joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002ce90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dc9aa
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10108c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0x10]
mov edx, 0x10000
test al, 4
mov ecx, 0x10003
push 0x68
cmove ecx, edx
or ecx, eax
mov dword [ebp + 0x10], ecx
call fcn.100acdf8
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1002cfa0
push dword [ebp + 0x14]
lea ecx, [ebx + 4]
mov dword [ebx], 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002c120
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
lea ecx, [ebx + 4]
mov byte [ebp - 4], 2
mov dword [ebx + 0x14], 2
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x20], 0x3f800000
mov dword [ebx + 0x24], 0x3f800000
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov byte [ebx + 0x34], 0
call fcn.1002c760
push eax
lea ecx, [ebx + 8]
call fcn.1002cff0
mov eax, dword [ebp + 0x10]
and al, 6
cmp al, 2
push 0x30
sete al
mov byte [ebx + 0x1c], al
lea eax, [ebx + 0x38]
push 0
push eax
call fcn.100aefd0
mov eax, esi
add esp, 0xc
mov dword [eax], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [esi], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10031480
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dcd43
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10108c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov eax, dword [ebp + 8]
lea edi, [ebx + 0x18]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov esi, dword [eax + 4]
sub esi, dword [eax]
xor eax, eax
sar esi, 2
mov byte [ebp - 4], 1
test esi, esi
je 0x10031550
cmp esi, 0x3fffffff
ja 0x100315b3
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push edi
call fcn.10011660
mov dword [edi], eax
mov dword [edi + 4], eax
lea eax, [eax + esi*4]
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
mov edi, dword [edi]
mov esi, dword [eax + 4]
mov eax, dword [eax]
sub esi, eax
push esi
push eax
push edi
call fcn.100aea50
add esp, 0xc
sar esi, 2
lea eax, [edi + esi*4]
lea edi, [ebx + 0x18]
mov dword [edi + 4], eax
sub eax, dword [edi]
lea ecx, [ebx + 0xc]
sar eax, 2
push eax
mov byte [ebp - 4], 2
call fcn.100321e0
push dword [ebp + 0xc]
mov ecx, ebx
call fcn.10031ae0
mov dword [ebx + 0x3c], 0
mov eax, ebx
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x24], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.1000bd00
int3

Function at 0x10031780
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dcd83
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10108c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov esi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 0
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 2
mov dword [ebp + 8], esi
call fcn.1000b4b0
mov esi, dword [esi + 0x10]
test esi, esi
je 0x10031826
nop
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
push eax
mov ecx, edi
call fcn.10031a90
mov esi, dword [esi + 4]
test esi, esi
jne 0x10031810
mov eax, dword [edi + 0x1c]
lea ecx, [edi + 0xc]
sub eax, dword [edi + 0x18]
sar eax, 2
push eax
call fcn.100321e0
push dword [ebp + 0xc]
mov ecx, edi
call fcn.10031ae0
mov dword [edi + 0x3c], 0
mov eax, edi
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x24], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100487a0
Capabilities:
Access peb ldr_data
Get ntdll base address
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100dd9ec
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10108c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
movss xmm0, dword [0x100e2954]
subss xmm0, dword [ebp + 0xc]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov byte [edi + 0x54], 1
cmp dword [eax + 0x14], 0xf
mov byte [ebp - 4], 4
movss dword [0x1011063c], xmm0
jbe 0x10048891
mov eax, dword [eax]
push 0x100e4bc4
push eax
call fcn.100bbbc1
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x100489d4
push ebx
push 1
push 0x90
push 0x101107b0
call fcn.100bb04f
add esp, 0x10
cmp dword [0x101107b0], 0x50534249
jne 0x100489cb
cmp dword [0x101107b4], 0x2e
jne 0x100489cb
mov esi, 0x101107b8
mov eax, dword [esi]
test eax, eax
je 0x10048910
cmp dword [esi + 4], 0
je 0x10048910
push 0
push eax
push ebx
call fcn.100bb459
push dword [esi + 4]
call fcn.100ad4e9
push ebx
push 1
push dword [esi + 4]
mov dword [esi], eax
push eax
call fcn.100bb04f
add esp, 0x20
jmp 0x10048916
mov dword [esi], 0
add esi, 8
cmp esi, 0x10110840
jl 0x100488e0
push 0
mov ecx, edi
call fcn.10049910
mov ecx, edi
mov dword [edi], eax
call fcn.10048fc0
mov ecx, edi
call fcn.10049f60
mov ecx, edi
call fcn.10049720
mov ecx, edi
call fcn.10049ae0
mov ecx, edi
call fcn.1004a820
mov esi, 0x101107b8
push dword [esi]
call fcn.100ace36
add esi, 8
add esp, 4
cmp esi, 0x10110840
jl 0x10048954
push ebx
call fcn.100ba79f
add esp, 4
mov byte [edi + 0x54], 0
mov ecx, edi
push 1
call fcn.1004bb90
mov ebx, dword [0x1011070c]
mov esi, dword [ebx + 4]
cmp byte [esi + 0xd], 0
jne 0x100489b7
nop
push dword [esi + 8]
mov ecx, 0x1011070c
push 0x1011070c
call fcn.10001d30
mov eax, esi
mov esi, dword [esi]
push 0x18
push eax
call fcn.100ace28
add esp, 8
cmp byte [esi + 0xd], 0
je 0x10048990
mov dword [ebx + 4], ebx
mov dword [ebx], ebx
mov dword [ebx + 8], ebx
mov dword [0x10110710], 0
jmp 0x100489d4
push ebx
call fcn.100ba79f
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1004feb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [0x10110a3c]
mov esi, ecx
test edi, edi
je 0x1004ff23
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageA]
cmp byte [0x101109a5], 0
jne 0x1004ff17
cmp dword [0x10110a24], 3
jne 0x1004ff10
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
call esi
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 5
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi]
mov ecx, edi
push 0
push dword [ebp + 8]
call dword [eax + 0x18]
pop edi
pop esi
pop ebp
ret 4
mov ecx, esi
call fcn.10051e70
mov eax, dword [edi]
mov ecx, edi
push 0
push dword [ebp + 8]
call dword [eax + 0x18]
pop edi
pop esi
pop ebp
ret 4
Function at 0x100536e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100de020
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x10108c80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
push 0x104
mov dword [ebp - 0x134], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xorps xmm0, xmm0
test eax, eax
jne 0x10053749
movups xmmword [esi], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
mov byte [esi], al
jmp 0x10053925
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x11c], 0
movups xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x118], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10053770
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.10001c10
mov edi, dword [ebp - 0x11c]
mov dword [ebp - 4], 0
test edi, edi
je 0x100538fa
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x12c]
mov ecx, dword [ebp - 0x12c]
cmp edx, 0xf
mov dword [ebp - 0x138], edx
cmova eax, ecx
cmp byte [edi + eax - 1], 0x5c
je 0x100538fa
cmp edi, edx
jae 0x100537ee
lea eax, [edi + 1]
cmp edx, 0xf
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x12c]
cmova eax, ecx
mov word [eax + edi], 0x5c
jmp 0x100538fa
mov eax, bind
sub eax, edi
cmp eax, 1
jb 0x10053944
lea ecx, [edi + 1]
or ecx, 0xf
cmp ecx, 0x7fffffff
jbe 0x10053813
mov ecx, bind
jmp 0x10053840
mov eax, edx
shr eax, 1
mov dword [ebp - 0x130], eax
mov eax, bind
sub eax, dword [ebp - 0x130]
cmp edx, eax
jbe 0x10053833
mov ecx, bind
jmp 0x10053840
mov eax, dword [ebp - 0x130]
add eax, edx
cmp ecx, eax
cmovb ecx, eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], ecx
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.10001bb0
cmp dword [ebp - 0x138], 0xf
lea ecx, [edi + 1]
mov dword [ebp - 0x11c], ecx
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x118], ecx
lea ecx, [edi + eax]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], ecx
push edi
jbe 0x100538d3
mov edi, dword [ebp - 0x12c]
push edi
push eax
call fcn.100aea50
mov eax, dword [ebp - 0x130]
add esp, 0xc
mov ecx, dword [ebp - 0x138]
inc ecx
mov word [eax], 0x5c
mov eax, edi
cmp ecx, 0x1000
jb 0x100538c7
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10053949
push ecx
push edi
call fcn.100ace28
add esp, 8
jmp 0x100538ee
lea ecx, [ebp - 0x12c]
push ecx
push eax
call fcn.100aea50
mov eax, dword [ebp - 0x130]
add esp, 0xc
mov word [eax], 0x5c
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x12c], eax
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x12c]
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x11c]
movq qword [esi + 0x10], xmm0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ad4b8
mov esp, ebp
pop ebp
ret 4
call fcn.100031f0
call fcn.100b251a
int3
Function at 0x100539d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xf
jbe 0x100539de
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100539f0
xor eax, eax
pop ebp
ret 4
test al, 0x10
mov eax, 0
setne al
inc eax
pop ebp
ret 4

Function at 0x100545d0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [esi - 0xc7]
cmp eax, 0xc
ja case.0x100545e2.202
jmp dword [eax*4 + 0x10054738]
mov eax, 3
pop esi
pop ebp
ret 4
mov eax, 4
pop esi
pop ebp
ret 4
mov eax, 1
pop esi
pop ebp
ret 4
mov eax, 2
pop esi
pop ebp
ret 4
mov eax, 5
pop esi
pop ebp
ret 4
mov eax, 6
pop esi
pop ebp
ret 4
mov eax, 0x1c
pop esi
pop ebp
ret 4
mov eax, 0x1d
pop esi
pop ebp
ret 4
mov eax, 0x1f
pop esi
pop ebp
ret 4
mov eax, 0x1e
pop esi
pop ebp
ret 4
push edi
push 1
and esi, 0x7f
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edi, eax
test edi, edi
je 0x1005472e
mov ecx, dword [0x10110a5c]
push 0x2a
call fcn.10053db0
mov ecx, dword [0x10110a5c]
shl al, 7
push 0x36
mov byte [0x10110b08], al
call fcn.10053db0
mov ecx, dword [0x10110a5c]
shl al, 7
mov byte [0x10110b09], al
or al, byte [0x10110b08]
push 0x1d
mov byte [0x10110a78], al
call fcn.10053db0
mov ecx, dword [0x10110a5c]
shl al, 7
push 0x9d
mov byte [0x10110b0a], al
call fcn.10053db0
mov ecx, dword [0x10110a5c]
shl al, 7
mov byte [0x10110b0b], al
or al, byte [0x10110b0a]
push 0x38
mov byte [0x10110a79], al
call fcn.10053db0
mov ecx, dword [0x10110a5c]
shl al, 7
push 0xb8
mov byte [0x10110b0c], al
call fcn.10053db0
shl al, 7
mov byte [0x10110b0d], al
or al, byte [0x10110b0c]
push 0
mov byte [0x10110a7a], al
lea eax, [ebp + 8]
push eax
push 0x10110a68
push esi
push edi
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
jne 0x1005472e
movzx eax, word [ebp + 8]
pop edi
movzx eax, al
pop esi
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x1005e1e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10108c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push 0x100e4bc4
push eax
mov dword [ebp - 0x11c], ecx
call fcn.100bbbc1
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1005e225
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ad4b8
mov esp, ebp
pop ebp
ret 8
push esi
push edi
push ebx
push 4
lea eax, [ebp - 0x118]
push 1
push eax
call fcn.100bb04f
push 4
lea eax, [ebp - 0x118]
push str.DDS
push eax
call fcn.100bc2f0
add esp, 0x1c
test eax, eax
jne 0x1005e40e
push ebx
push 1
lea eax, [ebp - 0x90]
push 0x7c
push eax
call fcn.100bb04f
add esp, 0x10
cmp dword [ebp - 0x90], 0x7c
jne 0x1005e40e
mov eax, dword [ebp - 0x40]
lea esi, [ebp - 0x90]
mov ecx, 0x1f
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov ecx, 8
cmp eax, 0x31545844
cmove edi, ecx
cmp eax, 0x33545844
mov ecx, 0x10
cmove edi, ecx
cmp eax, 0x35545844
jne 0x1005e2b4
mov edi, ecx
jmp 0x1005e2bc
test edi, edi
je 0x1005e40e
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x110]
or eax, 0x10
mov dword [ebp - 0x110], 0
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x11c]
push 0
push edx
lea edx, [ebp - 0x10c]
mov eax, dword [eax]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
js 0x1005e40e
mov esi, dword [ebp - 0x110]
xorps xmm0, xmm0
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x14], 0x401008
mov dword [ebp - 0x114], 0
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov eax, dword [esi]
lea ecx, [ebp - 0x10c]
push 0
push 1
push ecx
push 0
push esi
call dword [eax + 0x64]
test eax, eax
js 0x1005e3bd
nop word [eax + eax]
mov ecx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x100]
add eax, 3
shr eax, 2
lea ecx, [ecx + 3]
shr ecx, 2
imul ecx, eax
push ebx
push 1
imul ecx, edi
push ecx
push dword [ebp - 0xe8]
call fcn.100bb04f
add esp, 0x10
test eax, eax
je 0x1005e3bd
mov eax, dword [esi]
push 0
push esi
call dword [eax + 0x80]
mov eax, dword [esi]
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push esi
call dword [eax + 0x30]
test eax, eax
js 0x1005e3e6
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov esi, dword [ebp - 0x114]
push esi
mov eax, dword [esi]
call dword [eax + 8]
mov eax, dword [esi]
lea ecx, [ebp - 0x10c]
push 0
push 1
push ecx
push 0
push esi
call dword [eax + 0x64]
test eax, eax
jns 0x1005e340
push ebx
call fcn.100ba79f
mov eax, dword [esi]
add esp, 4
push esi
call dword [eax + 8]
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x114]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x1005e417
push ebx
call fcn.100ba79f
mov eax, dword [esi]
add esp, 4
push esi
call dword [eax + 8]
mov eax, dword [ebp - 0x110]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ad4b8
mov esp, ebp
pop ebp
ret 8
push ebx
call fcn.100ba79f
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ad4b8
mov esp, ebp
pop ebp
ret 8
Function at 0x1005eab0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x1005eacd
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x40
push 0x3000
push 0x80
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x2c], eax
add eax, 0x40
mov dword [esi + 0x30], eax
mov eax, dword [ecx + 0xc]
mov dword [esi], eax
mov ebx, dword [ecx + 0x1c]
mov dword [esi + 8], ebx
mov edi, dword [ecx + 0x10]
mov dword [esi + 0xc], edi
mov edx, dword [ecx + 0x14]
mov dword [esi + 0x10], edx
mov ecx, dword [ecx + 0x18]
mov dword [ebp + 8], edx
cdq
and edx, 7
mov dword [esi + 0x14], ecx
add eax, edx
mov dword [esi + 0x18], 0
sar eax, 3
mov dword [esi + 4], eax
xor eax, eax
test ebx, ebx
jne 0x1005eb32
mov dword [esi + 0x18], 0xff000000
mov eax, 0xff000000
test edi, edi
jne 0x1005eb3e
or eax, 0xff0000
mov dword [esi + 0x18], eax
cmp dword [ebp + 8], 0
jne 0x1005eb4c
or eax, 0xff00
mov dword [esi + 0x18], eax
test ecx, ecx
jne 0x1005eb58
or eax, 0xff
mov dword [esi + 0x18], eax
mov byte [esi + 0x1d], 0
test ebx, ebx
je 0x1005eb8b
test bl, 1
jne 0x1005eb73
xor al, al
inc al
shr ebx, 1
mov byte [esi + 0x1d], al
test bl, 1
je 0x1005eb67
mov al, 8
test bl, 1
je 0x1005eb8d
nop word [eax + eax]
shr ebx, 1
dec al
test bl, 1
jne 0x1005eb80
jmp 0x1005eb8d
xor al, al
add al, 0x18
mov ebx, edi
mov byte [esi + 0x1c], al
mov eax, ebx
mov byte [esi + 0x1f], 0
test eax, eax
je 0x1005ebbf
test al, 1
jne 0x1005ebaf
xor cl, cl
inc cl
shr eax, 1
mov byte [esi + 0x1f], cl
test al, 1
je 0x1005eba4
mov cl, 8
test al, 1
je 0x1005ebc1
shr eax, 1
dec cl
test al, 1
jne 0x1005ebb5
jmp 0x1005ebc1
xor cl, cl
mov edi, dword [esi + 0x10]
add cl, 0x10
mov eax, edi
mov byte [esi + 0x1e], cl
mov byte [esi + 0x21], 0
test eax, eax
je 0x1005ebfb
test al, 1
jne 0x1005ebeb
xor cl, cl
nop word [eax + eax]
inc cl
shr eax, 1
mov byte [esi + 0x21], cl
test al, 1
je 0x1005ebe0
mov cl, 8
test al, 1
je 0x1005ebfd
shr eax, 1
dec cl
test al, 1
jne 0x1005ebf1
jmp 0x1005ebfd
xor cl, cl
mov edx, dword [esi + 0x14]
add cl, 8
mov eax, edx
mov byte [esi + 0x20], cl
mov byte [esi + 0x23], 0
test eax, eax
je 0x1005ec3d
test al, 1
jne 0x1005ec21
xor cl, cl
inc cl
shr eax, 1
mov byte [esi + 0x23], cl
test al, 1
je 0x1005ec16
mov byte [esi + 0x22], 8
test al, 1
je 0x1005ec41
mov cl, 8
nop dword [eax + eax]
dec cl
shr eax, 1
mov byte [esi + 0x22], cl
test al, 1
jne 0x1005ec30
jmp 0x1005ec41
mov byte [esi + 0x22], 0
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x30]
push edx
push edi
push ebx
push dword [esi + 8]
mov dword [esi + 0x24], ecx
push dword [esi]
mov dword [esi + 0x28], eax
push ecx
mov ecx, 0x10110c18
call fcn.1005cde0
push dword [esi + 0x14]
mov ecx, 0x10110c18
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi]
push dword [esi + 0x30]
call fcn.1005d1c0
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10067420
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x10067457
push esi
call fcn.10070bb0
add esp, 4
cmp byte [esi + 0x40], 0
je 0x1006744e
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
jmp 0x10067462
cmp eax, 0xcb
jne 0x100674de
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x100674c8
nop
mov eax, dword [esi + 8]
test eax, eax
je 0x1006747f
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x100674c2
cmp eax, 2
je 0x100674c8
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10067470
cmp eax, 3
je 0x100674a7
cmp eax, 1
jne 0x10067470
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x10067470
mov eax, dword [esi + 0x11c]
add eax, edi
mov dword [edx + 8], eax
jmp 0x10067470
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.10067510
add esp, 4
pop edi
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x10067500
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.10067510
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x10067510
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x1006753d
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
je 0x1006756f
nop dword [eax]
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
mov eax, dword [esi]
mov eax, dword [eax]
call eax
mov eax, dword [esi + 0x180]
add esp, 4
cmp byte [eax + 8], 0
jne 0x10067550
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebp
ret