joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a860
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
xor edx, edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x49aab3
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0045ce48
test al, al
je 0x49a92b
call fcn.0045ce48
test al, al
je 0x49a92b
lea eax, [ebp - 0x22c]
mov edx, dword [0x4a36c4]
mov edx, dword [edx]
call fcn.004048d8
mov eax, dword [ebp - 0x22c]
call fcn.0045e4f8
lea edx, [ebp - 0x228]
call fcn.0045d338
push dword [ebp - 0x228]
lea eax, [ebp - 0x234]
mov edx, dword [0x4a39fc]
mov edx, dword [edx]
call fcn.004048d8
mov eax, dword [ebp - 0x234]
lea ecx, [ebp - 0x230]
xor edx, edx
call fcn.00409528
push dword [ebp - 0x230]
push 0x49aac8
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404a60
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402f00
lea eax, [ebp - 0x1d0]
call fcn.00402c9c
call fcn.00402928
mov edx, 0x49aad8
lea eax, [ebp - 0x1d0]
call fcn.00404dbc
call fcn.00403390
call fcn.00402928
push 0x49aae8
lea edx, [ebp - 0x23c]
xor eax, eax
call fcn.00402b48
push dword [ebp - 0x23c]
push 0x49aaf8
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00404a60
mov edx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d0]
call fcn.00404dbc
call fcn.00403390
call fcn.00402928
push 0x49ab04
lea edx, [ebp - 0x244]
xor eax, eax
call fcn.00402b48
push dword [ebp - 0x244]
push 0x49aaf8
push 0x49ab18
lea eax, [ebp - 0x240]
mov edx, 4
call fcn.00404a60
mov edx, dword [ebp - 0x240]
lea eax, [ebp - 0x1d0]
call fcn.00404dbc
call fcn.00403390
call fcn.00402928
mov edx, 0x49ab30
lea eax, [ebp - 0x1d0]
call fcn.00404dbc
call fcn.00403390
call fcn.00402928
lea eax, [ebp - 0x1d0]
call fcn.00402fc8
call fcn.00402928
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.0040316c
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404ba0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x49aa8d
mov eax, dword [ebp - 0x1dc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1e0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49aaba
lea eax, [ebp - 0x244]
mov edx, 8
call fcn.00404704
lea eax, [ebp - 4]
call fcn.004046e0
ret
Function at 0x49d520
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49d617
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x110]
mov edx, dword [0x4a3a98]
mov edx, dword [edx]
call fcn.004048d8
mov eax, dword [ebp - 0x110]
mov edx, 0x49d62c
call fcn.00404aec
jne 0x49d5a9
mov byte [ebp - 0x107], 0
push 0x49d63c
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x109]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
jmp 0x49d5f1
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404950
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x49d674
call fcn.004049ec
mov eax, dword [0x4a3a98]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 4]
call fcn.00404ba0
mov esi, eax
push esi
call sub.kernel32.dll_lstrcatA
push esi
push ebx
call sub.kernel32.dll_lstrcpyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d61e
lea eax, [ebp - 0x114]
mov edx, 2
call fcn.00404704
lea eax, [ebp - 4]
call fcn.004046e0
ret
Function at 0x49daec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.0040316c
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.0040316c
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0x4a5b18
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x49dbbe
mov eax, dword [ebp - 0x5c]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x58]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x54]
mov dword [eax], edx
mov dword [edi], 0x10007
push edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetThreadContext
lea eax, [ebp - 8]
push eax
push 4
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [edi + 0xa4]
add eax, 8
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_ReadProcessMemory
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
jmp 0x49dba1
cmp dword [ebp - 0x68], 0x10000
je 0x49dbb4
add edi, dword [ebp - 0x6c]
push 0x1c
lea eax, [ebp - 0x78]
push eax
push edi
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x49db95
mov eax, dword [ebp + 0xc]
sub edi, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49e004
Capabilities:
Get session user name
Query service configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x49e17f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49e10a
push 0xf01ff
mov eax, dword [0x4a3544]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x49e101
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
mov eax, dword [ebp - 0x1c]
call fcn.00408bb0
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x49e0f1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceConfigA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x1c]
call fcn.004048d8
lea eax, [ebp - 0x20]
call fcn.0049df80
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
call fcn.00408cfc
test eax, eax
jne 0x49e0d9
lea eax, [ebp - 0x14]
call fcn.0049dfcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e0f8
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.004027e0
ret
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp byte [ebp - 1], 0
je 0x49e15c
mov dword [ebp - 0x1c], pe_nt_image_headers32
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00404d2c
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404ba0
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, dword [ebp - 0x10]
call fcn.00404ba0
call fcn.004096ec
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00404d2c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00408cfc
test eax, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e186
lea eax, [ebp - 0x20]
call fcn.004046e0
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404704
ret
Function at 0x1000ddb4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10048c58]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
jne 0x1000de80
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x118]
push eax
call fcn.1001082b
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x118]
push ecx
mov dword [ebp - 0xe], 0x75732074
mov dword [ebp - 8], 0x74726f
mov dword [ebp - 0x13], 0x6174736e
mov word [ebp - 0xa], 0x7070
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0xf], 0x6e
call fcn.10010540
add esp, 0xc
test eax, eax
jne 0x1000deb5
push sym.gphelper.dll__HookSetWindowPos_28
push 0x100499b4
call fcn.1000e597
pop ecx
pop ecx
test eax, eax
je 0x1000deb5
push sym.gphelper.dll__HookSetForegroundWindow_4
push 0x100499b0
call fcn.1000e597
pop ecx
pop ecx
test eax, eax
je 0x1000deb5
push sym.gphelper.dll__HookSetActiveWindow_4
push 0x100499bc
call fcn.1000e597
pop ecx
pop ecx
test eax, eax
je 0x1000deb5
push sym.gphelper.dll__HookBringWindowToTop_4
push 0x100499b8
call fcn.1000e597
pop ecx
jmp 0x1000deb4
cmp dword [ebp + 0xc], 0
jne 0x1000deb5
push 0x100499b4
call fcn.1000e751
mov dword [esp], 0x100499b0
call fcn.1000e751
mov dword [esp], 0x100499bc
call fcn.1000e751
mov dword [esp], 0x100499b8
call fcn.1000e751
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.10010c06
leave
ret 0xc
Function at 0x1000dec6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10048c58]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x110]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREPC_Accelerate_Pro
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000e003
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.1000f2c0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push str.hvals
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000dff7
cmp dword [ebp - 0x118], ebx
jbe 0x1000dff7
mov esi, 0x10049880
push esi
lea ecx, [ebp - 0x114]
call fcn.1000db4f
push edi
lea eax, [ebp - 0x114]
push 0x1001c9cc
push eax
call fcn.1000dc2f
add esp, 0xc
lea ecx, [ebp - 0x10c]
push esi
call fcn.1000db4f
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push 0x1001bba4
push eax
call fcn.1000dc2f
mov esi, dword [ebp - 0x114]
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ebx
push esi
call fcn.1000db90
test eax, eax
js 0x1000dfe1
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10c]
lea ecx, [ecx - 0x10]
call fcn.1000dd64
lea ecx, [esi - 0x10]
call fcn.1000dd64
xor eax, eax
inc eax
jmp 0x1000e00a
mov ecx, dword [ebp - 0x10c]
lea ecx, [ecx - 0x10]
call fcn.1000dd64
lea ecx, [esi - 0x10]
call fcn.1000dd64
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [0x100499b8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010c06
leave
ret 4
Function at 0x1000e01b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10048c58]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x110]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREPC_Accelerate_Pro
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000e157
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.1000f2c0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push str.hvals
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000e14b
cmp dword [ebp - 0x118], ebx
jbe 0x1000e14b
mov esi, 0x10049880
push esi
lea ecx, [ebp - 0x114]
call fcn.1000db4f
push edi
lea eax, [ebp - 0x114]
push 0x1001c9cc
push eax
call fcn.1000dc2f
add esp, 0xc
lea ecx, [ebp - 0x10c]
push esi
call fcn.1000db4f
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push 0x1001bba4
push eax
call fcn.1000dc2f
mov esi, dword [ebp - 0x114]
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ebx
push esi
call fcn.1000db90
test eax, eax
js 0x1000e135
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10c]
add ecx, 0xfffffff0
call fcn.1000dd64
lea ecx, [esi - 0x10]
call fcn.1000dd64
mov eax, edi
jmp 0x1000e15e
mov ecx, dword [ebp - 0x10c]
lea ecx, [ecx - 0x10]
call fcn.1000dd64
lea ecx, [esi - 0x10]
call fcn.1000dd64
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [0x100499bc]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010c06
leave
ret 4
Function at 0x1000e16f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10048c58]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x110]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREPC_Accelerate_Pro
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000e2ac
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.1000f2c0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push str.hvals
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000e2a0
cmp dword [ebp - 0x118], ebx
jbe 0x1000e2a0
mov esi, 0x10049880
push esi
lea ecx, [ebp - 0x114]
call fcn.1000db4f
push edi
lea eax, [ebp - 0x114]
push 0x1001c9cc
push eax
call fcn.1000dc2f
add esp, 0xc
lea ecx, [ebp - 0x10c]
push esi
call fcn.1000db4f
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push 0x1001bba4
push eax
call fcn.1000dc2f
mov esi, dword [ebp - 0x114]
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ebx
push esi
call fcn.1000db90
test eax, eax
js 0x1000e28a
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10c]
lea ecx, [ecx - 0x10]
call fcn.1000dd64
lea ecx, [esi - 0x10]
call fcn.1000dd64
xor eax, eax
inc eax
jmp 0x1000e2b3
mov ecx, dword [ebp - 0x10c]
lea ecx, [ecx - 0x10]
call fcn.1000dd64
lea ecx, [esi - 0x10]
call fcn.1000dd64
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [0x100499b0]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010c06
leave
ret 4
Function at 0x1000e2c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x10048c58]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x110]
push eax
push 0x20019
push 0
push str.SOFTWAREPC_Accelerate_Pro
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000e406
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call fcn.1000f2c0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push str.hvals
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000e3fa
cmp dword [ebp - 0x118], eax
jbe 0x1000e3fa
mov esi, 0x10049880
push esi
lea ecx, [ebp - 0x114]
call fcn.1000db4f
push edi
lea eax, [ebp - 0x114]
push 0x1001c9cc
push eax
call fcn.1000dc2f
add esp, 0xc
lea ecx, [ebp - 0x10c]
push esi
call fcn.1000db4f
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push 0x1001bba4
push eax
call fcn.1000dc2f
mov esi, dword [ebp - 0x114]
add esp, 0xc
lea ecx, [ebp - 0x10c]
push 0
push esi
call fcn.1000db90
test eax, eax
js 0x1000e3e4
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10c]
lea ecx, [ecx - 0x10]
call fcn.1000dd64
lea ecx, [esi - 0x10]
call fcn.1000dd64
xor eax, eax
inc eax
jmp 0x1000e41d
mov ecx, dword [ebp - 0x10c]
lea ecx, [ecx - 0x10]
call fcn.1000dd64
lea ecx, [esi - 0x10]
call fcn.1000dd64
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push edi
call dword [0x100499b4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010c06
leave
ret 0x1c
Function at 0x1000e597
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
push edi
xor edi, edi
call fcn.1000e55a
push esi
call fcn.1000e89b
push dword [ebp + 0xc]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
call fcn.1000e89b
push 0x50
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x70]
xorps xmm0, xmm0
push edi
push eax
movlpd qword [ebp - 0x78], xmm0
call fcn.1000f2c0
lea eax, [ebp - 0x78]
push eax
push 5
push ebx
call fcn.1000e444
mov esi, eax
add esp, 0x20
mov dword [ebp - 0x20], esi
cmp esi, 5
jb 0x1000e73a
push esi
push ebx
call fcn.1000e97d
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push ebx
call fcn.1000eaef
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x1000e735
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push esi
push ebx
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1000e71a
lea eax, [ebp - 8]
push eax
push 0x40
push 0x6c
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1000e6fd
xor edx, edx
lea ecx, [edi + 0x2c]
test esi, esi
je 0x1000e67b
sub ebx, ecx
mov al, byte [ebx + ecx]
mov byte [ecx], al
mov byte [edi + edx + 0x4c], al
inc edx
inc ecx
cmp edx, esi
jb 0x1000e666
mov ebx, dword [ebp - 0x1c]
lea ecx, [edi + 0x2c]
lea eax, [esi + ebx]
push eax
lea eax, [ecx + esi]
push eax
call fcn.1000e511
mov edx, dword [ebp - 0x10]
pop ecx
pop ecx
mov ecx, ebx
sub ecx, edx
mov eax, edx
sub eax, ebx
cmp edx, ebx
cmovb eax, ecx
push edx
cmp eax, 0x7fff0000
jbe 0x1000e6c9
lea esi, [edi + 0xc]
push esi
call fcn.1000e511
pop ecx
pop ecx
sub eax, edi
sub eax, 0xc
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push esi
push ebx
call fcn.1000e511
mov esi, dword [ebp - 0x20]
jmp 0x1000e6cf
push ebx
call fcn.1000e511
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
mov dword [edi + 8], eax
push esi
lea eax, [edi + 0x2c]
push eax
push dword [ebp - 4]
mov dword [edi + 4], esi
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x6c
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [edi], 0
je 0x1000e729
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x2c]
mov dword [ecx], eax
jmp 0x1000e735
push 1
push edi
call fcn.1000ebdc
pop ecx
pop ecx
xor edi, edi
call fcn.1000e81f
push 0x100499dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
leave
ret
Function at 0x1000e751
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
call fcn.1000e55a
mov ecx, dword [ebp + 8]
xor esi, esi
mov eax, dword [esi*4 + 0x100499f8]
test eax, eax
je 0x1000e779
add eax, 0x2c
cmp eax, dword [ecx]
je 0x1000e813
inc esi
cmp esi, 0x40
jb 0x1000e763
xor esi, esi
test esi, esi
je 0x1000e802
push ebx
push dword [esi + 4]
push dword [esi]
call fcn.1000e97d
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 4], edi
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1000e7fc
mov edx, dword [esi]
xor ecx, ecx
cmp dword [esi + 4], ecx
jbe 0x1000e7c9
mov al, byte [esi + ecx + 0x4c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esi + 4]
jb 0x1000e7bc
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp + 8]
mov eax, dword [esi]
xor edi, edi
push 0
push esi
mov dword [ecx], eax
inc edi
call fcn.1000ebdc
pop ecx
pop ecx
call fcn.1000e81f
pop ebx
push 0x100499dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
leave
ret
mov esi, dword [esi*4 + 0x100499f8]
jmp 0x1000e781

Function at 0x1000e81f
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x100499cc], esi
jbe 0x1000e871
mov eax, dword [0x100499c8]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x100499c8]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x100499cc]
jb 0x1000e84c
push dword [0x100499c8]
call fcn.10010c9d
and dword [0x100499c8], 0
and dword [0x100499cc], 0
pop ecx
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
leave
ret
Function at 0x1000e8d3
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x10048c58]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000e96d
test esi, esi
je 0x1000e96d
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1000e964
mov dword [ebp - 0x2d0], 0x10001
xor ebx, ebx
jmp 0x1000e950
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x218], eax
jb 0x1000e96d
add eax, dword [ebp + 0x10]
cmp dword [ebp - 0x218], eax
jae 0x1000e96d
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp ebx, 3
jge 0x1000e964
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc ebx
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1000e91e
jmp 0x1000e96d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010c06
leave
ret

Function at 0x1000eaef
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
xor ebx, ebx
cmp dword [0x100499c4], 0x40
jae 0x1000ebd7
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
add esi, ecx
add ecx, dword [ebp + 0x14]
push edi
cmp ecx, 0x80000000
lea eax, [ecx + 0x7ff80000]
push 8
mov edx, 0xfff80000
cmovb edx, eax
and dword [ebp - 0x44], ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
inc eax
cmp esi, 0x80000000
lea edi, [esi - 0x7fff0000]
mov esi, dword [ebp - 4]
cmovb edi, eax
cmp edi, esi
jae 0x1000ebd5
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000ebb0
cmp dword [ebp - 0x10], 0x10000
jne 0x1000eba4
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jb 0x1000eba7
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jb 0x1000eba7
lea eax, [ecx - 1]
add eax, edi
xor edx, edx
div ecx
push 0x20
push 0x3000
push 0x6c
imul eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1000ebb4
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
add edi, eax
cmp edi, esi
jb 0x1000eb59
test ebx, ebx
je 0x1000ebd5
xor eax, eax
cmp dword [eax*4 + 0x100499f8], 0
je 0x1000ebc8
inc eax
cmp eax, 0x40
jb 0x1000ebb6
jmp 0x1000ebd5
inc dword [0x100499c4]
mov dword [eax*4 + 0x100499f8], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret