joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ae70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
mov ecx, edi
shr ecx, 2
lea ecx, [eax + ecx*4]
mov ebx, ecx
sub ebx, eax
add ebx, 3
shr ebx, 2
cmp eax, ecx
cmova ebx, edx
mov edx, dword [ebp + 8]
test ebx, ebx
je 0x48af15
cmp ebx, 8
jb 0x48aef7
lea ecx, [eax - 4]
lea ecx, [ecx + ebx*4]
cmp edx, ecx
ja 0x48aeb7
lea ecx, [edx - 4]
lea ecx, [ecx + ebx*4]
cmp ecx, eax
jae 0x48aef7
movdqa xmm1, xmmword [0x4cde90]
mov ecx, ebx
and ecx, 7
mov dword [ebp + 0x10], ebx
sub dword [ebp + 0x10], ecx
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx]
movdqu xmm0, xmmword [eax]
add esi, 8
pxor xmm0, xmm1
movdqu xmmword [edx], xmm0
movdqu xmm0, xmmword [eax + 0x10]
add eax, 0x20
pxor xmm0, xmm1
movdqu xmmword [edx + 0x10], xmm0
add edx, 0x20
cmp esi, ecx
jb 0x48aed0
cmp esi, ebx
jae 0x48af15
jmp 0x48af00
mov ecx, dword [eax]
inc esi
xor ecx, 0xc2c2c2c2
add eax, 4
mov dword [edx], ecx
add edx, 4
cmp esi, ebx
jb 0x48af00
and edi, 3
je 0x48af2f
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
lea eax, [eax + 1]
xor cl, 0xc2
mov byte [edx + eax - 1], cl
dec edi
jne 0x48af20
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x495940
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0xa0], 0
jne 0x495957
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esi], 0
jne 0x495950
mov eax, dword [esi + 0x7c]
sub eax, dword [esi + 0x78]
test eax, 0xfffffffc
je 0x495950
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x495c90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 1
push eax
mov dword [esi + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x497fa0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb2b9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4faa80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x500af4
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 5
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x2c]
mov dword [esi], vtable.TiXmlDeclaration.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x500af4
mov dword [esi + 0x30], 0x500af4
mov dword [esi + 0x34], 0x500af4
mov edi, dword [ebp + 8]
mov edx, edi
mov byte [ebp - 4], 3
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x498041
sub edx, ebx
push edx
push edi
call fcn.00497c80
mov edi, dword [ebp + 0xc]
mov edx, edi
lea ecx, [edx + 1]
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x498060
sub edx, ecx
lea ecx, [esi + 0x30]
push edx
push edi
call fcn.00497c80
mov edi, dword [ebp + 0x10]
mov edx, edi
lea ecx, [edx + 1]
jmp 0x498080
mov al, byte [edx]
inc edx
test al, al
jne 0x498080
sub edx, ecx
lea ecx, [esi + 0x34]
push edx
push edi
call fcn.00497c80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x498220
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb323
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4faa80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x500af4
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x500af4
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x4cd308
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00497c80
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a9fd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4a9fdc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004a9ff0

Function at 0x4aac90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
lea ecx, [ecx]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp + 8], edx
cmp dword [edi + 0x6c], eax
jb 0x4aad1c
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.004aed70
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x4aacef
sub eax, esi
jmp 0x4aacf1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x4aace0
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x4aad0f
sub eax, esi
jmp 0x4aad11
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x4aad00
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x4aadd1
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x4aad49
xor eax, eax
jmp 0x4aad95
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x4aad66
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004a9250
jmp 0x4aad76
cmp eax, 2
jne 0x4aad7f
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.004a9fd0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 0x30], eax
push ecx
push dword [ebx]
push dword [ebp - 4]
call fcn.004aed70
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x4aadbd
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x4aadd1
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x4aaca0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c05ee
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4faa80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004b9ab0
mov dword [ebp - 0x14], eax
cmp dword [0x501d1c], esi
jne 0x4c06e1
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4c066e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4c07c1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4c07c1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c07c1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x501d1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x501d20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x501d24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x501d2c], eax
test eax, eax
je 0x4c06de
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x501d28], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4c0706
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4c06f9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4c071b
push 4
pop eax
jmp 0x4c07c3
cmp dword [ebp - 0x14], esi
je 0x4c071b
push dword [0x501d1c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4c0700
mov eax, dword [0x501d28]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4c0779
cmp dword [0x501d2c], edi
je 0x4c0779
push eax
call ebx
push dword [0x501d2c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4c0779
test eax, eax
je 0x4c0779
call ecx
test eax, eax
je 0x4c076e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4c076e
test byte [ebp - 8], 1
jne 0x4c0779
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4c07a9
mov eax, dword [0x501d20]
cmp eax, edi
je 0x4c07a6
push eax
call ebx
test eax, eax
je 0x4c07a6
call eax
mov esi, eax
test esi, esi
je 0x4c07a6
mov eax, dword [0x501d24]
cmp eax, edi
je 0x4c07a6
push eax
call ebx
test eax, eax
je 0x4c07a6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x501d1c]
call ebx
test eax, eax
je 0x4c07c1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4c07c3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ae734
mov esp, ebp
pop ebp
ret
Function at 0x3ad7258d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3ad7a064]
jne 0x3ad72597
repz ret
jmp fcn.3ad73d0c

Function at 0x3ad76a41
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x3ad76a50
pop dword [ebp - 0x40]
mov eax, 0x4f582860
add eax, 0xeb7f41f0
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x38220
push 0
mov eax, 0x3d6c3d00
add eax, 0xfd6ad3b4
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xf46b6004
sub ecx, 0xf46b15d8
mov edi, eax
mov esi, 0x3ad88e00
add esi, dword [ebp - 0x40]
mov ebx, 0x89899c2b
sub ebx, 0x2fe0f281
xor dword [ebp - 0x30], 0x70392ea1
mov edx, dword [esi]
sub edx, ebx
mov dword [ebp - 0x18], 0x48bff389
mov dword [edi], edx
xor dword [ebp - 0xc], edx
add edi, 4
add esi, 0xa3da5b54
add esi, 0x5c25a4b0
loop 0x3ad76aa9
add eax, 0x918edf47
add eax, 0x6e723c3c
mov ebx, eax
add eax, 0x162cf8d5
add eax, 0xe9d30730
mov ecx, 0x7c59fd98
sub ecx, 0x4182fd98
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00409a27
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00409a27
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00409a27
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00409a27
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00409a27
mov dword [0x41203c], eax
call fcn.00409a27
test eax, eax
jge 0x402550
push 8
call fcn.00409a27
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00409a27
pop ecx
push 1
call fcn.00409a27
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00409a27
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00409a27
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00409a27
jmp 0x402495

Function at 0x409a27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x409a36
pop dword [ebp - 0x1c]
mov eax, 0x409a36
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x35d76
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x47926652
add ecx, 0xb86dd417
xor edx, edx
add edx, eax
mov ebx, 0x413bc4
add ebx, dword [ebp - 0x1c]
mov esi, 0x25a327c4
sub esi, 0x66d516c
mov dword [ebp - 0x10], 0x1ff72039
mov edi, dword [ebx]
mov dword [ebp - 0x10], 0x2199ab74
xor edi, esi
add dword [ebp - 4], edi
mov dword [edx], edi
xor dword [ebp - 8], ecx
add edx, 4
add ebx, 0x90622964
sub ebx, 0x90622960
loop 0x409a87
add eax, 0xdc77
xor ebx, ebx
add ebx, eax
add eax, 0x5369231
add eax, 0xfac96dd4
mov ecx, 0x4e88b730
sub ecx, 0x4e48b730
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x10003e70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov esi, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 4]
push edx
lea ecx, [ebp + 8]
call fcn.10003d70
mov ecx, eax
call fcn.10002f90
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1003ad24
test eax, eax
je 0x10003ebf
mov dword [ebp - 8], 1
jmp 0x10003ec6
mov dword [ebp - 8], 0
movzx eax, byte [ebp - 8]
pop esi
add esp, 8
cmp ebp, esp
call fcn.1003ad24
mov esp, ebp
pop ebp
ret

Function at 0x10004de0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x1004b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1003ad24
mov eax, dword [ebp + 0xc]
push eax
push 0x90
mov ecx, dword [ebp + 8]
push ecx
call fcn.10020fb0
add esp, 0xc
mov esi, esp
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1003ad24
push edx
mov ecx, ebp
push eax
lea edx, [0x10004e80]
call fcn.1003acd0
pop eax
pop edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001cf2e
add esp, 0x10
cmp ebp, esp
call fcn.1003ad24
mov esp, ebp
pop ebp
ret

Function at 0x10007830
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x1004b040]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1003ad24
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100209a0
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1003ad24
push edx
mov ecx, ebp
push eax
lea edx, [0x100078cc]
call fcn.1003acd0
pop eax
pop edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001cf2e
add esp, 0x10
cmp ebp, esp
call fcn.1003ad24
mov esp, ebp
pop ebp
ret
Function at 0x1000e970
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x1004e4fc]
mov dword [ebp - 4], eax
jmp 0x1000e997
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1000e9b0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1000e9ae
mov eax, dword [ebp - 4]
jmp 0x1000ea34
jmp 0x1000e98f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1003ad24
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000ea31
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x1000e9f3
mov edx, dword [ebp - 4]
mov eax, dword [0x1004e4fc]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1004e4fc], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.1003ad24
mov esp, ebp
pop ebp
ret
Function at 0x10010060
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.1000fe10
add esp, 4
test eax, eax
jne 0x100100bc
mov dword [ebp - 4], 9
jmp 0x10010149
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x10010149
mov dword [ebp - 8], 0
jmp 0x100100da
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10010149
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1003ad24
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10010147
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.1003ad24
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.1000fc30
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1003ad24
jmp 0x100100d1
mov eax, dword [ebp - 4]
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.1003ad24
mov esp, ebp
pop ebp
ret

Function at 0x10010160
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1001020b
mov dword [ebp - 4], 0
jmp 0x10010193
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x100101ee
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1003ad24
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100101ec
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.1003ad24
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1003ad24
jmp 0x1001018a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x1004e15c]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.1003ad24
pop esi
add esp, 8
cmp ebp, esp
call fcn.1003ad24
mov esp, ebp
pop ebp
ret
Function at 0x10010c30
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10010c79
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x10010c79
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x10010c79
xor eax, eax
jmp 0x10010cba
mov dword [ebp - 4], 1
jmp 0x10010c8b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10010cb5
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x10010cb3
xor eax, eax
jmp 0x10010cba
jmp 0x10010c82
mov eax, 1
mov esp, ebp
pop ebp
ret