joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444320
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x45818c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x4449a9
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x45c270], 0
push ebx
push esi
mov esi, 0x45c278
jne 0x4449d5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x45c290], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x45c270], 1
push dword [0x45c290]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x444a72
push 0x14
push 8
push dword [0x45a934]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x444a9c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x45c274]
test eax, eax
je 0x444a17
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x45c274], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x444aa1
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x45c290]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x45a934]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x444a9c
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8
Function at 0x430560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
je 0x4306b7
jne 0x4306b7
cmp ebx, dword [ebp + 0x850]
mov ecx, dword [0xdd6700]
mov ecx, dword [0x427f94]
sub dword [0xe4b3bc], 1
push 0x100e7c8c
push 0xa71b90
mov dword [0xcfb758], 0
mov dword [0x52ea40], eax
mov edx, dword [0xcc922c]
fiadd word [eax + 0x19]
aas
test eax, 0xc033790a
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
jmp 0x43060e
and ecx, 0xf
jbe 0x430663
lea ebx, [ebx]
cmp esi, edx
je 0x43064d
jne 0x43064d
mov ecx, 0xbe5e30
call dword [0xcd5ccc]
and edi, 0x7fff
aam 0x8e
inc ebx
scasb al, byte es:[edi]
cmp al, 0xd2
inc ecx
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
jae 0x4305b4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4305e8
cmp esi, edx
jb 0x4305b9
push 0x4305b4
ret
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x430713
pop ebp
jmp 0x4307c4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4305b4
push dword [ebp + 0xc]
push dword [ebp + 8]
jmp 0x430776
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
je 0x4305d9
jne 0x4305d9
push 0x4662e8
mov dword [0x112b49dc], eax
push 0x848e30
add byte [ebx + 0x36], ch
add esi, dword [0x69998f00]
call dword [0x104b5130]
push 0xa88478
mov dword [eax + 0xc], 5
cwde
jne 0x4307ce
inc edi
outsd dx, dword [esi]
fisttp word [ecx - 0x77]
inc eax
out 0xff, eax
ret
ret
adc edi, eax
inc esp
xor byte [eax + ebp*2], al
invalid

Function at 0x468d00
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x477670
call fcn.0046d040
call fcn.0046cd0e
movzx esi, ax
push 2
call fcn.0046cb0e
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x468bb7
sub ebx, ebx
jmp 0x468bea
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x468bb3
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x468bb3
sub ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x468bea
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.0046c530
or eax, eax
jne 0x468bfe
push 0x1c
call fcn.00468cd9
pop ecx
call fcn.0046bf93
or eax, eax
jne 0x468c0f
push 0x10
call fcn.00468cd9
pop ecx
call fcn.0046cbf5
and dword [ebp - 4], 0
call fcn.0046c545
or eax, eax
jns 0x468c29
push 0x1b
call fcn.00468cd9
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x5348d0], eax
call fcn.0046cc35
mov dword [0x52f068], eax
call fcn.0046c7f3
test eax, eax
jns 0x468c4f
push 8
call fcn.0046c06e
pop ecx
call fcn.0046ca2c
or eax, eax
jns 0x468c60
push 9
call fcn.0046c06e
pop ecx
push 1
call fcn.0046c0a8
pop ecx
or eax, eax
je 0x468c73
push eax
call fcn.0046c06e
pop ecx
call fcn.0046cfe5
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x468c95
push esi
call fcn.0046c304
call fcn.0046c099
jmp 0x468cca
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.0046d085
ret
call fcn.0046cb5b
jmp 0x468b89
Function at 0x10007585
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x78]
lea ecx, [esp + 0x20]
mov dword [0x102b2cb4], 0x37a
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1000876e
mov dword [esp + 0x18], eax
lea eax, [0x100076b0]
mov ecx, dword [0x102b2cb4]
mov edx, dword [esp + 0x78]
mov dword [esp + 0x30], edx
add ecx, 0xffffdcc0
mov dword [0x102b2cb4], ecx
mov dword [esp + 0x28], 0x125600
mov ecx, dword [0x102b2ca0]
mov dword [esp + 0x60], ecx
mov ecx, dword [0x102b2ca4]
mov dword [esp + 0x50], ecx
mov ecx, dword [0x102b2ca8]
mov dword [esp + 0x40], ecx
mov ecx, dword [0x102b2cac]
mov dword [esp + 0x58], ecx
mov ecx, dword [0x102b2cb0]
mov dword [esp + 0x70], ecx
mov dword [0x102b2cb8], 0x1a2
mov dword [esp + 0x14], eax
jmp 0x10007648
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10007648
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x10007659
jmp 0x1000761e
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x10007632
jmp 0x1000761e
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x5c], ecx
mov dword [0x102b2cb4], 0xd16
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x64], esi
mov esi, dword [esp + 0x80]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.100085f1
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x102b2cb4], 0x4fd
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x10007cd0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov edi, dword [0x102b2cb8]
add edi, 0x1064
mov dword [0x102b2cb4], edi
mov dword [0x102b2cc0], 0
mov byte [0x102b2cc4], 0
mov dword [0x102b2cb8], 0x1215
mov dword [0x102b2cbc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x102b2cbc]
add eax, 1
mov dword [0x102b2cbc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10007d27
xor eax, eax
mov dword [0x102b2cb4], 0x1408
mov dword [0x102b2cbc], 0
mov ecx, dword [0x102b2cb8]
add ecx, 0xffffd9c5
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0xffffdcb5
mov esi, 0x100
mov edi, dword [0x102b2cc0]
mov ebx, dword [ebp - 0x18]
movzx ebx, byte [ebx + eax]
add ebx, edi
mov dword [ebp - 0x28], eax
xor edi, edi
mov dword [ebp - 0x2c], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add ebx, edx
mov eax, ebx
cdq
idiv esi
mov dword [0x102b2cc0], edx
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x28]
mov bl, byte [esi + ebx]
mov byte [0x102b2cc4], bl
mov dword [0x102b2cb8], ecx
mov bl, byte [esi + edx]
mov ecx, dword [ebp - 0x28]
mov byte [esi + ecx], bl
mov edx, dword [0x102b2cb4]
add edx, 0x2328
mov dword [0x102b2cb4], edx
mov bl, byte [0x102b2cc4]
mov edx, dword [0x102b2cc0]
mov byte [esi + edx], bl
mov dword [0x102b2cb8], 0x2f0
mov edx, dword [0x102b2cbc]
add edx, 1
mov dword [0x102b2cbc], edx
cmp edx, 0x100
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
jl 0x10007d75
mov dword [0x102b2cb8], 0x2133
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007e46
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x2c87
mov ebx, 0x1d5a
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [0x102b2cbc], 0
mov dword [0x102b2cc0], 0
mov dword [0x102b2cc8], 0
mov dword [0x102b2cb4], 0x1d5a
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], edi
je 0x10007fdb
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov edi, 0x100
add ecx, 1
mov dword [ebp - 0x38], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
idiv edi
mov dword [0x102b2cbc], edx
mov ecx, dword [ebp - 0x2c]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x3c]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x40], edx
cdq
idiv edi
mov dword [0x102b2cc0], edx
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x40]
mov cl, byte [ecx + edi]
mov byte [0x102b2cc4], cl
add esi, 0xfffff6df
mov dword [0x102b2cb4], esi
mov esi, dword [ebp - 0x2c]
mov cl, byte [esi + edx]
mov byte [esi + edi], cl
mov dword [0x102b2cb8], 0x63b
mov cl, byte [0x102b2cc4]
mov edx, dword [0x102b2cc0]
mov byte [esi + edx], cl
mov dword [0x102b2cb4], 0xbac
mov edx, dword [0x102b2cbc]
movzx edx, byte [esi + edx]
mov ebx, dword [0x102b2cc0]
movzx ebx, byte [esi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x102b2cc8], ebx
mov dword [0x102b2cb4], 0x1236
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x38]
mov cl, byte [edx + ecx]
xor cl, byte [esi + ebx]
mov ebx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x38]
mov byte [ebx + edx], cl
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x44], edx
je 0x10007fce
mov eax, dword [0x102b2cbc]
mov ecx, dword [0x102b2cc0]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [0x102b2cb4]
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
jmp 0x10007ec4
mov eax, dword [0x102b2cb4]
add eax, 0xf2d
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [0x102b2cb4], eax
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008128
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.10007feb
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x10008164
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x102b2cb4], 0xfffff751
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + eax + 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x24]
mov ebx, dword [esi + edi + 0x24]
mov dword [0x102b2cb8], 0xffffe77b
mov edx, dword [esi + edi + 0x18]
cmp edx, 0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
je 0x10008293
jmp 0x10008236
mov al, byte [ebp - 0x39]
test al, 1
jne 0x1000827a
jmp 0x10008210
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x39]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x48], eax
jne 0x10008248
jmp 0x100081bd
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
xor edx, edx
mov esi, dword [ebp - 0x34]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x48], edx
jmp 0x10008248
xor eax, eax
mov ecx, dword [ebp - 0x54]
add ecx, 2
mov edx, dword [ebp - 0x58]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x38], eax
jb 0x100081f4
jmp 0x10008293
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], ecx
jmp 0x100081f4
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x5c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x39], cl
je 0x100081bd
jmp 0x100081ca
mov eax, dword [ebp - 0x54]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x38]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100085f1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [0x102b2cb8]
add esi, 0xfffff0b4
mov dword [0x102b2cb8], esi
mov dword [0x102b2cb4], 0x13ed
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x102777e8]
mov dh, byte [eax + 0x102777b9]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
je 0x1000870d
jmp 0x10008625
mov eax, dword [ebp - 0x34]
mov ecx, dword [0x102b2cb4]
add ecx, 0xffffe855
mov dword [0x102b2cb4], ecx
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.10007a0b
xor eax, eax
mov dword [0x102b2cb8], 0x26a5
mov ecx, dword [ebp - 0x38]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x48], ecx
mov ecx, dword [ebp - 0x38]
mov dword [edx + 0x1c], ecx
mov esi, dword [0x102b2cb8]
add esi, 0x236
mov dword [0x102b2cb4], esi
add ecx, 0x109a
mov esi, dword [ebp - 0x38]
cmp esi, 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x10008704
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x54
pop esi
pop ebp
ret
lea eax, [ebp - 0x24]
mov dword [0x102b2cb8], 0x18e3
mov dword [ebp - 0x44], eax
call fcn.100083ba
mov dword [esp], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
call fcn.1000849f
cmp eax, 0
sete cl
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x45], cl
mov al, byte [ebp - 0x45]
test al, 1
jne 0x1000874b
jmp 0x10008655
xor eax, eax
add esp, 0x54
pop esi
pop ebp
ret
Function at 0x10003f70
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x100d9140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x2e8], edx
mov dword [ebp - 0x2ec], ecx
mov byte [ebp - 0x2e1], 1
push edi
nop dword [eax]
xor ebx, ebx
xor esi, esi
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0
push eax
push 0
push 0
push 0x81a
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ntdll.dll_NtGetNextThread]
mov edi, eax
test esi, esi
je 0x10003fe5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
js 0x100040af
mov esi, dword [ebp - 0x2d8]
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadId]
mov edi, eax
test edi, edi
je 0x10003fb0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp edi, eax
je 0x10003fb0
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10003fb0
test eax, eax
je 0x1000402c
cmp byte [ebp - 0x2e1], 0
jne 0x1000402c
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10003fb0
push 0x2c8
lea eax, [ebp - 0x2d0]
push 0
push eax
call fcn.10036e20
add esp, 0xc
mov dword [ebp - 0x2d4], 0x10007
lea eax, [ebp - 0x2d4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10003fb0
mov eax, dword [ebp - 0x2e8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x1000409b
lea edx, [ebp - 0x2dc]
mov dword [ebp - 0x2e0], esi
push edx
lea eax, [ebp - 0x2d4]
mov dword [ebp - 8], edi
lea edx, [ebp - 0x2e0]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ecx]
push edx
lea edx, [ebp - 8]
push edx
call dword [eax + 8]
lea eax, [ebp - 0x2d4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
inc ebx
jmp 0x10003fb0
mov byte [ebp - 0x2e1], 0
test ebx, ebx
jne 0x10003fa0
mov ecx, dword [ebp - 0x2ec]
mov ecx, dword [ecx + 0x24]
test ecx, ecx
je 0x100040d0
mov eax, dword [ecx]
call dword [eax + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
nop dword [eax + eax]
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0
push eax
push 0
push 0
push 0x81a
push esi
call ebx
push eax
call dword [sym.imp.ntdll.dll_NtGetNextThread]
mov edi, eax
test esi, esi
je 0x10004111
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
js 0x1000413b
mov esi, dword [ebp - 0x2d8]
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadId]
mov edi, eax
test edi, edi
je 0x100040e0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp edi, eax
je 0x100040e0
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x100040e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10034fda
mov esp, ebp
pop ebp
ret
Function at 0x10004150
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100d9140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push esi
push edi
push eax
push 0x40
mov esi, ecx
mov edi, edx
push ebx
mov dword [ebp - 8], esi
mov dword [ebp - 8], esi
push edi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000419f
mov byte [esi + 0xc], al
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034fda
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x18]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
cmp esi, ecx
je 0x100041dc
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi], edi
mov dword [esi + 4], ebx
mov byte [esi + 0xc], 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034fda
mov esp, ebp
pop ebp
ret
mov byte [esi + 0xc], 1
test edi, edi
je 0x100041f8
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10034fda
mov esp, ebp
pop ebp
ret

Function at 0x100055c0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 8], ebx
lea esi, [edi + 0x20]
mov al, byte [edx + 0xc]
test al, 0x60
je 0x100055f9
movzx eax, al
shr eax, 5
and eax, 3
mov ecx, dword [eax*8 + 0x100a35b0]
or dword [esi], ecx
mov eax, dword [eax*8 + 0x100a35b4]
or dword [esi + 4], eax
mov al, byte [edx + 0xd]
lea ecx, [edx + 0xd]
mov dword [ebp - 0xc], ecx
test al, 3
je 0x10005630
movzx ecx, al
and ecx, 3
mov eax, dword [ecx*8 + 0x100b9040]
or dword [esi], eax
mov eax, dword [ecx*8 + 0x100b9044]
or dword [esi + 4], eax
lea eax, [edi + 0x20]
mov ecx, dword [ebp - 0xc]
add edx, 0xd
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
jmp 0x10005638
mov dword [ebp - 0x10], esi
mov edx, ecx
mov dword [ebp - 0x14], ecx
mov al, byte [ecx]
test al, 0xc
je 0x10005660
movzx ecx, al
shr ecx, 2
and ecx, 3
mov eax, dword [ecx*8 + 0x100cb938]
or dword [esi], eax
mov eax, dword [ecx*8 + 0x100cb93c]
or dword [esi + 4], eax
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edi + 0xc]
jmp dword [eax*4 + 0x10005ae0]
Function at 0x100156e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100d9140]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push esi
mov esi, edx
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0x18]
push eax
test cl, cl
je 0x10015762
call fcn.10029ee0
mov eax, dword [ebp - 0x10]
mov ecx, dword [0x100de280]
cmp byte [eax + 0xd], 0
jne 0x1001571b
cmp esi, dword [eax + 0x10]
jae 0x1001571d
mov eax, ecx
cmp eax, ecx
je 0x100157cf
lea eax, [ebp - 8]
push eax
call fcn.1001b590
mov esi, eax
lea eax, [ebp - 8]
push eax
call fcn.1001b590
push esi
push dword [eax]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
call fcn.1001b650
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034fda
mov esp, ebp
pop ebp
ret
call fcn.10029ee0
mov eax, dword [ebp - 0x10]
mov ecx, dword [0x100de280]
cmp byte [eax + 0xd], 0
jne 0x1001577b
cmp esi, dword [eax + 0x10]
jae 0x1001577d
mov eax, ecx
cmp eax, ecx
jne 0x100157cf
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0x40
push dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
test eax, eax
jne 0x100157c1
lea eax, [ebp - 0xc]
push eax
push 4
push dword [ebp + 8]
push dword [ebp - 8]
call esi
test eax, eax
jne 0x100157c1
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034fda
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.1001b590
mov dword [eax], esi
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10034fda
mov esp, ebp
pop ebp
ret