joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40be20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4ce3b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4ce3b0]
sub esp, 4
test ebx, ebx
je 0x40be72
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40be6b
test esi, esi
je 0x40be6b
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40be4d
mov dword [esp], 0x4ce3b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40caa0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40cad4
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x4ce3d4], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [0x4c1020], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40cac3

Function at 0x40cb70
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x24
mov edx, dword [0x4c1020]
test edx, edx
js 0x40cb8e
mov eax, dword [0x4ce3d8]
test edx, edx
jne 0x40cba2
add esp, 0x24
pop ebx
pop esi
ret
call sym._fc_key_init_once
mov edx, dword [0x4c1020]
mov eax, dword [0x4ce3d8]
test edx, edx
je 0x40cb88
mov esi, dword [0x4ce3d4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
mov eax, dword [esp + 0x1c]
add esp, 0x24
pop ebx
pop esi
ret
Function at 0x40cc40
Capabilities:
Set thread local storage value

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, 1
push ebx
mov ebx, eax
sub esp, 0x3c
mov eax, dword [eax + 0xc]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [edx]
test eax, eax
jne 0x40cc84
jmp 0x40cd42
mov dword [0x4ce3d8], ecx
mov eax, dword [edi]
add esi, 1
mov eax, dword [eax]
mov dword [edi], eax
test eax, eax
je 0x40cd42
mov ebp, dword [eax + 0x18]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov edx, dword [ebx + 4]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov eax, dword [ebx]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 0xa
mov dword [esp], 1
call eax
test eax, eax
jne 0x40cd78
test ebp, ebp
je 0x40ccf9
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call ebp
cmp eax, 7
je 0x40cda1
cmp eax, 8
jne 0x40cd78
mov eax, dword [edi]
mov ecx, dword [eax]
mov eax, dword [0x4c1020]
test eax, eax
js 0x40cd85
test eax, eax
je 0x40cc6d
mov eax, dword [0x4ce3d4]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40cc73
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
add esi, 1
mov eax, dword [eax]
mov dword [edi], eax
test eax, eax
jne 0x40cc84
mov eax, dword [esp + 0x24]
mov edx, dword [ebx + 4]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
mov eax, dword [ebx]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 0x1a
mov dword [esp], 1
call eax
test eax, eax
je 0x40cd9c
add esp, 0x3c
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x28], ecx
call sym._fc_key_init_once
mov eax, dword [0x4c1020]
mov ecx, dword [esp + 0x28]
jmp 0x40cd06
mov eax, 5
mov ecx, dword [esp + 0x2c]
mov dword [ecx], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40cdb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x4c1020]
mov ebx, dword [esp + 0x30]
test eax, eax
js 0x40ce2d
test eax, eax
jne 0x40cddd
mov eax, dword [0x4ce3d8]
mov dword [0x4ce3d8], ebx
mov dword [ebx], eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [0x4ce3d4]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x4ce3d4]
mov dword [ebx], esi
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40cdd5
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
jmp eax
call sym._fc_key_init_once
mov eax, dword [0x4c1020]
jmp 0x40cdc4
Function at 0x40ce40
Capabilities:
Set thread local storage value

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x20]
mov ebx, dword [eax]
mov eax, dword [0x4c1020]
test eax, eax
js 0x40ce85
test eax, eax
jne 0x40ce62
mov dword [0x4ce3d8], ebx
add esp, 0x18
pop ebx
ret
mov eax, dword [0x4ce3d4]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40ce5d
add esp, 0x18
pop ebx
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
call sym._fc_key_init_once
mov eax, dword [0x4c1020]
jmp 0x40ce53

Function at 0x40cf80
Capabilities:
Get thread local storage value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [0x4c1020]
mov ebx, dword [esp + 0x40]
test eax, eax
js 0x40d000
mov esi, dword [0x4ce3d8]
test eax, eax
jne 0x40d014
mov dword [esp + 0x28], esi
test esi, esi
je 0x40cff4
mov eax, esi
lea edi, [esp + 0x28]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x40cfe6
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 4], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp], 1
call ecx
cmp eax, 6
je 0x40d041
cmp eax, 8
jne 0x40d06c
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
test eax, eax
jne 0x40cfab
mov eax, 5
add esp, 0x30
pop ebx
pop esi
pop edi
ret
call sym._fc_key_init_once
mov eax, dword [0x4c1020]
mov esi, dword [0x4ce3d8]
test eax, eax
je 0x40cf9d
mov esi, dword [0x4ce3d4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x40cf9d
mov eax, dword [esp + 0x28]
mov dword [ebx + 0xc], 0
lea ecx, [esp + 0x2c]
mov edx, edi
mov dword [esp + 0x28], esi
mov dword [ebx + 0x10], eax
mov eax, ebx
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x40cff9
mov eax, edi
call sym._uw_install_context.isra.0
mov eax, 3
jmp 0x40cff9

Function at 0x40d360
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
mov dword [0x4ce3e4], 0xffffffff
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
sub esp, 0x10
mov dword [0x4ce3e8], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d3c2
mov dword [esp + 4], sym._emutls_destroy
mov dword [esp], eax
mov dword [0x4ce3e0], eax
call sym.___mingwthr_key_dtor
test eax, eax
jne 0x40d3ca
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d3ba
call sym._abort
nop
Function at 0x40d3d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [0x4c1014]
mov eax, dword [esp + 0x40]
test edx, edx
jne 0x40d3f4
mov eax, dword [eax + 8]
test eax, eax
je 0x40d44d
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [eax + 8]
test esi, esi
je 0x40d45f
mov ebx, dword [0x4ce3e0]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
mov edi, eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
test ebx, ebx
je 0x40d4e1
mov edi, dword [ebx]
cmp edi, esi
jb 0x40d527
lea ebx, [ebx + esi*4]
mov eax, dword [ebx]
test eax, eax
jne 0x40d3ec
mov eax, dword [esp + 0x40]
call sym._emutls_alloc
mov dword [ebx], eax
jmp 0x40d3ec
mov eax, dword [esp + 0x40]
call sym._emutls_alloc
mov edx, dword [esp + 0x40]
mov dword [edx + 8], eax
jmp 0x40d3ec
mov ebp, dword [0x4c1014]
test ebp, ebp
je 0x40d595
mov edi, dword [0x4c1024]
test edi, edi
je 0x40d5be
lock add dword [0x4ce3e4], 1
jne 0x40d5f0
mov eax, dword [esp + 0x40]
mov esi, dword [eax + 8]
test esi, esi
je 0x40d5a4
mov eax, dword [0x4c1014]
test eax, eax
je 0x40d3fb
mov eax, 0xffffffff
lock xadd dword [0x4ce3e4], eax
sub eax, 1
js 0x40d3fb
mov eax, dword [0x4ce3e8]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
sub esp, 0xc
jmp 0x40d3fb
lea eax, [esi + 0x21]
mov dword [esp + 4], 4
lea edi, [esi + 0x20]
mov dword [esp], eax
call sym._calloc
mov ebx, eax
test eax, eax
je 0x40d61e
mov dword [eax], edi
mov eax, dword [0x4ce3e0]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40d437
call ebp
jmp 0x40d437
lea ecx, [edi + edi]
lea eax, [esi + 0x20]
mov dword [esp], ebx
cmp esi, ecx
cmova ecx, eax
lea eax, [ecx*4 + 4]
mov dword [esp + 0x1c], ecx
mov dword [esp + 4], eax
call sym._realloc
mov ebx, eax
test eax, eax
je 0x40d61e
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
sub ecx, edi
lea eax, [eax + edi*4 + 4]
shl ecx, 2
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp], eax
call sym._memset
jmp 0x40d503
call sym._emutls_init
mov dword [0x4c1024], 1
mov edx, dword [0x4c1014]
test edx, edx
jne 0x40d47b
mov eax, dword [esp + 0x40]
mov esi, dword [eax + 8]
test esi, esi
jne 0x40d3fb
mov eax, dword [0x4ce3dc]
lea esi, [eax + 1]
mov dword [0x4ce3dc], esi
mov eax, dword [esp + 0x40]
mov dword [eax + 8], esi
jmp 0x40d498
lock add dword [0x4c1028], 1
je 0x40d578
mov esi, dword [0x4c1024]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jne 0x40d587
mov dword [esp], 0
call ebx
mov ecx, dword [0x4c1024]
sub esp, 4
test ecx, ecx
je 0x40d5d8
jmp 0x40d587
mov eax, dword [0x4ce3e8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x40d489
lock sub dword [0x4ce3e4], 1
jmp 0x40d489
call sym._abort
lea esi, [esi]
lea esi, [esi]
Function at 0x409384
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00409338
test al, al
jne 0x4093a5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4093f1
xor eax, eax
push ebp
push 0x4093e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004033cc
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4093e8
lea eax, [ebp - 0xc]
call fcn.00409374
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40971c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40980b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0040710c
mov edx, dword [ebp - 8]
mov ecx, 0x409824
xor eax, eax
call fcn.00409610
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4097d9
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x40973c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.004091c0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00405080
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0040769c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x68
call fcn.00409190
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404a4c
call fcn.00405c7c
call fcn.00402e88
jmp 0x40973c
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004031e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409812
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403170
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403170
ret

Function at 0x4098d8
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409932
inc esi
xor edi, edi
cmp edi, 1
jne 0x4098fe
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x40990c
cmp edi, 1
jle 0x40990c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409384
test eax, eax
jne 0x409932
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409932
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409932
inc edi
dec esi
jne 0x4098ee
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x40993c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x409989
xor ebx, ebx
jmp 0x40997e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.0040502c
test eax, eax
jne 0x40997d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x409a39
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x40995f
mov al, byte [ebp - 1]
sub al, 1
jb 0x409994
je 0x40999d
jmp 0x4099a6
call fcn.0040743c
mov edi, eax
jmp 0x4099a8
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x4099a8
xor edi, edi
test di, di
je 0x409a39
xor ebx, ebx
jmp 0x4099e4
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x4099e3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4099d8
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x4099e3
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409a39
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4099b5
xor ebx, ebx
jmp 0x409a2e
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x409a2d
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x409a22
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x409a2d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x409a39
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4099f3
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x409dec
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409ebf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409ed8
push ebx
push 0x409ee4
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040336c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033cc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409e6c
mov al, 0x6a
call fcn.00409a48
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409dc0
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409e75
call fcn.00409dc0
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ec6
lea eax, [ebp - 4]
call fcn.00403150
ret
Function at 0x409f58
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40a00c
jmp 0x40a001
cmp dword [esi + 0x10], 0x1000
jne 0x409fed
test byte [esi + 0x15], 1
jne 0x409fed
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409fac
cmp eax, 2
je 0x409fac
cmp eax, 0x10
je 0x409fac
cmp eax, 0x20
jne 0x409fc1
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409fc1
mov bl, 1
xor ebp, ebp
jmp 0x409fd2
mov eax, dword [esi]
add eax, ebp
call fcn.00409f50
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409fc5
test bl, bl
je 0x409fed
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x40a00c
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409f84
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x100010a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10001164
cmp dword [ebp - 4], 0x50000000
jb 0x100010e1
cmp dword [ebp - 4], 0x80000000
ja 0x100010e1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100010ba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10144270
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10001107
jmp 0x10001164
cmp dword [ebp - 0x14], 0x10000
jne 0x1000114a
cmp dword [ebp - 0x18], 0x10000
jb 0x1000114a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000113d
mov eax, dword [ebp - 8]
jmp 0x10001166
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000115f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100010ba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10001170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000122c
cmp dword [ebp - 4], 0x50000000
jb 0x100011ac
cmp dword [ebp - 4], 0x80000000
ja 0x100011ac
mov dword [ebp - 4], 0x80010000
jmp 0x10001185
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10144270
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100011d2
jmp 0x1000122c
cmp dword [ebp - 0x14], 0x10000
jne 0x10001215
cmp dword [ebp - 0x18], 0x10000
jb 0x10001215
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10001208
mov eax, dword [ebp - 8]
jmp 0x1000122e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10001227
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10001185
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10329710]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret
Function at 0x10002070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10329720], eax
je 0x1000208e
mov eax, 0x10dd
jmp 0x1000216f
mov eax, dword [0x10329730]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000210c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100020ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100020ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001710
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10141b6f
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10002096
mov dword [0x10329730], 0
call fcn.10001a30
mov ecx, dword [0x1032972c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10002159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10141b6f
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10002124
mov dword [0x1032972c], 0
mov dword [0x10329720], 0
xor eax, eax
mov esp, ebp
pop ebp
ret