joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10080c00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
mov eax, ebp
test ebp, ebp
jne 0x10080c17
xor ebx, ebx
jmp 0x10080c2f
cmp byte [ebp], 0
je 0x10080c26
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x10080c20
sub eax, ebp
and eax, 0x3fffffff
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x10080cee
jmp 0x10080c54
mov esi, dword [esp + 0x10]
cmp esi, 2
jge 0x10080c5c
xor esi, 1
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10080c7c
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 8]
mov edx, esi
shl edx, 4
mov edx, dword [edx + eax]
call fcn.10055b10
test eax, eax
jne 0x10080cdb
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 8]
shl esi, 4
mov ecx, dword [esi + edx + 0xc]
add ecx, 4
cmp dword [ecx + 0xc], 0
je 0x10080cc5
xor eax, eax
mov edi, ebx
mov edx, ebp
test ebx, ebx
jle 0x10080cbf
lea ecx, [ecx]
movzx esi, byte [edx]
movzx esi, byte [esi + 0x100d90e8]
lea ebp, [eax*8]
xor esi, ebp
dec edi
xor eax, esi
inc edx
test edi, edi
jg 0x10080ca0
mov ebp, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x10080cc7
xor edx, edx
push ebp
call fcn.10056a00
add esp, 4
test eax, eax
je 0x10080cf8
mov edi, dword [eax + 8]
test edi, edi
jne 0x10080cee
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jl 0x10080c50
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edi, edi
jmp 0x10080cdb

Function at 0x10080d90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, edi
test edi, edi
jne 0x10080da6
xor ebx, ebx
jmp 0x10080dbf
cmp byte [edi], 0
je 0x10080db6
jmp 0x10080db0
inc eax
cmp byte [eax], 0
jne 0x10080db0
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov edx, dword [ecx + 4]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
test edx, edx
jle 0x10080e7c
mov ecx, dword [ecx + 8]
push esi
mov dword [esp + 0x14], ecx
jmp 0x10080de4
mov eax, dword [esp + 0x10]
cmp eax, 2
jge 0x10080dec
xor eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
shl eax, 4
mov esi, dword [eax + edx + 0xc]
add eax, edx
test ecx, ecx
je 0x10080e0c
mov edx, dword [eax]
call fcn.10055b10
test eax, eax
jne 0x10080e5b
cmp dword [esi + 0x20], 0
lea ecx, [esi + 0x14]
je 0x10080e45
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x10080e3f
nop
movzx edi, byte [edx]
movzx edi, byte [edi + 0x100d90e8]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x10080e20
mov edi, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x10080e47
xor edx, edx
push edi
call fcn.10056a00
add esp, 4
test eax, eax
je 0x10080e78
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x10080e6e
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jl 0x10080de0
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor ebp, ebp
jmp 0x10080e5b
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x100855e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jmp 0x10085600
mov al, byte [ebp + 0x100d9958]
mov byte [esp + 0x10], al
test edi, edi
je 0x10085685
cmp byte [edi], 0
mov eax, edi
je 0x1008561b
inc eax
cmp byte [eax], 0
jne 0x10085615
mov ecx, dword [esp + 0x20]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x190
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x1008566d
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x10085663
mov edi, edi
movzx edi, byte [edx]
movzx edi, byte [edi + 0x100d90e8]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x10085640
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
xor edx, edx
div dword [ecx]
jmp 0x1008566f
xor edx, edx
push edi
call fcn.10056a00
add esp, 4
test eax, eax
je 0x10085681
mov eax, dword [eax + 8]
jmp 0x1008568c
xor eax, eax
jmp 0x1008568c
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x1008569c
movzx ecx, byte [esp + 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x100856bd
inc ebp
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x10085600
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0x10]
pop edi
mov dword [esi + 0x10], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x100b50f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100bb898
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
mov edi, dword [esp + 0x1c]
mov edx, dword [eax + 0x4c]
push edi
call edx
mov esi, eax
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
mov dword [esp + 0x18], 0
push edx
test esi, esi
je 0x100b515a
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esi]
mov eax, dword [eax + 4]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push ecx
push edx
push edi
mov ecx, esi
call eax
jmp 0x100b5175
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
push edi
call dword [0x100ff7a4]
mov edi, eax
mov dword [esp + 0x14], 0xffffffff
test esi, esi
je 0x100b518d
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x1c

Function at 0x100b51b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100bb898
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
mov edi, dword [esp + 0x1c]
mov edx, dword [eax + 0x50]
push edi
call edx
mov esi, eax
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
mov dword [esp + 0x18], 0
push edx
test esi, esi
je 0x100b521a
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esi]
mov eax, dword [eax + 8]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push ecx
push edx
push edi
mov ecx, esi
call eax
jmp 0x100b5235
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
push edi
call dword [0x100ff7e0]
mov edi, eax
mov dword [esp + 0x14], 0xffffffff
test esi, esi
je 0x100b524d
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x1c
Function at 0x100b5d30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100beb2c
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push esi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
sete al
test ecx, ecx
je 0x100b5e48
push 1
push 2
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_int_]
mov dword [esp + 0xb8], 0
call dword [sym.imp.MSVCP90.dll_public:_static_class_std::locale_const____cdecl_std::locale::classic_void_]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + 4]
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + ecx + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_class_std::locale___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::imbue_class_std::locale_const__]
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::locale::destructor_void_]
call fcn.100b83e0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call fcn.100b87e0
mov edx, dword [ebp + 0xc]
push edx
push esi
call fcn.100b8860
call fcn.100b8500
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
mov eax, str._hooked_successfully_n
jne 0x100b5de7
mov eax, str._hook_failed_n
push eax
mov eax, dword [ebp + 8]
push ecx
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.1000dcf0
add esp, 0xc
push eax
call fcn.1000df00
add esp, 8
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::str_void_]
cmp dword [eax + 0x18], 8
jb 0x100b5e1d
mov eax, dword [eax + 4]
jmp 0x100b5e20
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x2c]
mov dword [esp + 0xb8], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::vbase_dtor_void_]
mov eax, esi
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b6be0
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x100bea82
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100fc018]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x60]
mov ebx, ecx
mov dword [esp + 0x3c], 0
cmp dword [esp + 0x5c], 8
mov eax, dword [esp + 0x48]
jae 0x100b6c24
lea eax, [esp + 0x48]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x100b6c53
cmp dword [esp + 0x14], 1
jge 0x100b6c53
lea ecx, [esp + 0x44]
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
jmp 0x100b6cb7
mov edx, dword [edi]
push edx
mov ecx, ebp
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov esi, 1
cmp dword [esp + 0x14], esi
jle 0x100b6c9c
mov eax, dword [edi + esi*4]
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x40], 1
call fcn.1000aff0
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
inc esi
cmp esi, dword [esp + 0x14]
jl 0x100b6c69
cmp dword [ebp + 0x14], 0
lea ecx, [esp + 0x44]
setne bl
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, bl
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0x20
Function at 0x100b79e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100e9420
push 0x100baa89
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x100fc018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp + 8], ecx
xor esi, esi
cmp eax, esi
jne 0x100b7a2d
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp + 8], eax
mov ecx, eax
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x100b7a44
push 0xc1
jmp 0x100b7b21
mov edx, dword [ecx + 0x3c]
add edx, ecx
mov dword [ebp - 0x20], edx
cmp dword [edx], 0x4550
je 0x100b7a5e
push 0xbf
jmp 0x100b7b21
movzx ecx, word [edx + 0x14]
cmp cx, si
je 0x100b7b1c
movzx ecx, cx
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 0x1c], esi
movzx edx, word [edx + 6]
cmp esi, edx
jae 0x100b7b1c
lea ecx, [esi + esi*4]
lea edi, [eax + ecx*8]
mov edx, str..detour
mov ecx, edi
mov edi, edi
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x100b7ab0
test bl, bl
je 0x100b7aac
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x100b7ab0
add ecx, 2
add edx, 2
test bl, bl
jne 0x100b7a90
xor ecx, ecx
jmp 0x100b7ab5
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x100b7b0a
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x100b7b1c
cmp dword [edi + 0x10], 0
je 0x100b7b1c
mov edx, dword [ebp + 8]
lea esi, [ecx + edx]
mov eax, dword [esi]
cmp eax, 0x40
jb 0x100b7b1c
cmp dword [esi + 4], 0x727444
jne 0x100b7b1c
cmp dword [esi + 8], 0
jne 0x100b7ae5
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc esi
mov edx, dword [ebp - 0x20]
jmp 0x100b7a72
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100b7cf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
cmp dword [esi], 0x678
jne 0x100b7df8
cmp dword [esp + 0x10], 0x678
jb 0x100b7df8
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
push ebx
or eax, 0xffffffff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0x10], eax
mov dword [esp + 8], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push ecx
push edx
xor ebx, ebx
call edi
test eax, eax
je 0x100b7dee
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x14]
lea eax, [esp + 8]
push eax
push 0x40
push ecx
push edx
call edi
test eax, eax
je 0x100b7dda
mov eax, dword [esi + 4]
mov edx, dword [esi + 0x10]
push eax
lea ecx, [esi + 0x1c]
push ecx
push edx
call sub.MSVCR90.dll_memcpy
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x14]
push eax
lea ecx, [esi + 0x5c]
push ecx
push edx
call sub.MSVCR90.dll_memcpy
mov eax, dword [esi + 0x18]
add esp, 0x18
test eax, eax
je 0x100b7dc1
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0x18]
push ecx
push 0x40
push edx
push eax
call edi
test eax, eax
je 0x100b7dc6
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x18]
push eax
lea ecx, [esi + 0x664]
push ecx
push edx
call sub.MSVCR90.dll_memcpy
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 0xc]
add esp, 0xc
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
call edi
mov ebx, 1
mov edx, dword [esp + 8]
mov eax, dword [esi + 8]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x14]
push edx
push eax
push ecx
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esi + 0x10]
push eax
push ecx
push edx
call edi
pop edi
mov eax, ebx
pop ebx
add esp, 0xc
ret 4
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esp, 0xc
ret 4

Function at 0x100b7e10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100e9400
push 0x100baa89
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100fc018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], dx
jne 0x100b7eb2
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100b7eb2
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x100b7eb2
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x100b7eb2
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b7f60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [0x100ff100]
test esi, esi
je 0x100b7f8a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x100b7f73
pop edi
pop esi
pop ecx
ret

Function at 0x100b7fe0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x1c
push ebx
push esi
mov esi, eax
movzx eax, si
push edi
test eax, eax
je 0x100b7ff6
lea esi, [eax + esi - 0x10000]
cmp esi, dword [esp + 0x2c]
jae 0x100b809f
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea esp, [esp]
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x100b8024
mov esi, 0x80010000
jmp 0x100b8095
xor eax, eax
push 0x1c
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call ebx
test eax, eax
je 0x100b809f
cmp dword [esp + 0x1c], 0x10000
mov eax, dword [esp + 0x18]
jne 0x100b8080
cmp eax, 0x10000
jb 0x100b8080
push 0x40
push 0x3000
push 0x10000
push esi
call edi
test eax, eax
jne 0x100b80a1
add esi, 0x10000
jmp 0x100b8095
mov edx, dword [esp + 0xc]
lea esi, [edx + eax]
movzx eax, si
test eax, eax
je 0x100b8095
lea esi, [esi + eax - 0x10000]
cmp esi, dword [esp + 0x2c]
jb 0x100b8010
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x100b80b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, eax
add esi, 0xffff0000
movzx eax, si
push edi
test eax, eax
je 0x100b80c8
sub esi, eax
cmp esi, dword [esp + 0x30]
jbe 0x100b815b
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebp, 0x10000
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x100b80f7
mov esi, 0x4fff0000
jmp 0x100b8155
xor eax, eax
push 0x1c
lea ecx, [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call ebx
test eax, eax
je 0x100b815b
cmp dword [esp + 0x20], ebp
jne 0x100b8142
cmp dword [esp + 0x1c], ebp
jb 0x100b8142
push 0x40
push 0x3000
push ebp
push esi
call edi
test eax, eax
jne 0x100b815d
sub esi, ebp
jmp 0x100b8155
mov esi, dword [esp + 0x14]
add esi, 0xffff0000
movzx eax, si
test eax, eax
je 0x100b8155
sub esi, eax
cmp esi, dword [esp + 0x30]
ja 0x100b80e3
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x100b8170
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
push edi
lea ebx, [esi - 0x7ff80000]
cmp esi, 0x7ff80000
ja 0x100b8189
mov ebx, 0x10000
lea ebp, [esi + 0x7ff80000]
cmp esi, 0x80000000
jb 0x100b819c
mov ebp, 0xfff80000
mov eax, dword [0x100ff104]
mov edx, dword [0x100ff100]
test eax, eax
jne 0x100b81b6
test edx, edx
je 0x100b81c9
mov eax, edx
mov dword [0x100ff104], eax
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100b81c9
cmp ecx, ebx
jb 0x100b81c9
cmp ecx, ebp
jbe 0x100b82b7
mov eax, edx
mov dword [0x100ff104], eax
test edx, edx
je 0x100b81f7
test eax, eax
je 0x100b81eb
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100b81eb
cmp ecx, ebx
jb 0x100b81eb
cmp ecx, ebp
jbe 0x100b82b2
mov eax, dword [eax + 4]
test eax, eax
jne 0x100b81d8
mov dword [0x100ff104], eax
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, 0x40000000
jbe 0x100b8232
lea edi, [esi - 0x40000000]
push esi
mov eax, edi
call fcn.100b7fe0
add esp, 4
test eax, eax
jne 0x100b8276
push ebx
mov eax, edi
call fcn.100b80b0
add esp, 4
test eax, eax
jne 0x100b8276
cmp esi, 0x40000000
jae 0x100b8258
lea edi, [esi + 0x40000000]
push esi
mov eax, edi
call fcn.100b80b0
add esp, 4
test eax, eax
jne 0x100b8276
push ebp
mov eax, edi
call fcn.100b7fe0
add esp, 4
test eax, eax
jne 0x100b8276
push ebx
mov eax, esi
call fcn.100b80b0
add esp, 4
test eax, eax
jne 0x100b8276
push ebp
mov eax, esi
call fcn.100b7fe0
add esp, 4
test eax, eax
je 0x100b82df
xor edx, edx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov ecx, dword [0x100ff100]
mov dword [eax + 4], ecx
mov dword [0x100ff104], eax
mov dword [0x100ff100], eax
lea ecx, [eax + 0xffa8]
mov esi, 0x38b
nop
mov dword [ecx + 0x40], edx
mov edx, ecx
sub ecx, 0x48
sub esi, 1
jne 0x100b82a0
mov dword [eax + 8], edx
jmp 0x100b82b7
mov dword [0x100ff104], eax
mov esi, dword [eax + 8]
cmp esi, ebx
jb 0x100b82df
cmp esi, ebp
ja 0x100b82df
mov edx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [eax + 8], edx
call sub.MSVCR90.dll_memset
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x100b8320
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov eax, dword [0x100ff100]
push ebx
mov ebx, 0x100ff100
test eax, eax
je 0x100b838b
push esi
push edi
cmp dword [eax], 0x52727464
jne 0x100b8380
lea edi, [eax + 0x10000]
xor edx, edx
lea esi, [eax + 0x88]
mov ecx, dword [esi]
test ecx, ecx
je 0x100b8355
cmp ecx, eax
jb 0x100b8380
cmp ecx, edi
jae 0x100b8380
inc edx
add esi, 0x48
cmp edx, 0x38d
jb 0x100b8347
mov ecx, dword [eax + 4]
push 0x8000
push 0
push eax
mov dword [ebx], ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x100ff104], 0
jmp 0x100b8383
lea ebx, [eax + 4]
mov eax, dword [ebx]
test eax, eax
jne 0x100b8331
pop edi
pop esi
pop ebx
ret
Function at 0x100b8430
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100ff110], eax
je 0x100b8446
mov eax, 0x10dd
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [0x100ff120]
xor ebp, ebp
push edi
cmp esi, ebp
je 0x100b84ae
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x10]
push eax
movzx eax, byte [edx + 0x36]
push ecx
mov ecx, dword [esi + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebp
jne 0x100b849d
mov ebx, dword [esi + 0x10]
cmp ebx, ebp
je 0x100b849d
push 0x48
push ebp
mov edi, ebx
push ebx
and edi, 0xffff0000
call sub.MSVCR90.dll_memset
mov edx, dword [edi + 8]
mov dword [ebx + 0x40], edx
mov dword [edi + 8], ebx
add esp, 0xc
mov dword [esi + 0x10], ebp
mov edi, dword [esi]
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov esi, edi
cmp edi, ebp
jne 0x100b8456
mov dword [0x100ff120], ebp
call fcn.100b7f90
mov esi, dword [0x100ff11c]
cmp esi, ebp
je 0x100b84e7
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
lea esp, [esp]
mov eax, dword [esi + 4]
push eax
call ebx
mov edi, dword [esi]
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov esi, edi
cmp edi, ebp
jne 0x100b84d0
pop edi
pop esi
mov dword [0x100ff11c], ebp
mov dword [0x100ff110], ebp
pop ebp
xor eax, eax
pop ebx
pop ecx
ret