joyce8/EMBER2024-capa huggingface dataset:
Function at 0x721a94
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x721c4b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
push 0x15
push edx
push esi
call sub.KERNEL32.DLL_FindResourceA
mov ebx, eax
test ebx, ebx
je 0x721c32
lea eax, [ebp - 0x111]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
setne al
neg al
sbb eax, eax
call fcn.006961d0
lea eax, [ebp - 0x216]
push eax
push 0
push 0x721c5c
lea eax, [ebp - 0x111]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
setne al
neg al
sbb eax, eax
call fcn.006961d0
xor eax, eax
push ebp
push 0x721c2b
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push esi
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x721c0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_LockResource
mov edi, eax
test edi, edi
je 0x721bf3
xor eax, eax
push ebp
push 0x721bec
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
lea edx, [ebp - 0x21c]
lea eax, [ebp - 0x216]
call fcn.006920b4
mov ecx, dword [ebp - 0x21c]
mov dl, 1
mov eax, dword [0x680880]
call fcn.00684764
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x721bc0
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push esi
call sub.KERNEL32.DLL_SizeofResource
mov ecx, eax
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.00684568
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x721bc7
mov eax, dword [ebp - 8]
call fcn.00699c7c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x721c11
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_FreeResource
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x721c52
lea eax, [ebp - 0x21c]
call fcn.0069a934
ret
Function at 0x7223e4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xa0], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x722521
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call sub.KERNEL32.DLL_GetVersionExA
mov eax, dword [ebp - 0x8c]
sub eax, 1
jb 0x722430
je 0x722439
dec eax
je 0x722478
jmp 0x722483
mov dword [ebp - 5], 0x73323303
jmp 0x722483
and dword [ebp - 0x90], 0xffff
cmp dword [ebp - 0x98], 4
ja 0x72245e
cmp dword [ebp - 0x98], 4
jne 0x72246b
cmp dword [ebp - 0x94], 0xa
jb 0x72246b
mov esi, 0x722530
lea edi, [ebp - 5]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x722483
mov esi, 0x722534
lea edi, [ebp - 5]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x722483
mov esi, 0x722538
lea edi, [ebp - 5]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 5]
mov dword [ebp - 0xc8], eax
mov byte [ebp - 0xc4], 4
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xc0], eax
mov byte [ebp - 0xbc], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 0xb4], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0
lea eax, [ebp - 0x88]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 6
lea edx, [ebp - 0xc8]
mov ecx, 4
mov eax, 0x722544
call fcn.006925fc
mov eax, dword [ebp - 0xa0]
mov edx, ebx
call fcn.00691024
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x722528
lea eax, [ebp - 0xa0]
call fcn.0069a934
ret

Function at 0x73c890
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x156], 0
jne 0x73c981
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x73c981
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x150]
test ebx, ebx
je 0x73c8cf
cmp byte [ebx + 0x51], 0
jne 0x73c981
mov eax, dword [ebp - 4]
cmp byte [eax + 0x138], 0
jne 0x73c8ed
mov eax, dword [ebp - 4]
mov byte [eax + 0x178], 2
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x78]
xor edx, edx
push ebp
push 0x73c97a
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
call sub.KERNEL32.DLL_GetTickCount
mov edx, eax
sub edx, ebx
cmp edx, 0x14
jge 0x73c914
cmp ebx, eax
jle 0x73c902
mov eax, dword [ebp - 4]
cmp dword [eax + 0x128], 0
jne 0x73c92c
mov eax, dword [ebp - 4]
mov bx, 0xffec
call fcn.00699e58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x73c981
mov eax, dword [ebp - 4]
mov byte [eax + 0x178], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x128], 0
jne 0x73c959
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x78]
jmp 0x73c979
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x138]
xor dl, 1
mov eax, dword [ebp - 4]
call sym.MassSender.exe__Rxctrls_TRxSpeedButton_SetDown_qqro
mov eax, dword [ebp - 4]
mov bx, 0xffec
call fcn.00699e58
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x744d2c
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x744dbf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov esi, eax
and esi, 0xffff
push 0
push 0
push 0x1004
push esi
call sub.KERNEL32.DLL_GetLocaleInfoA
mov ebx, eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.0069aee8
push ebx
mov eax, dword [ebp - 8]
call fcn.0069ad78
push eax
push 0x1004
push esi
call sub.KERNEL32.DLL_GetLocaleInfoA
call sub.KERNEL32.DLL_GetACP
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0069155c
mov ebx, eax
mov ecx, dword [ebp - 4]
mov edx, edi
mov eax, ebx
call sym.MassSender.exe__Rvuni_RVU_AnsiToUnicode_qqruix17System_AnsiString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x744dc6
lea eax, [ebp - 8]
call fcn.0069a934
ret
Function at 0x7731a4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 1
je 0x7731cb
push ebx
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x773354
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_SaveDC
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x77334d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x77321a
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_SaveDC
mov esi, eax
test edi, edi
je 0x773210
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, ebx
call edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_RestoreDC
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.USER32.DLL_GetWindowRect
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.USER32.DLL_ClientToScreen
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 4
je 0x773332
mov edx, dword [ebp - 4]
test al, 8
je 0x773296
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x77327b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00658248
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x14
push ebx
call sub.USER32.DLL_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_RestoreDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_SaveDC
mov esi, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x7732b8
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00658248
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
push 0x318
push ebx
call sub.USER32.DLL_SendMessageA
push esi
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_RestoreDC
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00658248
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 0x10
je 0x773310
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x28], 0x1e
lea eax, [ebp - 0x34]
push eax
push 0x7730e0
push ebx
call sub.USER32.DLL_EnumChildWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test al, 0x20
je 0x773332
mov byte [ebp - 0x34], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x34]
push eax
push 0x7730e0
call sub.USER32.DLL_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x773354
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_RestoreDC
ret
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x77b79c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, ecx
mov dword [ebp - 8], eax
dec edx
mov eax, edx
shl eax, 2
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
je 0x77b809
xor eax, eax
push ebp
push 0x77b802
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x77b809
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_VirtualProtect
ret
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x781d28
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00781c28
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x781ed6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x680958]
call fcn.00699c4c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x781eb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x54]
xor eax, eax
mov dword [ebp - 0x14], eax
call fcn.0067f938
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
call fcn.0067f224
xor eax, eax
push ebp
push 0x781e9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
call fcn.0067f198
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
call sub.USER32.DLL_SetClipboardData
cmp dword [ebp - 0x14], 0
je 0x781dce
mov eax, dword [ebp - 0x14]
push eax
push 9
call sub.USER32.DLL_SetClipboardData
mov eax, dword [ebp - 8]
call fcn.006844f8
push eax
mov eax, dword [0x7c97d0]
movzx eax, word [eax]
push eax
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x781e6e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x781e64
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x781e5d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 8]
call fcn.006844f8
mov ecx, eax
mov edx, ebx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [ebp - 0xc]
push eax
movzx eax, word [sym.MassSender.exe__Clipicon_CF_ICON]
push eax
call sub.USER32.DLL_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x781e64
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x781e86
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x781ea3
mov eax, dword [ebp - 0x18]
call fcn.0067f1f8
ret
Function at 0x781ee4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, eax
call fcn.0067f938
mov dx, word [sym.MassSender.exe__Clipicon_CF_ICON]
call fcn.0067f900
test al, al
je 0x781fee
call fcn.0067f938
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.0067f224
xor eax, eax
push ebp
push 0x781fe7
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [sym.MassSender.exe__Clipicon_CF_ICON]
push eax
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x781fca
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x680958]
call fcn.00699c4c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x781fac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_GlobalSize
mov ecx, eax
mov edx, esi
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 8]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x50]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x781fb3
mov eax, dword [ebp - 4]
call fcn.00699c7c
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001c50
Capabilities:
Log keystrokes via application hook

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov edi, eax
push 0
push edi
push 0x10001af0
push 0xe
call esi
push 0
push edi
push 0x10001b50
push 0xd
mov dword [0x1000a788], eax
call esi
mov dword [0x1000a78c], eax
call fcn.10002850
test eax, eax
je 0x10001c92
pop edi
xor eax, eax
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x1000a798
push 0x10001b90
push esi
call fcn.10002990
test eax, eax
jne 0x10001c8d
push esi
call fcn.10002db0
test eax, eax
jne 0x10001c8d
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 0x1000a784
push 0x10001bf0
push esi
call fcn.10002990
test eax, eax
jne 0x10001c8d
push esi
call fcn.10002db0
test eax, eax
jne 0x10001c8d
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x1000a780
push 0x10001c10
push esi
call fcn.10002990
test eax, eax
jne 0x10001c8d
push esi
call fcn.10002db0
test eax, eax
jne 0x10001c8d
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x1000a790
push 0x10001c30
push esi
call fcn.10002990
test eax, eax
jne 0x10001c8d
push esi
call fcn.10002db0
neg eax
pop edi
sbb eax, eax
inc eax
pop esi
ret
Function at 0x100037a0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10003560
add esp, 4
test eax, eax
jne 0x100037fc
mov dword [ebp - 4], 9
jmp 0x10003889
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x10003889
mov dword [ebp - 8], 0
jmp 0x1000381a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10003889
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.10005e3f
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10003887
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.10005e3f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.10003380
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10005e3f
jmp 0x10003811
mov eax, dword [ebp - 4]
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.10005e3f
mov esp, ebp
pop ebp
ret

Function at 0x100038a0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1000394b
mov dword [ebp - 4], 0
jmp 0x100038d3
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x1000392e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.10005e3f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000392c
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.10005e3f
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10005e3f
jmp 0x100038ca
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x1000a404]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.10005e3f
pop esi
add esp, 8
cmp ebp, esp
call fcn.10005e3f
mov esp, ebp
pop ebp
ret
Function at 0x10003960
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x1000a7b0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100039c3
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10005e3f
test eax, eax
jne 0x100039ee
mov eax, 0xa
jmp 0x10003af0
cmp dword [ebp + 0xc], 0
je 0x10003a3a
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x10003a38
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x10003a76
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10003a61
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x10003a76
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10005e3f
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.10005e3f
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.10005e3f
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x10003b14]
call fcn.10005de9
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.10005e3f
mov esp, ebp
pop ebp
ret
Function at 0x100041c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x1000a7a8]
mov dword [ebp - 4], eax
jmp 0x100041e7
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10004200
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100041fe
mov eax, dword [ebp - 4]
jmp 0x10004284
jmp 0x100041df
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.10005e3f
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10004281
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x10004243
mov edx, dword [ebp - 4]
mov eax, dword [0x1000a7a8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x1000a7a8], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.10005e3f
mov esp, ebp
pop ebp
ret

Function at 0x10004770
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100047c0
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100047c0
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100047c0
xor eax, eax
jmp 0x10004801
mov dword [ebp - 4], 1
jmp 0x100047d2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100047fc
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x100047fa
xor eax, eax
jmp 0x10004801
jmp 0x100047c9
mov eax, 1
mov esp, ebp
pop ebp
ret