joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e22ce
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x5e236c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x5e236c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5e236c
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5e236c
mov ebx, dword [eax + 0x34]
mov dword [ebp - 0xc], ebx
mov ebx, dword [eax + 0x50]
mov dword [ebp - 8], ebx
push edi
push 4
push 0x2000
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x122d2dfb]
pop edi
test eax, eax
jne 0x5e235f
push edi
push 4
push 0x2000
push dword [ebp - 8]
push 0
call dword [edi + 0x122d2dfb]
pop edi
test eax, eax
je 0x5e236c
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x14], eax
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5e23f1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x14]
mov dword [ebp - 8], ebx
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e249d
push ecx
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jae 0x5e2432
mov ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
push ecx
push edi
push 4
push 0x1000
push dword [ebp - 4]
push eax
call dword [edi + 0x122d2dfb]
pop edi
pop ecx
test eax, eax
je 0x5e2490
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5e2470
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 0xc]
lea eax, [ebx + 0x10]
cmp dword [eax + 4], 0
je 0x5e2485
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e2419
pop ecx
mov dword [ebp - 0x10], 0
jmp 0x5e24a4
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x5e26be
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e2738
push ecx
mov ecx, dword [ebx + 0xc]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebx + 0x24]
push edx
call fcn.005e2663
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x1247bd35]
pop edi
test eax, eax
jne 0x5e272e
pop ecx
jmp 0x5e273f
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e26e7
mov dword [ebp - 0x18], 1
popal
mov eax, dword [ebp - 0x18]
leave
ret 4
Function at 0x5e28e5
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x18], 0
jne 0x5e2a39
cmp dword [ebp + 0xc], 0
jne 0x5e2a39
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x5e292c
sub eax, dword [ebp + 0x10]
js 0x5e2a39
je 0x5e2a39
cmp eax, dword [ebp + 0x14]
jl 0x5e2a39
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5e2a39
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5e2a39
mov ebx, dword [eax + 0x50]
push edi
push 4
push 0x1000
push ebx
push 0
call dword [edi + 0x122d2dfb]
pop edi
test eax, eax
je 0x5e2a39
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
pop ebx
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124a6c9c]
push eax
call fcn.005e194d
pop edi
test eax, eax
je 0x5e2a39
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124a6ca0]
push eax
call fcn.005e194d
pop edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xc], eax
push edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi + 4]
rep movsb byte es:[edi], byte [esi]
pop edi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e2a2c
push ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
test eax, eax
je 0x5e2a39
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5e2a19
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e29e7
push dword [ebp + 8]
call fcn.005e37db
jmp 0x5e2a40
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
leave
ret 0x14
Function at 0x5e2dcb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5e2eba
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5e2eba
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5e2e66
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5e2eba
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x124a6dfc]
pop edi
pop ecx
test eax, eax
jne 0x5e2e1f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5e2e6c
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5e2eba
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5e2eba
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5e2eba
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5e2eba
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005e2d14
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x5e9a43
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5e9a5e
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124aec83]
pop edx
test eax, eax
je 0x5e9b30
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5e9b1f
test dword [ebp - 0x2a8], 1
jne 0x5e9b1f
and dword [ebp - 0x2a8], 0x100
jne 0x5e9b1f
push esi
push edx
push 4
push esi
call dword [edx + 0x122d2d2d]
pop edx
pop esi
test eax, eax
je 0x5e9ac2
jmp 0x5e9b1f
cmp word [esi], 0x5a4d
jne 0x5e9b1f
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5e9b1f
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d2c1d]
pop edx
test eax, eax
je 0x5e9b1f
lea eax, [ebp - 0x28c]
push eax
call fcn.005e999f
test eax, eax
jne 0x5e9b18
jmp 0x5e9b1f
mov eax, esi
jmp 0x5e9b30
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5e9a5e
pop esi
leave
ret 4
Function at 0x402eec
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push 0
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push dword [ebp + 0x14]
call sub.kernel32.dll_WriteFile
test eax, eax
setne al
movsx eax, al
push eax
call fcn.00402d8c
mov esi, eax
cmp dword [0x407dcc], 0xffffffff
je 0x402f4d
mov eax, dword [ebp + 0x14]
cmp eax, dword [0x407dc8]
jne 0x402f4d
lea eax, [ebp - 0x1c]
push eax
push dword [0x407dc8]
call sub.kernel32.dll_GetConsoleScreenBufferInfo
movsx eax, word [ebp - 0x18]
mov dword [0x407dd4], eax
movsx eax, word [ebp - 0x16]
mov dword [0x407dd8], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403064
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38c
push esi
push edi
mov edi, 3
push 0x4088ec
call fcn.004061e8
mov esi, dword [eax]
push 0x4088ec
call fcn.004061e8
mov dword [eax], 0x40
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x38c]
push eax
push 0
call fcn.00405a50
call fcn.004058cc
lea eax, [ebp - 0x150]
push eax
push 1
call fcn.00405958
call fcn.004044f0
test eax, eax
jne 0x4031a5
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 0x40
push 0
call fcn.00405a30
call fcn.004044f0
test eax, eax
jne 0x40311b
cmp word [ebp - 0x190], 0x5a4d
jne 0x40311b
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00405974
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x190]
push eax
push 2
push 0
call fcn.00405a30
jmp 0x403125
mov dword [ebp - 0x154], 0
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call fcn.00405974
call fcn.004044f0
test eax, eax
jne 0x403189
cmp word [ebp - 0x190], 0x4550
jne 0x403189
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xf8
push 0
call fcn.00405a30
call fcn.004044f0
test eax, eax
jne 0x403189
cmp dword [ebp - 0x288], 0x4550
jne 0x403189
cmp word [ebp - 0x22c], 3
jne 0x403189
mov edi, 2
lea eax, [ebp - 0x150]
push eax
call fcn.004059a4
push 0x4088e4
call fcn.004061e8
mov dword [eax], 0
push 0x4088ec
call fcn.004061e8
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4031fc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
call sub.kernel32.dll_CreateThread
mov esi, eax
push esi
call sub.kernel32.dll_CloseHandle
test esi, esi
setne al
movsx eax, al
push eax
call fcn.00402d8c
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x4032a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
cmp dword [0x407e6c], 0
je 0x4032c2
mov eax, dword [0x407e6c]
mov dword [ebp - 4], eax
jmp 0x403357
push 0x104
call fcn.004045c4
mov dword [ebp - 4], eax
push 0x104
push dword [ebp - 4]
push 0
call sub.kernel32.dll_GetModuleFileNameA
push dword [ebp - 4]
call fcn.0040408c
inc eax
mov ebx, eax
call sub.kernel32.dll_GetCommandLineA
mov esi, eax
mov al, byte [esi]
dec al
cmp al, 0x1f
jbe 0x403307
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.00403238
mov esi, eax
inc esi
push esi
call fcn.0040408c
inc eax
mov edi, eax
lea eax, [ebp - 4]
push eax
mov eax, ebx
add eax, edi
inc eax
push eax
call fcn.00404624
call sub.kernel32.dll_AreFileApisANSI
test eax, eax
jne 0x403338
push edi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push esi
call sub.user32.dll_CharToOemBuffA
jmp 0x403345
push esi
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push edi
call fcn.00404e04
mov eax, dword [ebp - 4]
add eax, ebx
add eax, edi
mov byte [eax], 0
mov eax, dword [ebp - 4]
mov dword [0x407e6c], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403434
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x24], 0x52414853
mov dword [ebp - 0x20], 0x454d4445
mov dword [ebp - 0x1c], 0x5356354d
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0xb
call fcn.00404d78
xor eax, eax
mov bl, 0
cmp dword [0x407e10], 0
jne 0x403482
push 0x407b60
push 1
call fcn.00402c98
mov dword [0x407e10], eax
cmp dword [0x407e10], 0
jne 0x40349b
push 0x8000
call fcn.004045c4
mov esi, eax
mov bl, 1
jmp 0x4034d5
lea eax, [ebp - 0x24]
push eax
push 0
push 6
call dword [0x407e10]
test eax, eax
jne 0x4034c5
lea eax, [ebp - 0x24]
push eax
push 0x8000
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov bl, 1
push 0
push 0
push 0
push 6
push eax
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test bl, bl
je 0x4034fe
push esi
push 0x8000
push 0xff
call fcn.00404e60
push esi
push 0x24
push 0
call fcn.00404e60
mov eax, esi
add eax, 0xc
push eax
call fcn.004046ac
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4038ac
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push esi
call fcn.00403838
lea edx, [ebp - 0x400]
movzx ecx, word [ebp + 0x14]
dec ecx
xor esi, esi
jmp 0x4038e4
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov word [edx + 2], ax
mov eax, dword [ebp + 0x18]
movzx eax, byte [eax]
mov word [edx], ax
inc dword [ebp + 0x18]
add edx, 4
inc esi
cmp ecx, esi
jge 0x4038ca
mov ax, word [ebp + 0x14]
mov word [ebp - 0x404], ax
mov word [ebp - 0x402], 1
mov word [ebp - 0x408], 0
mov word [ebp - 0x406], 0
mov ax, word [ebp + 0x10]
mov word [ebp - 0x410], ax
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40e], ax
movzx ecx, word [ebp + 0x10]
movzx eax, word [ebp + 0x14]
add ecx, eax
dec ecx
mov word [ebp - 0x40c], cx
mov ax, word [ebp + 0xc]
mov word [ebp - 0x40a], ax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x408]
push dword [ebp - 0x404]
lea eax, [ebp - 0x400]
push eax
push dword [0x407dc8]
call sub.kernel32.dll_WriteConsoleOutputA
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x403c8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x403cac
mov al, byte [ebp - 4]
jmp 0x403caf
mov al, byte [ebp + 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x405d08
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
or edi, 0xffffffff
or eax, 0xffffffff
mov dword [ebp - 0x24], 0
xor esi, esi
mov edx, dword [0x4081c0]
add edx, 0x24
mov esi, edx
cmp dword [edx], 0xffffffff
je 0x405d46
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x405d41
mov ecx, dword [edx + 8]
cmp ecx, dword [esi + 8]
jbe 0x405d41
mov esi, edx
add edx, 0x10
jmp 0x405d2a
mov edx, esi
cmp dword [edx], 0xffffffff
je 0x405e5a
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x405e5a
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x405e58
mov ecx, dword [edx + 8]
sub dword [ebp + 0x10], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [edx + 0xc]
test edx, edx
je 0x405e58
mov cl, byte [edx]
sub cl, 0x3c
jne 0x405d8e
jmp 0x405e58
sub cl, 3
jne 0x405da8
inc edx
mov dword [ebp - 0xc], edx
movzx ecx, byte [edx]
inc ecx
add edx, ecx
mov byte [ebp - 0x25], 1
jmp 0x405e53
inc cl
jne 0x405dbc
movzx ecx, word [edx + 1]
add edi, ecx
add edx, 3
jmp 0x405e53
inc cl
jne 0x405dd0
movzx ecx, word [edx + 1]
add edi, ecx
mov ecx, dword [edx + 3]
add eax, ecx
add edx, 7
jmp 0x405de3
movzx ecx, byte [edx]
shr ecx, 6
add edi, ecx
mov cl, byte [edx]
and cl, 0x3f
movzx ecx, cl
add eax, ecx
inc edx
cmp eax, dword [ebp + 0x10]
jne 0x405ded
mov esi, eax
mov dword [ebp - 0x24], edi
cmp eax, dword [ebp + 0x10]
jl 0x405e4a
sub eax, dword [ebp + 0x10]
cmp eax, 0xa
jle 0x405e00
cmp byte [ebp - 0x25], 0
jne 0x405e48
mov eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov eax, dword [ebp + 0xc]
mov byte [eax], cl
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp eax, dword [ebp - 0x14]
jle 0x405e36
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dl, byte [eax + ecx]
xor dl, 0xaa
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov byte [eax + ecx], dl
jmp 0x405e11
movzx eax, word [ebp - 0x24]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
add esi, dword [ebp - 0x18]
mov eax, esi
jmp 0x405e5a
jmp 0x405e58
mov esi, eax
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x25], 0
jmp 0x405d80
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x406330
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10
cld
push ecx
call fcn.0040630c
call fcn.00403434
mov dword [0x4081c0], eax
lea edx, [eax + 0x18]
mov dword [0x408220], edx
pop edx
call fcn.0040618c
call sub.kernel32.dll_GetEnvironmentStrings
mov dword [0x4081ec], eax
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x408200], eax
mov dword [0x408228], eax
call fcn.00403064
cmp eax, 3
setb byte [0x4081c9]
call fcn.00404084
lea eax, [esp]
xor edx, edx
mov ecx, dword fs:[edx]
mov dword fs:[edx], eax
mov dword [eax], ecx
mov dword [eax + 4], 0x4065bc
mov dword [eax + 8], ebp
jmp dword [esp + 0x10]
Function at 0x100010a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10001164
cmp dword [ebp - 4], 0x50000000
jb 0x100010e1
cmp dword [ebp - 4], 0x80000000
ja 0x100010e1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100010ba
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100a23c0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10001107
jmp 0x10001164
cmp dword [ebp - 0x14], 0x10000
jne 0x1000114a
cmp dword [ebp - 0x18], 0x10000
jb 0x1000114a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000113d
mov eax, dword [ebp - 8]
jmp 0x10001166
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000115f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10001240
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100010ba
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10001170
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000122c
cmp dword [ebp - 4], 0x50000000
jb 0x100011ac
cmp dword [ebp - 4], 0x80000000
ja 0x100011ac
mov dword [ebp - 4], 0x80010000
jmp 0x10001185
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100a23c0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100011d2
jmp 0x1000122c
cmp dword [ebp - 0x14], 0x10000
jne 0x10001215
cmp dword [ebp - 0x18], 0x10000
jb 0x10001215
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10001208
mov eax, dword [ebp - 8]
jmp 0x1000122e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10001227
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10001270
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10001185
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100019a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100019b5
xor eax, eax
jmp 0x10001a2a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100019e2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001a25
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001a23
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10001a1f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001a23
xor eax, eax
jmp 0x10001a2a
jmp 0x100019d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x104f927c]
mov dword [ebp - 4], eax
jmp 0x10001c09
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001c26
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10001c00
mov esp, ebp
pop ebp
ret
Function at 0x10002070
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x104f928c], eax
je 0x1000208e
mov eax, 0x10dd
jmp 0x1000216f
mov eax, dword [0x104f929c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000210c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x100020ea
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x100020ea
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001710
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.100a0dd7
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10002096
mov dword [0x104f929c], 0
call fcn.10001a30
mov ecx, dword [0x104f9298]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10002159
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100a0dd7
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10002124
mov dword [0x104f9298], 0
mov dword [0x104f928c], 0
xor eax, eax
mov esp, ebp
pop ebp
ret