joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a35c
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x46a42d
xor eax, eax
push ebp
push 0x46a426
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, ebx
call fcn.00404fb0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x46a3ff
xor eax, eax
push ebp
push 0x46a3f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_DeleteService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a3ff
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a42d
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp byte [ebp - 1], 0
je 0x46a425
push 0x7d0
call sub.kernel32.dll_Sleep_1
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a438
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push 0x10
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x46a50e
xor eax, eax
push ebp
push 0x46a507
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10
mov eax, ebx
call fcn.00404fb0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x46a4e0
xor eax, eax
push ebp
push 0x46a4d9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a4e0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a50e
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp byte [ebp - 1], 0
je 0x46a506
push 0x7d0
call sub.kernel32.dll_Sleep_1
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a518
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov ebx, eax
push 0x20
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x46a5e9
xor eax, eax
push ebp
push 0x46a5e2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
mov eax, ebx
call fcn.00404fb0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x46a5bb
xor eax, eax
push ebp
push 0x46a5b4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a5bb
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a5e9
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp byte [ebp - 1], 0
je 0x46a5e1
push 0x7d0
call sub.kernel32.dll_Sleep_1
ret
movzx eax, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a5f4
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [ebp - 0x10], eax
push 2
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x46a6fb
xor eax, eax
push ebp
push 0x46a6f4
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
mov eax, esi
call fcn.00404fb0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x46a6dd
xor eax, eax
push ebp
push 0x46a6d6
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, bl
mov dword [ebp - 0x10], eax
mov eax, dword [0x470674]
cmp dword [eax], 5
jle 0x46a694
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ChangeServiceConfig2A
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x46a6bf
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_ChangeServiceConfigA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a6dd
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a6fb
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003440
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002d340
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1003a080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1000cadb
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1000c0d6
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.10003940
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002dce5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1003a080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov edi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
cmp dword [edx + 0x14], 0xf
jbe 0x1000b03b
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1000b059
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1000b047
push esi
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.1000b750
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1000b076
mov dword [ebx], eax
mov byte [ebx + 4], 0
jmp 0x1000b1d0
cmp dword [0x1003bf70], 0x7ffffff
je 0x1000b1e6
mov dword [ebp - 0x20], 0x1003bf6c
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x1c], 0
call fcn.1000cadb
add esp, 4
mov edi, eax
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x10]
lea ecx, [edi + 8]
call fcn.10002f10
mov dword [ebp - 4], 1
mov ecx, dword [0x1003bf70]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10036270]
mov eax, dword [0x1003bf84]
cvtpd2ps xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x10036270]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1003bf68]
comiss xmm1, xmm0
jbe 0x1000b17d
divss xmm2, xmm0
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
fstp qword [esp]
call fcn.1002abd0
fstp qword [ebp - 0x18]
movsd xmm0, qword [ebp - 0x18]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.1002d0c0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x1003bf84]
cmp eax, ecx
jae 0x1000b15f
cmp eax, 0x200
jae 0x1000b15d
shl eax, 3
cmp eax, ecx
jae 0x1000b15f
mov eax, ecx
push eax
call fcn.1000b370
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1000b750
mov ecx, dword [0x1003bf70]
mov edx, dword [eax]
jmp 0x1000b180
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc ecx
mov dword [0x1003bf70], ecx
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [0x1003bf74]
mov dword [ebp - 0x10], eax
mov eax, dword [0x1003bf80]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [0x1003bf6c]
jne 0x1000b1b4
mov dword [ecx + eax*8], edi
jmp 0x1000b1c6
cmp esi, edx
jne 0x1000b1bd
mov dword [ecx + eax*8], edi
jmp 0x1000b1ca
mov edx, dword [ebp - 0x10]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1000b1ca
mov dword [ecx + eax*8 + 4], edi
mov dword [ebx], edi
mov byte [ebx + 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1000beca
int3
Function at 0x1000b370
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fffffff
sub esp, 0xc
bsr ecx, eax
push ebx
push esi
mov esi, 1
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
ja 0x1000b4e0
lea eax, [ecx - 1]
mov ebx, dword [0x1003bf6c]
or eax, esi
mov dword [ebp - 8], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
mov ecx, 0x1003bf74
lea eax, [esi + esi]
push eax
call fcn.1000aed0
mov edi, dword [0x1003bf6c]
lea eax, [esi - 1]
mov dword [0x1003bf80], eax
mov dword [0x1003bf84], esi
mov edi, dword [edi]
cmp edi, ebx
je 0x1000b4bb
mov esi, edi
nop word [eax + eax]
cmp dword [esi + 0x1c], 0xf
lea ebx, [esi + 8]
mov edi, dword [edi]
mov dword [ebp - 0xc], edi
jbe 0x1000b3f1
mov ebx, dword [esi + 8]
mov eax, dword [esi + 0x18]
xor ecx, ecx
mov dword [ebp - 4], eax
mov edx, 0x811c9dc5
test eax, eax
je 0x1000b418
mov edi, eax
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1000b404
mov edi, dword [ebp - 0xc]
and edx, dword [0x1003bf80]
mov eax, dword [0x1003bf74]
mov ecx, dword [ebp - 8]
lea eax, [eax + edx*8]
mov dword [ebp - 4], eax
cmp dword [eax], ecx
jne 0x1000b437
mov dword [eax], esi
mov dword [eax + 4], esi
jmp 0x1000b4b0
mov ebx, dword [eax + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.1000b7e0
test al, al
jne 0x1000b471
mov ebx, dword [ebx]
cmp ebx, esi
je 0x1000b469
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x1000b4b0
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x1000b493
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.1000b7e0
test al, al
je 0x1000b4c4
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x1000b478
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov esi, edi
cmp edi, dword [ebp - 8]
jne 0x1000b3e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x1000b4b0
push str.invalid_hash_bucket_count
call fcn.1000beca
int3
Function at 0x1000b880
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x1003a080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push esi
push dword [0x1003bf88]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1000b8fa
mov eax, esi
shr eax, 0x10
test eax, eax
jne 0x1000b8c6
push esi
lea eax, [ebp - 0x44]
push 0x100360d4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea esi, [ebp - 0x44]
push esi
lea eax, [ebp - 0x24c]
push 0x100360d8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x24c]
push 0x10
push str.AheadLib
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000cac8
mov esp, ebp
pop ebp
ret
Function at 0x1000b910
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x1003a080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp eax, 3
ja case.default.0x1000b933
jmp dword [eax*4 + 0x1000bb34]
call fcn.100043b0
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.d3d9.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003bf88], eax
test eax, eax
jne 0x1000b9b2
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x10036098
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x61c]
push 0x10
push str.AheadLib
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x10
call fcn.1000b880
mov ecx, 0x11
mov dword [0x1003bf30], eax
call fcn.1000b880
mov ecx, 0x12
mov dword [0x1003bf24], eax
call fcn.1000b880
mov ecx, 0x13
mov dword [0x1003bf14], eax
call fcn.1000b880
mov ecx, str.Direct3DCreate9On12
mov dword [0x1003bf48], eax
call fcn.1000b880
mov ecx, str.Direct3DCreate9On12Ex
mov dword [0x1003bef4], eax
call fcn.1000b880
mov ecx, 0x16
mov dword [0x1003bef8], eax
call fcn.1000b880
mov ecx, 0x17
mov dword [0x1003bf08], eax
call fcn.1000b880
mov ecx, str.Direct3DShaderValidatorCreate9
mov dword [0x1003bf3c], eax
call fcn.1000b880
mov ecx, str.PSGPError
mov dword [0x1003bf40], eax
call fcn.1000b880
mov ecx, str.PSGPSampleTexture
mov dword [0x1003bf20], eax
call fcn.1000b880
mov ecx, str.D3DPERF_BeginEvent
mov dword [0x1003bf38], eax
call fcn.1000b880
mov ecx, str.D3DPERF_EndEvent
mov dword [0x1003bf18], eax
call fcn.1000b880
mov ecx, str.D3DPERF_GetStatus
mov dword [0x1003bf10], eax
call fcn.1000b880
mov ecx, str.D3DPERF_QueryRepeatFrame
mov dword [0x1003bf04], eax
call fcn.1000b880
mov ecx, str.D3DPERF_SetMarker
mov dword [0x1003befc], eax
call fcn.1000b880
mov ecx, str.D3DPERF_SetOptions
mov dword [0x1003bf44], eax
call fcn.1000b880
mov ecx, str.D3DPERF_SetRegion
mov dword [0x1003bef0], eax
call fcn.1000b880
mov ecx, str.DebugSetLevel
mov dword [0x1003bf2c], eax
call fcn.1000b880
mov ecx, str.DebugSetMute
mov dword [0x1003bf00], eax
call fcn.1000b880
mov ecx, str.Direct3D9EnableMaximizedWindowedModeShim
mov dword [0x1003bf28], eax
call fcn.1000b880
mov ecx, str.Direct3DCreate9
mov dword [0x1003bf0c], eax
call fcn.1000b880
mov ecx, str.Direct3DCreate9Ex
mov dword [0x1003bf34], eax
call fcn.1000b880
mov dword [0x1003bf1c], eax
jmp case.default.0x1000b933
mov eax, dword [0x1003bf88]
test eax, eax
je case.default.0x1000b933
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.1000cac8
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000dd50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1000df20
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1000de2d
mov edx, dword [ebp - 4]
cmp edx, dword [0x1003a0f0]
jb 0x1000dd9a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1003a0f4]
ja 0x1000dd9a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1000dd6a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10012070
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1000ddbf
jmp 0x1000de2d
cmp dword [ebp - 0x14], 0x10000
jne 0x1000de13
cmp dword [ebp - 0x18], 0x10000
jb 0x1000de13
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000ddf6
mov eax, dword [ebp - 8]
jmp 0x1000de2f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1000de06
xor eax, eax
jmp 0x1000de2f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000de28
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1000df20
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000dd6a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000de40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1000df50
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000df15
mov edx, dword [ebp - 4]
cmp edx, dword [0x1003a0f0]
jb 0x1000de85
mov eax, dword [ebp - 4]
cmp eax, dword [0x1003a0f4]
ja 0x1000de85
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1000de55
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10012070
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1000deaa
jmp 0x1000df15
cmp dword [ebp - 0x14], 0x10000
jne 0x1000defe
cmp dword [ebp - 0x18], 0x10000
jb 0x1000defe
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000dee1
mov eax, dword [ebp - 8]
jmp 0x1000df17
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1000def1
xor eax, eax
jmp 0x1000df17
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000df10
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1000df50
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000de55
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000df80
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1000e370
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x1003b704], 0
jne 0x1000dfbd
cmp dword [0x1003b700], 0
je 0x1000dfbd
mov eax, dword [0x1003b700]
mov dword [0x1003b704], eax
cmp dword [0x1003b704], 0
je 0x1000e03a
mov ecx, dword [0x1003b704]
cmp dword [ecx + 8], 0
je 0x1000e03a
mov edx, dword [0x1003b704]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1000e03a
mov ecx, dword [0x1003b704]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1000e03a
mov eax, dword [0x1003b704]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x1000e009
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x1000e010
xor eax, eax
jmp 0x1000e159
mov ecx, dword [0x1003b704]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10012070
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x1000e159
mov edx, dword [0x1003b700]
mov dword [0x1003b704], edx
jmp 0x1000e056
mov eax, dword [0x1003b704]
mov ecx, dword [eax + 4]
mov dword [0x1003b704], ecx
cmp dword [0x1003b704], 0
je 0x1000e096
cmp dword [0x1003b704], 0
je 0x1000e094
mov edx, dword [0x1003b704]
cmp dword [edx + 8], 0
je 0x1000e094
mov eax, dword [0x1003b704]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x1000e094
mov edx, dword [0x1003b704]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1000e094
jmp 0x1000dfee
jmp 0x1000e048
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1000e160
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1000e157
mov eax, dword [ebp - 0x18]
mov dword [0x1003b704], eax
mov ecx, dword [0x1003b704]
mov dword [ecx], 0x52727464
mov edx, dword [0x1003b704]
mov dword [edx + 8], 0
mov eax, dword [0x1003b704]
mov ecx, dword [0x1003b700]
mov dword [eax + 4], ecx
mov edx, dword [0x1003b704]
mov dword [0x1003b700], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x1003b704]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x1000e127
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x1000e147
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1000e11e
mov eax, dword [0x1003b704]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1000dfee
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000eea0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1003b700]
mov dword [ebp - 4], eax
jmp 0x1000eeb9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1000eee0
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1000eede
call sub.KERNEL32.dll_GetLastError
jmp 0x1000eee2
jmp 0x1000eeb0
xor eax, eax
mov esp, ebp
pop ebp
ret