joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10066c40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
call fcn.1000fef0
mov edi, eax
test edi, edi
je 0x10010272
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0x11], 0x78654e6c
mov word [ebp - 0xb], 0x6f6f
mov word [ebp - 0x13], 0x6c61
mov word [ebp - 8], 0x7845
mov word [ebp - 0xd], 0x4874
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 9], 0x6b
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001026b
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10013dd7
mov esp, ebp
pop ebp
ret

Function at 0x10010290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10066c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x1c], eax
mov esi, 1
call fcn.1000fea0
mov edi, eax
test edi, edi
je 0x1001030b
lea eax, [ebp - 0x14]
push eax
push edi
mov word [ebp - 0xd], 0x654b
mov dword [ebp - 0xb], 0x41784579
mov dword [ebp - 0x12], 0x65704f67
mov word [ebp - 0x14], 0x6552
mov byte [ebp - 7], 0
mov byte [ebp - 0xe], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10010304
push dword [ebp - 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10013dd7
mov esp, ebp
pop ebp
ret

Function at 0x10010390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10066c40]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
mov word [ebp - 0x18], 0x6547
mov dword [ebp - 0x11], 0x54746e65
mov dword [ebp - 0x15], 0x72727543
mov dword [ebp - 0xb], 0x646165
mov word [ebp - 0xd], 0x7268
mov byte [ebp - 0x16], 0x74
call fcn.1000fe50
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100103e9
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013dd7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
or eax, 0xffffffff
call fcn.10013dd7
mov esp, ebp
pop ebp
ret
Function at 0x10010430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10066c40]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.1000fef0
test eax, eax
je 0x10010487
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0xc], 0x736f5077
mov word [ebp - 0x11], 0x6957
mov word [ebp - 0x14], 0x6553
mov word [ebp - 0xe], 0x6f64
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 8], 0
mov byte [ebp - 0xf], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013dd7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10013dd7
mov esp, ebp
pop ebp
ret

Function at 0x100104a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10066c40]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.1000fef0
test eax, eax
je 0x100104fc
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 8], 0x776f64
mov dword [ebp - 0x13], 0x72676572
mov word [ebp - 0xf], 0x756f
mov dword [ebp - 0xc], 0x6e695764
mov dword [ebp - 0x17], 0x6f467465
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0xd], 0x6e
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013dd7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10013dd7
mov esp, ebp
pop ebp
ret

Function at 0x10010510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10066c40]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.1000fef0
test eax, eax
je 0x10010565
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 9], 0x776f646e
mov dword [ebp - 0xd], 0x69576576
mov dword [ebp - 0x11], 0x69746341
mov byte [ebp - 5], 0
mov word [ebp - 0x14], 0x6553
mov byte [ebp - 0x12], 0x74
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013dd7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10013dd7
mov esp, ebp
pop ebp
ret

Function at 0x10010580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10066c40]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.1000fef0
test eax, eax
je 0x100105d7
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x15], 0x6957676e
mov dword [ebp - 0xd], 0x6f546f54
mov word [ebp - 9], 0x70
mov dword [ebp - 0x11], 0x776f646e
mov word [ebp - 0x18], 0x7242
mov byte [ebp - 0x16], 0x69
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013dd7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10013dd7
mov esp, ebp
pop ebp
ret
Function at 0x100108b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10066c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100679e0]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, 0x100679e0
mov dword [ebp - 0x17], 0x5754464f
mov byte [ebp - 0x18], 0x53
mov word [ebp - 0x10], 0x5c
mov word [ebp - 0x13], 0x5241
mov byte [ebp - 0x11], 0x45
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x120], eax
mov eax, str.NSpeedUpTab
test eax, 0xffff0000
jne 0x10010926
movzx esi, ax
push 0
push esi
call fcn.10011400
add esp, 8
test eax, eax
je 0x10010936
push esi
push eax
lea ecx, [ebp - 0x120]
call fcn.10011980
jmp 0x10010936
push str.NSpeedUpTab
lea ecx, [ebp - 0x120]
call fcn.10011280
push edi
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.10011320
lea ecx, [ebp - 0x12c]
push ecx
push 0x20019
push 0
push dword [eax]
push 0x80000001
call fcn.10010290
mov edi, dword [ebp - 0x124]
add edi, 0xfffffff0
or esi, 0xffffffff
add esp, 0x20
mov dword [ebp - 0x128], eax
lea edx, [edi + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10010993
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x120]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
pop edi
test esi, esi
jg 0x100109b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x128], 0
jne 0x10010b07
push 0x103
lea eax, [ebp - 0x11b]
push 0
push eax
mov byte [ebp - 0x11c], 0
call fcn.10013180
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x12c]
mov word [ebp - 9], 0x736c
mov byte [ebp - 7], 0
mov word [ebp - 0xc], 0x7668
mov byte [ebp - 0xa], 0x61
call fcn.100100c0
add esp, 0x24
test eax, eax
jne 0x10010af9
cmp dword [ebp - 0x128], eax
jbe 0x10010af9
mov eax, dword [0x100679e0]
mov ecx, 0x100679e0
call dword [eax + 0xc]
add eax, 0x10
push ebx
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x124]
push 0x10038a0c
push eax
call fcn.100117c0
mov eax, dword [0x100679e0]
add esp, 0xc
mov ecx, 0x100679e0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x120]
push 0x10037be4
push eax
call fcn.100117c0
mov eax, dword [ebp - 0x124]
add esp, 0xc
test eax, eax
je 0x10010ae3
mov esi, dword [ebp - 0x120]
cmp dword [esi - 0xc], 0
jl 0x10010ae3
push eax
push esi
call fcn.100142bc
add esp, 8
test eax, eax
je 0x10010ae3
sub eax, esi
js 0x10010ae3
push dword [ebp - 0x12c]
call fcn.10010320
add esp, 4
lea ecx, [ebp - 0x120]
call fcn.10011260
lea ecx, [ebp - 0x124]
call fcn.10011260
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013dd7
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x120]
call fcn.10011260
lea ecx, [ebp - 0x124]
call fcn.10011260
push dword [ebp - 0x12c]
call fcn.10010320
add esp, 4
push ebx
call dword [0x10067b44]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10013dd7
mov esp, ebp
pop ebp
ret 4
Function at 0x10010b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10066c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100679e0]
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, 0x100679e0
mov word [ebp - 0x12], 0x4552
mov word [ebp - 0x15], 0x5754
mov word [ebp - 0x18], 0x4f53
mov byte [ebp - 0x16], 0x46
mov word [ebp - 0x10], 0x5c
mov byte [ebp - 0x13], 0x41
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x120], eax
mov eax, str.NSpeedUpTab
test eax, 0xffff0000
jne 0x10010b9b
movzx esi, ax
push 0
push esi
call fcn.10011400
add esp, 8
test eax, eax
je 0x10010bab
push esi
push eax
lea ecx, [ebp - 0x120]
call fcn.10011980
jmp 0x10010bab
push str.NSpeedUpTab
lea ecx, [ebp - 0x120]
call fcn.10011280
push ebx
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.10011320
lea ecx, [ebp - 0x12c]
push ecx
push 0x20019
push 0
push dword [eax]
push 0x80000001
call fcn.10010290
mov ebx, dword [ebp - 0x124]
add ebx, 0xfffffff0
or esi, 0xffffffff
add esp, 0x20
mov dword [ebp - 0x128], eax
lea edx, [ebx + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10010c08
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x120]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
pop ebx
test esi, esi
jg 0x10010c26
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x128], 0
jne 0x10010d72
push 0x103
lea eax, [ebp - 0x11b]
push 0
push eax
mov byte [ebp - 0x11c], 0
call fcn.10013180
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x12c]
mov dword [ebp - 0xa], 0x736c61
mov word [ebp - 0xc], 0x7668
call fcn.100100c0
add esp, 0x24
test eax, eax
jne 0x10010d64
cmp dword [ebp - 0x128], eax
jbe 0x10010d64
mov eax, dword [0x100679e0]
mov ecx, 0x100679e0
call dword [eax + 0xc]
add eax, 0x10
push edi
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x124]
push 0x10038a0c
push eax
call fcn.100117c0
mov eax, dword [0x100679e0]
add esp, 0xc
mov ecx, 0x100679e0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x120]
push 0x10037be4
push eax
call fcn.100117c0
mov eax, dword [ebp - 0x124]
add esp, 0xc
test eax, eax
je 0x10010d4e
mov esi, dword [ebp - 0x120]
cmp dword [esi - 0xc], 0
jl 0x10010d4e
push eax
push esi
call fcn.100142bc
add esp, 8
test eax, eax
je 0x10010d4e
sub eax, esi
js 0x10010d4e
push dword [ebp - 0x12c]
call fcn.10010320
add esp, 4
lea ecx, [ebp - 0x120]
call fcn.10011260
lea ecx, [ebp - 0x124]
call fcn.10011260
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013dd7
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x120]
call fcn.10011260
lea ecx, [ebp - 0x124]
call fcn.10011260
push dword [ebp - 0x12c]
call fcn.10010320
add esp, 4
push edi
call dword [0x10067b50]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10013dd7
mov esp, ebp
pop ebp
ret 4
Function at 0x10011000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10066c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x100110d3
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x118]
push eax
call fcn.10014169
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0xe], 0x75732074
mov dword [ebp - 8], 0x74726f
mov dword [ebp - 0x13], 0x6174736e
mov word [ebp - 0xa], 0x7070
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0xf], 0x6e
call fcn.10013e70
add esp, 0xc
test eax, eax
jne 0x10011102
push sym.gphelper.dll__HookSetWindowPos_28
push 0x10067b48
call fcn.10011c90
add esp, 8
test eax, eax
je 0x10011102
push sym.gphelper.dll__HookSetForegroundWindow_4
push 0x10067b44
call fcn.10011c90
add esp, 8
test eax, eax
je 0x10011102
push sym.gphelper.dll__HookSetActiveWindow_4
push 0x10067b50
call fcn.10011c90
add esp, 8
test eax, eax
je 0x10011102
push sym.gphelper.dll__HookBringWindowToTop_4
push 0x10067b4c
call fcn.10011c90
add esp, 8
jmp 0x10011102
test eax, eax
jne 0x10011102
push 0x10067b48
call fcn.10011e60
push 0x10067b44
call fcn.10011e60
push 0x10067b50
call fcn.10011e60
push 0x10067b4c
call fcn.10011e60
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.10013dd7
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10011bd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10011be5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10011c24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10011c20
lea ebx, [ebx]
cmp esi, edx
jae 0x10011c24
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x10011c10
cmp esi, edx
jb 0x10011c29
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x10011c90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
push edi
xor edi, edi
call fcn.10011f20
push esi
call fcn.10011f70
push dword [ebp + 0xc]
mov ebx, eax
mov dword [ebp - 0x18], ebx
call fcn.10011f70
push 0x50
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x6c]
xorps xmm0, xmm0
push edi
push eax
movlpd qword [ebp - 0x74], xmm0
call fcn.10013180
lea eax, [ebp - 0x74]
push eax
push 5
push ebx
call fcn.100124f0
mov esi, eax
add esp, 0x20
mov dword [ebp - 0x1c], esi
cmp esi, 5
jb 0x10011e44
push esi
push ebx
call fcn.10012350
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push ebx
call fcn.10012000
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x10011e3f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push esi
push ebx
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10011e23
lea eax, [ebp - 8]
push eax
push 0x40
push 0x6c
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10011e04
xor ecx, ecx
lea eax, [edi + 0x2c]
test esi, esi
je 0x10011d7b
mov edx, eax
sub ebx, eax
mov al, byte [ebx + edx]
mov byte [edx], al
mov byte [edi + ecx + 0x4c], al
inc ecx
lea edx, [edx + 1]
cmp ecx, esi
jb 0x10011d67
mov ebx, dword [ebp - 0x18]
lea eax, [esi + ebx]
push eax
lea eax, [esi + 0x2c]
add eax, edi
push eax
call fcn.10011fb0
mov ecx, dword [ebp - 0x10]
add esp, 8
cmp ecx, ebx
jae 0x10011d9a
mov eax, ebx
sub eax, ecx
jmp 0x10011d9e
mov eax, ecx
sub eax, ebx
push ecx
cmp eax, 0x7fff0000
jbe 0x10011dcd
lea esi, [edi + 0xc]
push esi
call fcn.10011fb0
sub eax, edi
sub eax, 0xc
push eax
push esi
push dword [ebp - 4]
call fcn.10010170
push esi
push ebx
call fcn.10011fb0
mov esi, dword [ebp - 0x1c]
add esp, 0x1c
jmp 0x10011dd6
push ebx
call fcn.10011fb0
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [edi + 8], eax
push esi
lea eax, [edi + 0x2c]
push eax
push dword [ebp - 4]
mov dword [edi + 4], esi
mov dword [edi], ebx
call fcn.10010170
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x6c
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push esi
push ebx
push dword [ebp - 4]
call fcn.10010170
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi], 0
je 0x10011e32
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x2c]
mov dword [ecx], eax
jmp 0x10011e3f
push 1
push edi
call fcn.10012150
add esp, 8
xor edi, edi
call fcn.100122b0
call fcn.10011f60
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011e60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor edi, edi
call fcn.10011f20
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.10012110
mov esi, eax
add esp, 4
test esi, esi
je 0x10011f0a
push dword [esi + 4]
push dword [esi]
call fcn.10012350
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 4]
push ecx
push 0x40
push dword [esi + 4]
mov dword [ebp - 8], eax
push dword [esi]
mov dword [ebp - 4], edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10011f05
mov edx, dword [esi]
xor ecx, ecx
cmp dword [esi + 4], ecx
jbe 0x10011ecd
nop
mov al, byte [esi + ecx + 0x4c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esi + 4]
jb 0x10011ec0
push dword [esi + 4]
mov edi, dword [ebp - 8]
push dword [esi]
push edi
call fcn.10010170
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [esi + 4]
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [esi]
push 0
push esi
mov dword [ebx], eax
mov edi, 1
call fcn.10012150
add esp, 8
call fcn.100122b0
call fcn.10011f60
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10012000
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push edi
xor edi, edi
cmp dword [0x10067b5c], 0x40
jae 0x10012108
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
add esi, ecx
cmp esi, 0x80000000
jae 0x1001202c
lea esi, [edi + 1]
jmp 0x10012032
sub esi, 0x7fff0000
push ebx
mov ebx, dword [ebp + 0x14]
add ebx, ecx
cmp ebx, 0x80000000
jae 0x10012048
add ebx, 0x7ff80000
jmp 0x1001204d
mov ebx, 0xfff80000
xorps xmm0, xmm0
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], edi
movq qword [ebp - 0x3c], xmm0
movq qword [ebp - 0x34], xmm0
movq qword [ebp - 0x2c], xmm0
movq qword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, ebx
jae 0x10012106
lea esp, [esp]
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x100120d7
cmp dword [ebp - 0xc], 0x10000
jne 0x100120cb
mov eax, dword [ebp - 0x10]
cmp eax, 0x6c
jb 0x100120ce
mov ecx, dword [ebp - 0x24]
cmp eax, ecx
jb 0x100120ce
lea eax, [ecx - 1]
add eax, esi
xor edx, edx
div ecx
push 0x20
push 0x3000
push 0x6c
imul eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x100120db
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
add esi, eax
cmp esi, ebx
jb 0x10012080
test edi, edi
je 0x10012106
xor eax, eax
lea ecx, [ecx]
cmp dword [eax*4 + 0x10067b90], 0
je 0x100120f9
inc eax
cmp eax, 0x40
jb 0x100120e0
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
inc dword [0x10067b5c]
mov dword [eax*4 + 0x10067b90], edi
pop ebx
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100121a0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x10066c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x10012258
test esi, esi
je 0x10012258
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x10012293
push edi
lea eax, [ebp - 0x2d0]
push eax
push esi
mov dword [ebp - 0x2d0], 0x10001
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10012281
mov edx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x218]
cmp ecx, ebx
jb 0x10012254
mov eax, dword [ebp + 0x10]
add eax, ebx
cmp ecx, eax
jae 0x10012254
push esi
call edx
cmp edi, 3
jge 0x10012267
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2d0]
push eax
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, dword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x10012211
pop ebx
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013dd7
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013dd7
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10013dd7
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.10013dd7
mov esp, ebp
pop ebp
ret

Function at 0x100122b0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.10010390
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call fcn.10010390
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x10067b64], esi
jbe 0x1001230f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ebx, [ebx]
mov eax, dword [0x10067b60]
push dword [eax + esi*4]
call edi
mov eax, dword [0x10067b60]
push dword [eax + esi*4]
call ebx
inc esi
cmp esi, dword [0x10067b64]
jb 0x100122f0
pop edi
pop ebx
push dword [0x10067b60]
call fcn.1001502f
add esp, 4
mov dword [0x10067b60], 0
push dword [ebp - 4]
mov dword [0x10067b64], 0
call fcn.10010390
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop esi
mov esp, ebp
pop ebp
ret