joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435d70
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x443104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x5c], eax
lea edi, [eax + 4]
mov edx, 0x440240
mov dword [ebp - 0x60], edi
mov ecx, edi
mov esi, 0x1e
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4051c2
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4051b1
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x4051e9
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x4051e9
cmp esi, 0xfffffffe
je 0x4051e5
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x4051e9
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x4051e9
xor eax, eax
jmp 0x4051ee
sbb eax, eax
or eax, 1
mov esi, dword [ebp - 0x5c]
add esi, 0x26
test eax, eax
jne 0x405222
mov ecx, esi
lea edi, [eax + 0x1e]
mov edx, 0x440240
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40521f
add ecx, 4
add edx, 4
sub edi, 4
jae 0x405202
mov cx, word [ecx]
cmp cx, word [edx]
je 0x405327
mov edi, dword [ebp - 0x60]
mov edx, edi
lea ecx, [ebp - 0x58]
call fcn.00401b10
lea eax, [ebp - 0x58]
mov edx, esi
push eax
lea ecx, [ebp - 0x34]
call fcn.00401a00
add esp, 4
mov edx, edi
xor ecx, ecx
mov ax, word [ebp + ecx - 0x34]
lea edx, [edx + 2]
xor ax, word [edx - 2]
mov word [ebp + ecx - 0x58], ax
add ecx, 2
cmp ecx, 0x22
jb 0x405241
lea edx, [ebp - 0x58]
lea ecx, [ebp - 0x34]
call fcn.00401e80
xor ecx, ecx
nop word [eax + eax]
movups xmm0, xmmword [ebp + ecx*2 - 0x34]
movups xmm1, xmmword [ebp + ecx*2 - 0x58]
pxor xmm1, xmm0
movups xmmword [ebp + ecx*2 - 0x34], xmm1
add ecx, 8
cmp ecx, 0x10
jb 0x405270
cmp ecx, 0x11
jae 0x4052a0
mov ax, word [ebp + ecx*2 - 0x58]
xor word [ebp + ecx*2 - 0x34], ax
inc ecx
cmp ecx, 0x11
jb 0x405290
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
mov edx, dword [eax]
nop word [eax + eax]
mov ax, word [edx + ecx*2]
xor word [ebp + ecx*2 - 0x34], ax
inc ecx
cmp ecx, 0x11
jb 0x4052b0
xor word [ebp - 0x58], 1
mov edx, esi
movups xmm0, xmmword [ebp - 0x58]
mov ax, word [ebp - 0x38]
mov ecx, esi
movups xmmword [esi], xmm0
movups xmm0, xmmword [ebp - 0x48]
movups xmmword [esi + 0x10], xmm0
mov word [esi + 0x20], ax
lea eax, [ebp - 0x34]
push eax
call fcn.00401a00
add esp, 4
mov edx, edi
mov ecx, edi
call fcn.00401e80
mov ecx, 0x11
nop dword [eax]
mov ax, word [esi - 0x22]
lea esi, [esi + 2]
xor word [esi - 2], ax
sub ecx, 1
jne 0x405300
movups xmm0, xmmword [ebp - 0x34]
mov ax, word [ebp - 0x14]
movups xmmword [edi], xmm0
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [edi + 0x10], xmm0
mov word [edi + 0x20], ax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bcc3
mov esp, ebp
pop ebp
ret
Function at 0x41c978
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41c9b7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c9b7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41c9b7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41c9b7
cmp dword [ecx + 0x74], 0xe
jbe 0x41c9b7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42a4ea
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042a167

Function at 0x433d30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x433d5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x433d5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x6d67113f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x6d67114e
pop dword [ebp - 0x34]
mov eax, 0x2e4e1514
sub eax, 0xc0e703c6
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xce1c1a68
add dword [ebp - 0x44], 0x80362ae3
mov dword [ebp - 0x40], 0x5bd89ad7
sub dword [ebp - 0x40], 0x29a54e92
mov dword [ebp - 0x3c], 0x4757b66d
sub dword [ebp - 0x3c], 0xfb0b723f
mov dword [ebp - 0x38], 0x154fabfd
sub dword [ebp - 0x38], 0x154fabfd
lea eax, [ebp - 0x44]
push eax
mov eax, 0x2551bd14
add eax, 0x48157334
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x7dfe5d15
add dword [ebp - 0x44], 0xf6740c41
mov dword [ebp - 0x40], 0xd63d6a14
sub dword [ebp - 0x40], 0x94d1089f
mov dword [ebp - 0x3c], 0xd495f50d
add dword [ebp - 0x3c], 0x8ed9775f
mov dword [ebp - 0x38], 0xe25171e6
add dword [ebp - 0x38], 0x1dae8e1a
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xc590870b
sub eax, 0x5829570b
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x355ca
push 0
call eax
mov ecx, 0x28e6a821
sub ecx, 0x28e664b1
xor ebx, ebx
add ebx, eax
mov esi, 0x60f3c18e
add esi, 0xc73a072
add esi, dword [ebp - 0x34]
mov edx, 0xddcfbdc9
add edx, 0x34735785
mov edi, dword [esi]
xor dword [ebp - 4], 0x1e04dfe7
add edi, edx
mov dword [ebp - 0x24], 0xf44ab994
mov dword [ebx], edi
sub dword [ebp - 8], ebx
add ebx, 0x366bbee6
add ebx, 0xc994411e
add esi, 4
loop 0x6d671272
add eax, 0x800cbe48
add eax, 0x7ff4424b
mov ebx, eax
add eax, 0x590a8d2c
sub eax, 0x590a8d27
mov ecx, 0xe17a375d
sub ecx, 0x7413375d
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x6d6717f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d6717fb
repz ret
jmp fcn.6d671b91
Function at 0xf44058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00f441a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf4407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf4406a
add dl, dl
jne 0xf44089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf440dc
xor eax, eax
add dl, dl
jne 0xf44096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf4417d
add dl, dl
jne 0xf440a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf440b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf440bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf440c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf440d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf44075
mov eax, 1
add dl, dl
jne 0xf440ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf440f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf440e1
sub eax, ebx
mov ebx, 1
jne 0xf44128
mov ecx, 1
add dl, dl
jne 0xf4410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf44119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf44105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf44075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf4413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf4414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf44136
cmp eax, 0x7d00
jae 0xf4416d
cmp eax, 0x500
jb 0xf44168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf44075
cmp eax, 0x7f
ja 0xf44170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf44075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf4419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf44075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10005da0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10005e21
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [esi]
push 0
push dword [ebp - 0xd0]
mov dword [ebp - 0xcc], eax
push 4
push esi
call edi
xor eax, eax
nop word [eax + eax]
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10005df0
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 0xcc]
push 0
push dword [ebp - 0xd0]
mov dword [esi], eax
push 4
push esi
call edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1005f599
mov esp, ebp
pop ebp
ret 4

Function at 0x10005e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10005e87
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
xor eax, eax
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10005e64
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005f599
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1005f599
mov esp, ebp
pop ebp
ret 4

Function at 0x10005ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060c6d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x1008b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [0x1008b540], 0x10
mov eax, 0x1008b52c
cmovae eax, dword [0x1008b52c]
cmp byte [eax], 0
je 0x10005fba
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
je 0x10005fba
cmp dword [0x1008b1b0], 0x10
mov eax, 0x1008b19c
cmovae eax, dword [0x1008b19c]
cmp byte [eax], 0
je 0x10005fba
mov esi, 0x10091130
mov edx, ecx
sub esi, ecx
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], al
test al, al
jne 0x10005f16
mov edx, 0x1008d910
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10005f30
mov ecx, dword [0x100919c8]
mov edx, 0x1008b52c
cmp dword [0x1008b540], 0x10
push 0x10091130
cmovae edx, dword [0x1008b52c]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
test eax, eax
jne 0x10005fba
mov ecx, 0x98
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x1007c7a8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x10005f8d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x14
jl 0x10005f70
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov eax, dword [0x1008d154]
mov esi, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, dword [0x1008d154]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10005fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060c9d
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1008b00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea esi, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae esi, dword [ebp + 8]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10006010
sub esi, ecx
push esi
call fcn.1005fdf4
add esp, 4
xor edx, edx
mov edi, eax
test esi, esi
js 0x1000603b
nop word [eax + eax]
xor byte [edx + edi], dl
lea ecx, [edx + edi]
inc edx
cmp edx, esi
jle 0x10006030
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10006071
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10006067
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10006067
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1005fde6
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x10007440
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
js 0x10007477
nop
lea eax, [ebp - 8]
push eax
push 0x40
push 4
lea eax, [ebx + esi]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, edi
jle 0x10007460
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005f599
mov esp, ebp
pop ebp
ret 8

Function at 0x10007780
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov ebx, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [edi], ecx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.1005f599
mov esp, ebp
pop ebp
ret 8
Function at 0x100077d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100845e8
push 0x1005f74f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1008b00c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
mov edi, dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0xc]
sub eax, esi
sub eax, 5
mov byte [esi], 0xe8
mov dword [esi + 1], eax
mov eax, 5
mov dword [ebp - 0x28], eax
cmp eax, edi
jae 0x10007842
mov byte [esi + eax], 0x90
inc eax
jmp 0x10007834
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000785c
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005f599
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10012340
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
mov dword [ebp - 0xc], eax
cmp ebx, 0x1000
jbe 0x10012397
test eax, eax
je 0x10012397
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10012396
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1005f599
mov esp, ebp
pop ebp
ret

Function at 0x100123b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [0x10092740]
mov ebx, edx
cmp edi, 0x1000
jbe 0x100123f9
test ebx, ebx
je 0x100123f9
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebx]
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1005f599
mov esp, ebp
pop ebp
ret

Function at 0x100125a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, 0x1000
jbe 0x100125fe
test edi, edi
je 0x100125fe
push esi
push edi
call fcn.1005fdf4
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005f599
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.1005f599
mov esp, ebp
pop ebp
ret 8

Function at 0x10012620
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
call fcn.1005fdf4
add esp, 4
mov ebx, eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ebx
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test edi, edi
jle 0x1001268e
sub ebx, esi
nop dword [eax + eax]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10012672
mov al, byte [esi]
mov byte [ebx + esi], al
inc esi
sub edi, 1
jne 0x10012660
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005f599
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005f599
mov esp, ebp
pop ebp
ret 8
Function at 0x100126b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
call fcn.1005fdf4
add esp, 4
mov ebx, eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x30], ebx
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 8]
mov edi, ebx
lea eax, [esi + ecx]
mov dword [ebp - 0x2c], eax
nop dword [eax]
push 0x1c
lea eax, [ebp - 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x28]
cmp edi, 0x1000
jbe 0x10012741
test ebx, ebx
je 0x10012741
test esi, esi
je 0x10012741
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push ebx
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x28]
lea ecx, [ebx + esi]
add edi, esi
cmp ecx, dword [ebp - 0x2c]
jb 0x100126f0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1005f599
mov esp, ebp
pop ebp
ret 8

Function at 0x10012770
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
cmp edi, 0x1000
jbe 0x100127ae
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov byte [edi], 0xcc
push eax
push dword [ebp - 8]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1005f599
mov esp, ebp
pop ebp
ret 4
Function at 0x100127c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x1008b00c]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
push 0xf
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [esp + 0x10], 0x128
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10012872
nop dword [eax]
mov eax, esi
lea ecx, [esp + 0x34]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10012836
test dl, dl
je 0x10012832
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10012836
add ecx, 2
add eax, 2
test dl, dl
jne 0x10012816
xor eax, eax
jmp 0x1001283b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10012862
push dword [esp + 0x18]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1001285e
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10012810
push edi
call ebx
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005f599
mov esp, ebp
pop ebp
ret

Function at 0x10012890
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10084bf8
push 0x1005f74f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1008b00c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov esi, ecx
mov dword [ebp - 4], 0
cmp esi, 0x1000
jbe 0x1001292a
cmp edi, 0x1000
jbe 0x1001292a
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub edi, esi
sub edi, 5
mov byte [esi], 0xe9
mov dword [esi + 1], edi
mov eax, 5
mov dword [ebp - 0x28], eax
cmp eax, 5
jae 0x1001290f
mov byte [esi + eax], 0x90
inc eax
jmp 0x10012900
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1001292a
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005f599
mov esp, ebp
pop ebp
ret