joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008bd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 5
push dword [esi*4 + 0x1006ee1c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x1006d504]
cmp eax, esi
je 0x10008c04
push 0
push dword [eax*4 + 0x1006ee1c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x1006d504], esi
pop esi
pop ebp
ret

Function at 0x10008c10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1006b2f0]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [0x1006dfa8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10008cea
push dword [0x1006dfa8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10008c6e
push 0
push dword [0x1006dfa8]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.1000bf80
push eax
call fcn.1000e9d0
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ace3
mov esp, ebp
pop ebp
ret
cmp byte [0x1451931], 1
jne 0x10008cdc
cmp byte [0x9df630], 0x55
jne 0x10008cd8
push 0x64
mov byte [0x9df630], 0xc3
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa1
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [0x1006dfa8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [0x1006dfa8]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x44]
push eax
push dword [0x1006dfa8]
call dword [sym.imp.USER32.dll_BeginPaint]
lea eax, [ebp - 0x44]
push eax
push dword [0x1006dfa8]
call dword [sym.imp.USER32.dll_EndPaint]
push 5
jmp 0x10008cde
push 1
push dword [0x1006dfa8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ace3
mov esp, ebp
pop ebp
ret
Function at 0x1000a4b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x1006b2f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x240]
push esi
push edi
mov ecx, 0x8e
lea esi, [ebp + 8]
lea edi, [ebp - 0x23c]
rep movsd dword es:[edi], dword [esi]
test ebx, ebx
je 0x1000a58b
lea eax, [ebp - 0x238]
push eax
call fcn.10006960
add esp, 4
test eax, eax
je 0x1000a58b
mov esi, dword [eax]
cmp esi, 0xffffffff
je 0x1000a58b
push ebx
call fcn.100032a0
push ebx
mov dword [ebp - 0x240], eax
call fcn.10003310
sub eax, 0x8000
cdq
sub eax, edx
mov edi, eax
sar edi, 1
push ebx
add edi, 0x8000
call fcn.10003320
add esp, 0xc
mov ebx, eax
push dword [0x100680c8]
lea eax, [ebp - 0x238]
push 0
push eax
push dword [0x100680c4]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x1000a55b
mov eax, dword [esi*4 + 0x10068978]
push eax
push ebx
push edi
call fcn.1000b7c0
add esp, 0xc
test al, al
jne 0x1000a59e
cmp byte [0x1006fdfd], 0
mov eax, dword [0x100680bc]
cmovne eax, dword [0x100680b8]
push 0xa3
push eax
call fcn.1000a880
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ace3
mov esp, ebp
pop ebp
ret
push esi
call fcn.1000b840
add esp, 4
test al, al
je 0x1000a58b
push esi
call fcn.1000bcf0
movzx eax, al
push eax
movsx eax, word [esi + esi + 0x13e0200]
push eax
push ebx
push edi
push dword [ebp - 0x240]
push esi
call fcn.1000a1c0
mov ecx, dword [ebp - 4]
add esp, 0x1c
xor ecx, ebp
pop edi
pop esi
mov al, 1
pop ebx
call fcn.1002ace3
mov esp, ebp
pop ebp
ret
Function at 0x1000a6f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
call sub.KERNEL32.dll_GetTickCount64
mov ecx, dword [0x10068148]
mov edx, dword [0x1006e5a0]
sub eax, dword [0x1006da7c]
imul ecx, edx
imul ecx, ecx, 0x3e8
cmp eax, ecx
jle 0x1000a876
push esi
inc edx
push edi
mov dword [0x1006e5a0], edx
push dword [0x15c1c34]
call fcn.10003310
push dword [0x15c1c34]
mov esi, eax
call fcn.10003320
mov edi, 2
sub edi, dword [ebp + 0xc]
add esp, 8
add edi, eax
lea eax, [esi - 0x8000]
cdq
sub eax, edx
sar eax, 1
sub eax, dword [ebp + 8]
add eax, 0x8000
cdq
sub eax, edx
sar eax, 1
xor edi, eax
xor edi, 1
je 0x1000a874
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push 0x64003c
push 0
push 0x204
push dword [0x1006edb4]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
push 0
push 0
push 0x205
push dword [0x1006edb4]
call esi
push 0x32
call edi
mov ecx, dword [0x1006d86c]
mov eax, dword [0x1006d974]
cmp ecx, 0x190
jge 0x1000a7f6
cmp eax, 0x10e
jge 0x1000a7f0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.1002c69f
add esp, 4
call fcn.1002c67c
and eax, 0x80000007
jns 0x1000a7df
dec eax
or eax, 0xfffffff8
inc eax
xor ecx, ecx
cmp eax, 3
setle cl
lea ecx, [ecx*4 + 2]
jmp 0x1000a84a
cmp ecx, 0x190
jle 0x1000a7ff
cmp eax, 0x10e
jl 0x1000a81d
cmp ecx, 0x190
jge 0x1000a814
cmp eax, 0x10e
jg 0x1000a7bf
cmp ecx, 0x190
jle 0x1000a850
cmp eax, 0x10e
jle 0x1000a850
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.1002c69f
add esp, 4
call fcn.1002c67c
and eax, 0x80000007
jns 0x1000a83d
dec eax
or eax, 0xfffffff8
inc eax
xor edx, edx
mov ecx, 4
cmp eax, 3
cmovg ecx, edx
mov dword [0x1006dfa4], ecx
call fcn.10007000
push 0xfa
call edi
call fcn.10007000
push 0xfa
call edi
call fcn.10007000
push 0xfa
call edi
pop edi
pop esi
pop ebp
ret
Function at 0x1000fdc0
Capabilities:
Create thread

Disassembly:
cmp dword [0x14530a0], 3
jne 0x1000fe25
cmp byte [0x1006811c], 0
je 0x1000fe25
cmp byte [0x1006fffe], 0
je 0x1000fe25
cmp byte [0x1006d437], 0
jne 0x1000fe25
cmp byte [0x1006fdfd], 0
mov eax, dword [0x10068180]
cmovne eax, dword [0x1006816c]
push 0x46
push eax
mov byte [0x1006d437], 1
call fcn.1000a880
add esp, 8
push 0
push 0
push 0
push 0x10003af0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x100132f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [0x10070454], 0
push edi
jmp 0x10013313
push 0x100495c4
lea eax, [ebp - 4]
push 0x1006ff98
push eax
call fcn.1002cfd8
add esp, 0xc
test eax, eax
jne 0x100133d5
push ebx
push esi
push 2
push eax
push dword [ebp - 4]
call fcn.1002df0d
push dword [ebp - 4]
call fcn.1002e2e5
push 0
push 0
push dword [ebp - 4]
mov edi, eax
call fcn.1002df0d
push edi
call fcn.10023086
push dword [ebp - 4]
mov ebx, eax
push edi
push 1
push ebx
call fcn.1002ddd2
push dword [ebp - 4]
call fcn.1002dabf
lea eax, [edi - 0x14]
push eax
lea esi, [ebx + 0x14]
lea eax, [ebx + 4]
push esi
push eax
call fcn.10002750
mov eax, dword [ebx]
mov dword [ebp - 8], eax
add esp, 0x40
inc eax
push eax
call fcn.10023086
lea ecx, [edi - 0x14]
push ecx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
push esi
lea eax, [ebp - 8]
push eax
push edi
call fcn.10025820
mov ecx, dword [ebp - 8]
push ebx
mov esi, eax
mov byte [edi + ecx], 0
call fcn.1002adf8
add esp, 0x18
test esi, esi
pop esi
pop ebx
jne 0x100133cc
mov eax, dword [ebp - 8]
mov dword [0x10070454], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
push edi
call fcn.1002adf8
add esp, 4
jmp 0x100133e5
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100134a0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x288
xor bl, bl
mov dword [ebp - 4], 0x288
call fcn.1002d11f
mov esi, eax
add esp, 4
test esi, esi
jne 0x100134ca
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x100134f0
push esi
call fcn.1002d0e7
push dword [ebp - 4]
call fcn.1002d11f
mov esi, eax
add esp, 8
test esi, esi
je 0x100134c2
lea eax, [ebp - 4]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x10013571
mov eax, esi
test esi, esi
je 0x10013571
cmp dword [eax + 0x1a0], 6
jne 0x10013516
cmp dword [eax + 0x190], 6
je 0x1001352d
mov eax, dword [eax]
test eax, eax
jne 0x10013504
push esi
call fcn.1002d0e7
add esp, 4
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02X__02X__02X__02X__02X__02X
push 0x1014da38
call fcn.1002c807
add esp, 0x20
mov bl, 1
push esi
call fcn.1002d0e7
add esp, 4
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019200
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x110c
call fcn.1002c890
mov eax, dword [0x1006b2f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x10019240
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ace3
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x10c]
push eax
push 0x1000
lea eax, [ebp - 0x110c]
push eax
push edi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10019326
xor esi, esi
test dword [ebp - 0x10c], 0xfffffffc
jbe 0x10019326
push 0x82
lea eax, [ebp - 0x108]
push eax
push dword [ebp + esi*4 - 0x110c]
push edi
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x10019314
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100192a0
sub ecx, edx
cmp ecx, 0x10
jb 0x100192d4
test ecx, ecx
js 0x100192d4
lea eax, [ebp - 0x108]
push str.ScriptEditor.dll
push eax
call fcn.1002c350
add esp, 8
test eax, eax
je 0x100192d4
lea ecx, [ebp - 0x108]
sub eax, ecx
jns 0x1001933f
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100192e0
sub ecx, edx
cmp ecx, 0xc
jb 0x10019314
test ecx, ecx
js 0x10019314
lea eax, [ebp - 0x108]
push str.Scripter.dll
push eax
call fcn.1002c350
add esp, 8
test eax, eax
je 0x10019314
lea ecx, [ebp - 0x108]
sub eax, ecx
jns 0x1001933f
mov eax, dword [ebp - 0x10c]
inc esi
shr eax, 2
cmp esi, eax
jb 0x10019274
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ace3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov al, 1
pop edi
call fcn.1002ace3
mov esp, ebp
pop ebp
ret

Function at 0x10020c30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.1002c890
mov eax, dword [0x1006b2f0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1fff
lea eax, [ebp - 0x2003]
push 0
push eax
mov byte [ebp - 0x2004], 0
call fcn.1002ca60
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x2004]
push 0x2000
push eax
call fcn.1002c7ec
add esp, 0x1c
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002ace3
mov esp, ebp
pop ebp
ret
Function at 0x10022090
Capabilities:
Create thread
Terminate process

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.10022f90
add esp, 8
test eax, eax
jne 0x100220b2
call fcn.10022f50
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push edi
jmp 0x100220c6
mov esi, eax
mov ecx, 0x12d
mov edi, 0x1006ff60
rep movsd dword es:[edi], dword [esi]
mov byte [eax + 0x9c], 1
movq xmm0, qword [str.127.0.0.1]
movq qword [eax], xmm0
movq xmm0, qword [0x10049a5c]
movq qword [eax + 8], xmm0
movq xmm0, qword [0x10049a64]
movq qword [eax + 0x10], xmm0
movq xmm0, qword [0x10049a6c]
pop edi
movq qword [eax + 0x18], xmm0
mov dword [eax + 0x20], 0x7d0
mov byte [eax + 0x24], 0
mov ecx, str.http:__www.tupac2015.url.tw_login_list.php
mov eax, 0x10070008
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002214b
test dx, dx
je 0x10022147
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002214b
add eax, 4
add ecx, 4
test dx, dx
jne 0x10022125
xor eax, eax
jmp 0x10022150
sbb eax, eax
or eax, 1
test eax, eax
je 0x10022161
call fcn.10022f50
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [0x1006ff84], 0
je 0x100221b7
call fcn.10027fc0
mov dword [0x10070418], eax
call fcn.10028020
mov dword [0x10070420], eax
call fcn.10028020
mov dword [0x10070424], eax
mov eax, dword [0x10070004]
xor eax, 0x1ed8e4e
push eax
push dword [0x10070420]
call fcn.10028170
mov eax, dword [0x10070000]
xor eax, 0x154f7ce
push eax
push dword [0x10070424]
call fcn.10028170
add esp, 0x10
call fcn.10022f50
call fcn.100134a0
cmp byte [0x1006ff96], 0
je 0x100221d4
call fcn.100132f0
mov dword [0x10070450], eax
push 0x3e8
push 0
push 0x1014c658
call fcn.1002ca60
push 0x7d0
push 0
push 0x1014ca40
call fcn.1002ca60
push 0x7d0
push 0
push 0x1014d218
call fcn.1002ca60
mov eax, 0x4cb3
mov word [0x1014cafc], ax
mov eax, 0x4cb2
mov word [0x1014d2d4], ax
mov eax, 0x4fde
mov word [0x1014cdb0], ax
mov eax, 0x4fdd
mov word [0x1014d588], ax
mov eax, 0x4fe0
mov word [0x1014cdb4], ax
mov eax, 0x4fdf
add esp, 0x24
mov word [0x1014d58c], ax
call fcn.10024ff0
call fcn.10023520
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10023d70
push 0x100226a0
push 0x1014dcd8
call fcn.10023e30
push 0x100224a0
push 0x1014dcdc
call fcn.10023e30
call fcn.10023780
push 0
push 0
push 0
push 0x10016f60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100222b1
ret

Function at 0x10023590
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1014de28]
mov dword [ebp - 4], eax
jmp 0x100235a9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100235c6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100235a0
mov esp, ebp
pop ebp
ret
Function at 0x100235d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1014de38], eax
je 0x100235ee
mov eax, 0x10dd
jmp 0x100236cf
mov eax, dword [0x1014de48]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002366c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1002364a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1002364a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10023740
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.1002ad6b
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x100235f6
mov dword [0x1014de48], 0
call fcn.100236e0
mov ecx, dword [0x1014de44]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x100236b9
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.1002ad6b
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x10023684
mov dword [0x1014de44], 0
mov dword [0x1014de38], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10023c40
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10023c55
xor eax, eax
jmp 0x10023cca
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x10023c82
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x10023cc5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x10023cc3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x10023cbf
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x10023cc3
xor eax, eax
jmp 0x10023cca
jmp 0x10023c79
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10023d70
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1014de3c], 0
je 0x10023d89
mov eax, dword [0x1014de3c]
jmp 0x10023e29
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10023d9b
xor eax, eax
jmp 0x10023e29
push 8
call fcn.1002ad1c
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10023df1
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x10023dda
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1002ad6b
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x1014de3c], eax
mov dword [0x1014de40], 0
mov eax, dword [ebp - 4]
jmp 0x10023e29
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10023e0b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10023dbb
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x1014de44]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x1014de44], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10024650
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10024720
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1002470c
cmp dword [ebp - 4], 0x50000000
jb 0x1002468c
cmp dword [ebp - 4], 0x80000000
ja 0x1002468c
mov dword [ebp - 4], 0x80010000
jmp 0x10024665
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.1002ca60
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100246b2
jmp 0x1002470c
cmp dword [ebp - 0x10], 0x10000
jne 0x100246f5
cmp dword [ebp - 0x14], 0x10000
jb 0x100246f5
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x100246e8
mov eax, dword [ebp - 0x24]
jmp 0x1002470e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10024707
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10024720
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10024665
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10024750
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10024820
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10024814
cmp dword [ebp - 4], 0x50000000
jb 0x10024791
cmp dword [ebp - 4], 0x80000000
ja 0x10024791
mov dword [ebp - 4], 0x4fff0000
jmp 0x1002476a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.1002ca60
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100247b7
jmp 0x10024814
cmp dword [ebp - 0x10], 0x10000
jne 0x100247fa
cmp dword [ebp - 0x14], 0x10000
jb 0x100247fa
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x100247ed
mov eax, dword [ebp - 0x24]
jmp 0x10024816
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1002480f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10024820
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1002476a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100249a0
Capabilities:
Encrypt data using rc4 prga
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10065a28
push 0x1002c8c0
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, dword [0x1006b2f0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], 0
jne 0x100249ea
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x10024a20
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x34]
jmp 0x10024bab
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0x4550
je 0x10024a58
push 0xbf
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x38]
jmp 0x10024bab
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax + 0x14]
test ecx, ecx
jne 0x10024a84
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x3c]
jmp 0x10024bab
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 0
jmp 0x10024aa7
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x28], edx
jae 0x10024b56
push str..detour
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
add eax, dword [ebp - 0x20]
push eax
call fcn.1002ed30
add esp, 8
test eax, eax
jne 0x10024b51
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x20]
cmp dword [edx + ecx + 0xc], 0
je 0x10024af2
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + eax + 0x10], 0
jne 0x10024af4
jmp 0x10024b56
mov edx, dword [ebp - 0x28]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx + 0xc]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0x40
jb 0x10024b21
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx + 4], 0x727444
je 0x10024b23
jmp 0x10024b56
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 8], 0
jne 0x10024b37
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov dword [eax + 8], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x40]
jmp 0x10024bab
jmp 0x10024a9e
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x44]
jmp 0x10024bab
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4