joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021436
Capabilities:
Initialize winsock library
Send data
Send data on socket

Disassembly:
push 0x220
mov eax, 0x10053e84
call fcn.100383ca
mov eax, dword [ebp + 8]
mov esi, ecx
call fcn.1002140d
push esi
lea ebx, [ebp - 0x64]
mov dword [ebp - 0x44], eax
call fcn.100254ca
xor ebx, ebx
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.10020f43
test eax, eax
jne 0x10021482
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x64]
call fcn.1002565e
mov eax, ebx
call fcn.1003844d
ret 4
cmp dword [ebp - 0x44], ebx
je 0x1002151a
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x48], esp
push ebx
call fcn.100253af
lea eax, [ebp - 0x64]
push eax
mov edx, str.__transferonwer
mov byte [ebp - 4], 1
call fcn.10026599
mov edi, eax
mov byte [ebp - 4], bl
call fcn.100256e1
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x80]
call fcn.10007a10
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 2
call fcn.10001480
sub esp, 0x10
mov byte [ebp - 4], 3
mov edx, eax
mov esi, esp
mov dword [ebp - 0x48], esp
call fcn.1002548e
lea eax, [ebp - 0x64]
push eax
mov edx, str.__attachment
mov byte [ebp - 4], 4
call fcn.10026599
mov edi, eax
mov byte [ebp - 4], 3
call fcn.100256e1
lea ecx, [ebp - 0x9c]
call fcn.100079e0
lea esi, [ebp - 0x80]
mov byte [ebp - 4], bl
call fcn.10012b60
cmp dword [0x10068a18], ebx
je 0x1002156a
push 0x190
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.10039730
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push ebx
push 2
push 2
call sub.WS2_32.dll_socket
mov dword [0x10068a1c], eax
cmp eax, 0xffffffff
jne 0x10021564
xor ebx, ebx
inc ebx
jmp 0x1002146c
mov dword [0x10068a18], ebx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x40]
call fcn.100269ff
cmp dword [ebp - 0x28], 0x10
push 2
pop eax
mov word [ebp - 0x24], ax
mov eax, 0xe832
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x20], 0x100007f
jae 0x10021599
lea eax, [ebp - 0x3c]
push 0x10
lea ecx, [ebp - 0x24]
push ecx
push ebx
push dword [ebp - 0x2c]
push eax
push dword [0x10068a1c]
call sub.WS2_32.dll_sendto
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
lea ecx, [ebp - 0x40]
call fcn.100079e0
mov ebx, esi
jmp 0x1002146c

Function at 0x1002f307
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10066060]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10039730
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logs_accelerator
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
mov ecx, esi
call fcn.10007a10
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
mov eax, esi
call fcn.100370e4
add ebp, 0x190
leave
ret
Function at 0x1002f37d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10066060]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.10039730
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logsignored
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
mov ecx, esi
call fcn.10007a10
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
mov eax, esi
call fcn.100370e4
add ebp, 0x190
leave
ret

Function at 0x1002f917
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x10066060]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 4
mov eax, 0x100512fe
call fcn.10038361
mov edi, dword [ebp + 0x230]
mov esi, dword [ebp + 0x238]
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push ebx
push eax
mov dword [ebp - 0x10], ebx
call fcn.10039730
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [ebp + 0x234], 1
jne 0x1002f983
push str.projonepodlp
jmp 0x1002f991
cmp dword [ebp + 0x234], 2
jne 0x1002f9af
push str.projonepotcm
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp esi, ebx
je 0x1002f9aa
push esi
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x1c]
jmp 0x1002f9ff
cmp dword [ebp + 0x234], ebx
jne 0x1002f9fa
push ebx
lea eax, [ebp]
push 2
push eax
call fcn.1002f917
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x1002f9d5
lea eax, [ebp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push esi
test eax, eax
je 0x1002f9f6
push 2
push edi
call fcn.1002f917
add esp, 0xc
lea esi, [ebp]
call fcn.10012b60
jmp 0x1002fa06
push 1
jmp 0x1002f9e3
mov eax, 0x10057af0
mov ecx, edi
call fcn.10007a10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.100370e4
add ebp, 0x228
leave
ret
Function at 0x1003140d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x10031427
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x10031423
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10031542
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10066060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.10031708
mov bl, al
mov al, dl
call fcn.10031708
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.10031708
mov bl, al
mov al, byte [esi - 4]
call fcn.10031708
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.10031708
mov bl, al
mov al, byte [esi]
call fcn.10031708
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.10031708
mov bl, al
mov al, byte [esi - 0xc]
call fcn.10031708
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x1003156a
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100370e4
leave
ret 4
Function at 0x100315f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10066060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.10031784
push ebx
mov dl, al
call fcn.1003175d
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.10031718
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.10031736
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.10031718
push ebx
mov byte [ebp - 0x15], al
call fcn.10031736
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.1003175d
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.10031784
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.1003175d
mov bl, al
mov al, byte [edi + 4]
call fcn.10031784
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.10031736
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.10031718
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.10031736
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.10031718
xor bl, al
mov al, dl
call fcn.10031784
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1003175d
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x10031623
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100370e4
leave
ret 4
Function at 0x10031e45
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x100503dd
call fcn.100383ca
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x30], ebx
xor esi, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10031e63
sub eax, ecx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.10009d00
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], ebx
jbe 0x10031f62
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x1005a478]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x10031e9f
cmp al, 0xff
je 0x10031e8b
cmp al, 0xff
je 0x10031f62
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x1005a478]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x10031ebf
cmp cl, 0xff
je 0x10031ea7
cmp cl, 0xff
je 0x10031f62
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
xor eax, eax
inc eax
lea ebx, [ebp - 0x2c]
call fcn.1001fc7f
mov al, byte [esi + edi]
inc esi
cmp al, 0x3d
je 0x10031f62
movsx eax, al
mov al, byte [eax + 0x1005a478]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x10031eff
cmp al, 0xff
je 0x10031ee2
cmp al, 0xff
je 0x10031f62
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
xor eax, eax
inc eax
lea ebx, [ebp - 0x2c]
call fcn.1001fc7f
mov al, byte [esi + edi]
inc esi
cmp al, 0x3d
je 0x10031f62
movsx eax, al
mov cl, byte [eax + 0x1005a478]
cmp esi, dword [ebp - 0x30]
jae 0x10031f3d
cmp cl, 0xff
je 0x10031f22
cmp cl, 0xff
je 0x10031f62
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
xor eax, eax
inc eax
lea ebx, [ebp - 0x2c]
call fcn.1001fc7f
cmp esi, dword [ebp - 0x30]
jb 0x10031e8b
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.100079b0
lea ecx, [ebp - 0x2c]
call fcn.100079e0
mov eax, dword [ebp - 0x38]
call fcn.1003844d
ret

Function at 0x10032a1d
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x100370e4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10066060]
jne 0x100370ee
repz ret
jmp fcn.1003846b
Function at 0x1003edf9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10038aa6
and dword [ebp - 4], 0
cmp dword [0x10069c74], 0
mov ebx, eax
jne 0x1003eeaa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1003ef5b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1003ef5b
push eax
call fcn.10038a34
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10069c74], eax
call esi
push eax
call fcn.10038a34
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10069c78], eax
call esi
push eax
call fcn.10038a34
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10069c7c], eax
call esi
push eax
call fcn.10038a34
pop ecx
mov dword [0x10069c84], eax
test eax, eax
je 0x1003eeaa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10038a34
pop ecx
mov dword [0x10069c80], eax
mov eax, dword [0x10069c80]
cmp eax, ebx
je 0x1003ef02
cmp dword [0x10069c84], ebx
je 0x1003ef02
push eax
call fcn.10038aaf
push dword [0x10069c84]
mov esi, eax
call fcn.10038aaf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1003ef02
test edi, edi
je 0x1003ef02
call esi
test eax, eax
je 0x1003eef9
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1003eef9
test byte [ebp - 0xc], 1
jne 0x1003ef02
or dword [ebp + 0x10], 0x200000
jmp 0x1003ef3b
mov eax, dword [0x10069c78]
cmp eax, ebx
je 0x1003ef3b
push eax
call fcn.10038aaf
pop ecx
test eax, eax
je 0x1003ef3b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1003ef3b
mov eax, dword [0x10069c7c]
cmp eax, ebx
je 0x1003ef3b
push eax
call fcn.10038aaf
pop ecx
test eax, eax
je 0x1003ef3b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10069c74]
call fcn.10038aaf
pop ecx
test eax, eax
je 0x1003ef5b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1003ef5d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100433a0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10069d98], eax
je 0x100433be
mov eax, 0x10dd
jmp 0x1004349f
mov eax, dword [0x10069da8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1004343c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1004341a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1004341a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10043510
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.100378fa
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x100433c6
mov dword [0x10069da8], 0
call fcn.100434b0
mov ecx, dword [0x10069da4]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x10043489
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.100378fa
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x10043454
mov dword [0x10069da4], 0
mov dword [0x10069d98], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100439e0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100439f5
xor eax, eax
jmp 0x10043a6a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x10043a22
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x10043a65
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x10043a63
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x10043a5f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x10043a63
xor eax, eax
jmp 0x10043a6a
jmp 0x10043a19
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10043b10
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10069d9c], 0
je 0x10043b29
mov eax, dword [0x10069d9c]
jmp 0x10043bc9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10043b3b
xor eax, eax
jmp 0x10043bc9
push 8
call fcn.100379ee
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10043b91
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x10043b7a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100378fa
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x10069d9c], eax
mov dword [0x10069da0], 0
mov eax, dword [ebp - 4]
jmp 0x10043bc9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10043bab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10043b5b
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x10069da4]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x10069da4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100444c0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100446d0
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x10069d8c], 0
jne 0x100444fd
cmp dword [0x10069d88], 0
je 0x100444fd
mov eax, dword [0x10069d88]
mov dword [0x10069d8c], eax
cmp dword [0x10069d8c], 0
je 0x1004457a
mov ecx, dword [0x10069d8c]
cmp dword [ecx + 8], 0
je 0x1004457a
mov edx, dword [0x10069d8c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x1004457a
mov ecx, dword [0x10069d8c]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1004457a
mov eax, dword [0x10069d8c]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x10044549
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x10044550
xor eax, eax
jmp 0x100446c0
mov ecx, dword [0x10069d8c]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10039730
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x100446c0
mov edx, dword [0x10069d88]
mov dword [0x10069d8c], edx
jmp 0x10044596
mov eax, dword [0x10069d8c]
mov ecx, dword [eax + 4]
mov dword [0x10069d8c], ecx
cmp dword [0x10069d8c], 0
je 0x100445d6
cmp dword [0x10069d8c], 0
je 0x100445d4
mov edx, dword [0x10069d8c]
cmp dword [edx + 8], 0
je 0x100445d4
mov eax, dword [0x10069d8c]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x100445d4
mov edx, dword [0x10069d8c]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x100445d4
jmp 0x1004452e
jmp 0x10044588
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jne 0x10044607
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.100448b0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10044620
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100447b0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100446be
mov ecx, dword [ebp - 4]
mov dword [0x10069d8c], ecx
mov edx, dword [0x10069d8c]
mov dword [edx], 0x52727464
mov eax, dword [0x10069d8c]
mov dword [eax + 8], 0
mov ecx, dword [0x10069d8c]
mov edx, dword [0x10069d88]
mov dword [ecx + 4], edx
mov eax, dword [0x10069d8c]
mov dword [0x10069d88], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [0x10069d8c]
add ecx, 0x48
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0x38c
jmp 0x10044689
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 1
jle 0x100446ad
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ecx + eax + 0x40], edx
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x10044680
mov ecx, dword [0x10069d8c]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 8], edx
jmp 0x1004452e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100447b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10044880
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10044875
mov edx, dword [ebp - 4]
cmp edx, dword [0x10066cd0]
jb 0x100447f5
mov eax, dword [ebp - 4]
cmp eax, dword [0x10066cd4]
ja 0x100447f5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100447c5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.10039730
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004481b
jmp 0x10044875
cmp dword [ebp - 0x10], 0x10000
jne 0x1004485e
cmp dword [ebp - 0x14], 0x10000
jb 0x1004485e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10044851
mov eax, dword [ebp - 0x24]
jmp 0x10044877
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10044870
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10044880
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100447c5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100448b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10044990
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1004497d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10066cd0]
jb 0x100448fa
mov eax, dword [ebp - 4]
cmp eax, dword [0x10066cd4]
ja 0x100448fa
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100448ca
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.10039730
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10044920
jmp 0x1004497d
cmp dword [ebp - 0x10], 0x10000
jne 0x10044963
cmp dword [ebp - 0x14], 0x10000
jb 0x10044963
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10044956
mov eax, dword [ebp - 0x24]
jmp 0x1004497f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10044978
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10044990
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100448ca
xor eax, eax
mov esp, ebp
pop ebp
ret