0x10000
jne 0x10008c13
cmp dword [ebp - 0x18], 0x10000
jb 0x10008c13
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10008bf6
mov eax, dword [ebp - 8]
jmp 0x10008c2f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10008c06
xor eax, eax
jmp 0x10008c2f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10008c28
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10008d20
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10008b6a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10008c40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10008d50
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10008d15
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10008c85
mov eax, dword [ebp - 4]
cmp eax, dword [0x10023004]
ja 0x10008c85
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10008c55
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x10008caa
jmp 0x10008d15
cmp dword [ebp - 0x14], 0x10000
jne 0x10008cfe
cmp dword [ebp - 0x18], 0x10000
jb 0x10008cfe
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10008ce1
mov eax, dword [ebp - 8]
jmp 0x10008d17
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10008cf1
xor eax, eax
jmp 0x10008d17
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10008d10
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10008d50
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10008c55
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10008d80
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10009170
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x100234b4], 0
jne 0x10008dbd
cmp dword [0x100234b0], 0
je 0x10008dbd
mov eax, dword [0x100234b0]
mov dword [0x100234b4], eax
cmp dword [0x100234b4], 0
je 0x10008e3a
mov ecx, dword [0x100234b4]
cmp dword [ecx + 8], 0
je 0x10008e3a
mov edx, dword [0x100234b4]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x10008e3a
mov ecx, dword [0x100234b4]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x10008e3a
mov eax, dword [0x100234b4]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10008e09
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10008e10
xor eax, eax
jmp 0x10008f59
mov ecx, dword [0x100234b4]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10008f59
mov edx, dword [0x100234b0]
mov dword [0x100234b4], edx
jmp 0x10008e56
mov eax, dword [0x100234b4]
mov ecx, dword [eax + 4]
mov dword [0x100234b4], ecx
cmp dword [0x100234b4], 0
je 0x10008e96
cmp dword [0x100234b4], 0
je 0x10008e94
mov edx, dword [0x100234b4]
cmp dword [edx + 8], 0
je 0x10008e94
mov eax, dword [0x100234b4]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10008e94
mov edx, dword [0x100234b4]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10008e94
jmp 0x10008dee
jmp 0x10008e48
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10008f60
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10008f57
mov eax, dword [ebp - 0x18]
mov dword [0x100234b4], eax
mov ecx, dword [0x100234b4]
mov dword [ecx], 0x52727464
mov edx, dword [0x100234b4]
mov dword [edx + 8], 0
mov eax, dword [0x100234b4]
mov ecx, dword [0x100234b0]
mov dword [eax + 4], ecx
mov edx, dword [0x100234b4]
mov dword [0x100234b0], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x100234b4]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10008f27
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10008f47
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x10008f1e
mov eax, dword [0x100234b4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x10008dee
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10009ca0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100234b0]
mov dword [ebp - 4], eax
jmp 0x10009cb9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10009ce0
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x10009cde
call sub.KERNEL32.dll_GetLastError
jmp 0x10009ce2
jmp 0x10009cb0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000a150
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100234c0], eax
je 0x1000a16d
mov eax, 0x10dd
jmp 0x1000a250
mov eax, dword [0x100234d0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000a1ec
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000a1c8
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1000a1c8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10009200
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.1000bbdb
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1000a175
mov dword [0x100234d0], 0
call fcn.10009ae0
mov ecx, dword [0x100234cc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1000a23a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1000bbdb
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1000a204
mov dword [0x100234cc], 0
mov dword [0x100234c0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a730
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100234c4], 0
je 0x1000a749
mov eax, dword [0x100234c4]
jmp 0x1000a7e8
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1000a75a
xor eax, eax
jmp 0x1000a7e8
push 8
call fcn.1000b88c
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000a7b2
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1000a79b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.1000bbdb
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100234c4], eax
mov dword [0x100234c8], 0
mov eax, dword [ebp - 8]
jmp 0x1000a7e8
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1000a7ca
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1000a77a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100234cc]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100234cc], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c580
Capabilities:
Create thread

Disassembly:
sub dword [esp + 8], 1
jne 0x1000c613
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push ebx
push 0x1000c620
push 0
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
push 0
push 0
push ebx
push 0x1000ccc0
push 0
push 0
call edi
push eax
call esi
push 0
push 0
push ebx
push 0x1000ccc0
push 0
push 0
call edi
push eax
call esi
push 0
push 0
push ebx
push 0x1000ccc0
push 0
push 0
call edi
push eax
call esi
push 0
push 0
push ebx
push 0x1000ccc0
push 0
push 0
call edi
push eax
call esi
push 0
push 0
push ebx
push 0x1000ccc0
push 0
push 0
call edi
push eax
call esi
pop edi
pop esi
pop ebx
mov eax, 1
ret 0xc

Function at 0x1000da90
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0xc
mov eax, dword [0x10023040]
xor eax, esp
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x1000dae0
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
xor ecx, esp
call fcn.1000b67c
add esp, 0xc
ret
Function at 0x1000e0b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x44
mov eax, dword [0x10023040]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
lea eax, [esp + 0x30]
push 0x1c
push eax
mov esi, ecx
mov dword [esp + 0x24], 0
xor ebp, ebp
mov dword [esp + 0x20], esi
push ebp
push esi
mov dword [esp + 0x4c], 0x1000
call edi
xor ebx, ebx
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x58], ebx
jbe 0x1000e1fe
nop dword [eax + eax]
push 0x1c
lea eax, [esp + 0x34]
push eax
push ebx
push esi
call edi
test eax, eax
je 0x1000e240
cmp dword [esp + 0x40], 0x1000
jne 0x1000e240
cmp dword [esp + 0x44], 1
je 0x1000e240
push ebp
call fcn.1000b68a
push dword [esp + 0x40]
call fcn.1000bbe9
add esp, 8
mov ebp, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x14], ebp
push eax
push 0x40
push dword [esp + 0x44]
push dword [esp + 0x3c]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1000e240
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x40]
push ebp
push dword [esp + 0x3c]
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x50]
push dword [esp + 0x44]
push dword [esp + 0x3c]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edx, dword [esp + 0x60]
mov edi, edx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1000e198
mov eax, dword [esp + 0x2c]
sub edi, ecx
add eax, ebp
mov dword [esp + 0x20], eax
cmp ebp, eax
jae 0x1000e23a
mov esi, dword [esp + 0x5c]
mov ecx, edx
sub ecx, dword [esp + 0x5c]
sub esi, ebp
xor edx, edx
mov dword [esp + 0x24], ecx
test edi, edi
jle 0x1000e1ec
nop dword [eax]
mov eax, ebp
lea ebx, [ecx + esi]
cmp byte [ebx + eax], 0x3f
je 0x1000e1e2
mov cl, byte [esi + eax]
cmp cl, byte [eax]
jne 0x1000e21e
inc edx
inc eax
cmp edx, edi
jl 0x1000e1d5
mov ebx, dword [esp + 0x10]
test ebp, ebp
je 0x1000e232
mov eax, ebp
mov ebp, dword [esp + 0x14]
sub eax, ebp
add eax, ebx
mov dword [esp + 0x1c], eax
push ebp
call fcn.1000b68a
mov ecx, dword [esp + 0x54]
add esp, 4
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000b67c
add esp, 0x44
ret
inc ebp
dec esi
cmp ebp, dword [esp + 0x20]
jae 0x1000e22e
mov ecx, dword [esp + 0x24]
xor edx, edx
jmp 0x1000e1d0
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
add ebx, dword [esp + 0x3c]
mov dword [esp + 0x10], ebx
cmp ebx, dword [esp + 0x58]
jb 0x1000e100
jmp 0x1000e1fe
Function at 0x10001040
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [0x10013360]
push esi
mov esi, dword [ebp + 8]
push edi
push 0xc
mov dword [ebp - 4], esi
call fcn.100013f2
add esp, 4
mov dword [ebp - 8], eax
lea edi, [ebx + 0xc]
mov dword [eax], esi
mov ecx, dword [esi]
mov dword [eax + 4], ecx
mov cx, word [esi + 4]
mov word [eax + 8], cx
mov cl, byte [esi + 6]
push edi
mov byte [eax + 0xa], cl
mov eax, dword [ebx]
push 0x40
push 7
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [eax + ebx + 4], 0x100011b0
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 4]
push edi
mov dword [ecx], eax
mov ax, word [ebx + 8]
mov word [ecx + 4], ax
mov al, byte [ebx + 0xa]
mov byte [ecx + 6], al
push dword [edi]
push 7
push ecx
call esi
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100010c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [0x10013358]
push edi
mov edi, dword [0x10013360]
add edi, 0xc
push edi
push 0x40
push 7
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
push edi
mov dword [ecx], eax
mov ax, word [ebx + 8]
mov word [ecx + 4], ax
mov al, byte [ebx + 0xa]
mov byte [ecx + 6], al
push dword [edi]
push 7
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000b860
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000b88d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000b88d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x176a8000
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov al, byte [0x17693158]
test eax, eax
je 0x176a801d
mov cl, byte [0x17693608]
or cl, 1
mov byte [0x17693608], cl
cmp dword [0x17693130], 0
je 0x176a8035
mov dl, byte [0x17693608]
or dl, 8
mov byte [0x17693608], dl
xor eax, eax
mov al, byte [0x17693608]
test eax, eax
je 0x176a809f
cmp dword [0x1769313c], 0
je 0x176a8059
push 0x17695dfc
push 0x17695e00
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov ecx, dword [0x176a2454]
push ecx
mov dl, byte [0x17693608]
push edx
push 0x176933b0
push 0x17693158
mov eax, dword [0x17693140]
push eax
mov ecx, dword [0x1769313c]
push ecx
mov edx, dword [0x17693138]
push edx
mov eax, dword [0x17693134]
push eax
mov ecx, dword [0x17693130]
push ecx
push 0x17693128
call fcn.176ab498
add esp, 0x28
pop ebp
ret
Function at 0x176a975f
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov word [ebp - 8], 0
call fcn.176aaa78
mov word [ebp - 4], ax
cmp dword [0x176a2570], 0
je 0x176a9789
mov dword [0x176a2b44], 0
jmp 0x176a9793
mov dword [0x176a2b44], 1
cmp dword [0x176a2b44], 0
je 0x176a9993
cmp dword [0x17695df8], 1
je 0x176a97ba
mov eax, dword [0x17695df4]
cmp eax, dword [0x17695df0]
jne 0x176a992c
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 5
idiv ecx
add edx, 1
mov dword [0x17695df0], edx
mov dword [0x17695df4], 1
mov edx, dword [0x176a4818]
and edx, 0x1f3
mov dword [0x176a2550], edx
mov eax, dword [0x176a2550]
mov ecx, dword [eax*4 + 0x17692010]
xor ecx, 0xfd0699d6
mov dword [0x176a2540], ecx
mov dword [0x176a2544], 0
push 4
push 0
push 0x176a2544
push 0x176a2540
movzx dx, byte [0x1769200d]
push edx
push 0x176a26ac
call fcn.176ac480
mov word [ebp - 4], ax
mov eax, dword [ebp - 4]
and eax, 0xffff
test eax, eax
jne 0x176a9876
mov ecx, dword [0x176a2544]
xor ecx, 0x7b2309a7
mov edx, dword [0x176a2550]
xor ecx, dword [edx*4 + 0x176927e0]
test ecx, ecx
je 0x176a9920
xor eax, eax
mov al, byte [0x17694f6a]
cmp eax, 0x31
jne 0x176a9888
mov word [ebp - 4], 3
xor ecx, ecx
mov cl, byte [0x17694f6a]
cmp ecx, 0x32
je 0x176a98a2
xor edx, edx
mov dl, byte [0x17694f6a]
cmp edx, 0x33
jne 0x176a98a8
mov word [ebp - 4], 0
mov dword [0x17695df8], 1
cmp dword [0x176a2594], 0
jne 0x176a991e
xor eax, eax
mov al, byte [0x17694f6a]
cmp eax, 0x32
je 0x176a98d4
xor ecx, ecx
mov cl, byte [0x17694f6a]
cmp ecx, 0x33
jne 0x176a991e
mov edx, dword [0x176a269c]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [0x176a254c], 0xc
push 0x2010
call fcn.176a80a1
push eax
call fcn.176aa8db
add esp, 8
mov dword [0x176a254c], 0
mov eax, dword [0x176a269c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [0x176a2594], 1
jmp 0x176a992a
mov dword [0x17695df8], 0
jmp 0x176a9991
mov ecx, dword [0x17695df4]
add ecx, 1
mov dword [0x17695df4], ecx
mov edx, dword [0x176a4818]
mov dword [0x176a2540], edx
mov dword [0x176a2544], 0
push 4
push 0
push 0x176a2544
push 0x176a2540
push 0
push 0x176a26ac
call fcn.176ac480
mov word [ebp - 4], ax
mov eax, dword [ebp - 4]
and eax, 0xffff
test eax, eax
jne 0x176a998b
mov ecx, dword [0x176a2544]
xor ecx, dword [0x176a4818]
test ecx, ecx
je 0x176a9991
mov word [ebp - 4], 3
jmp 0x176a99f7
mov edx, dword [0x17695df4]
add edx, 1
mov dword [0x17695df4], edx
mov eax, dword [0x176a4818]
mov dword [0x176a2540], eax
mov dword [0x176a2544], 0
push 4
push 0
push 0x176a2544
push 0x176a2540
push 0
push 0x176a26ac
call fcn.176ac480
mov word [ebp - 4], ax
mov ecx, dword [ebp - 4]
and ecx, 0xffff
test ecx, ecx
jne 0x176a99f1
mov edx, dword [0x176a2544]
xor edx, dword [0x176a4818]
test edx, edx
je 0x176a99f7
mov word [ebp - 4], 3
mov ax, word [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x176a9ec1
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x176a4800
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x64
jge 0x176a9f3e
mov eax, dword [ebp - 8]
cmp dword [eax*4 + 0x176a4820], 0
je 0x176a9f2d
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x176a4820]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x176a9f2d
cmp dword [ebp - 4], 0x103
je 0x176a9f2d
mov ecx, dword [ebp - 8]
mov edx, dword [ecx*4 + 0x176a4820]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [eax*4 + 0x176a4820], 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.176aa116
add esp, 4
mov dword [ebp - 8], eax
jmp 0x176a9ed9
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x64
jge 0x176a9f7a
mov edx, dword [ebp - 8]
cmp dword [edx*4 + 0x176a4820], 0
je 0x176a9f69
mov eax, dword [ebp - 8]
mov ecx, dword [eax*4 + 0x176a4820]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [ebp - 8]
push edx
call fcn.176aa116
add esp, 4
mov dword [ebp - 8], eax
jmp 0x176a9f45
mov esp, ebp
pop ebp
ret

Function at 0x176a9f7e
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0x64
jge 0x176a9fbe
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x176a4820], 0
je 0x176a9fad
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x176a4820]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 4]
push eax
call fcn.176aa116
add esp, 4
mov dword [ebp - 4], eax
jmp 0x176a9f89
push 0x176a4800
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret

Function at 0x176abcf0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x176abd65
mov eax, dword [esp + 0x10]
mov ecx, 2
sub eax, ecx
je 0x176abd3c
mov word [0x176a2b50], cx
call fcn.176ae1a0
add esp, 0x94
ret
cmp dword [esp + 4], 5
jne 0x176abd29
mov edx, dword [esp + 8]
mov eax, 1
cmp edx, eax
jb 0x176abd29
mov word [0x176a2b50], ax
call fcn.176aba40
call fcn.176abbd0
call fcn.176ae1a0
add esp, 0x94
ret