joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c120
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100838ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0
push 0x104
mov ecx, 0x100afb2c
call fcn.1007bc3c
push 0x100981c0
mov ecx, 0x100afb2c
call fcn.1007ba09
push 0xffffffffffffffff
mov ecx, 0x100afb2c
call fcn.1007bc8b
mov eax, dword [0x1009dd3c]
mov dword [ebp - 0x18], eax
mov edi, 1
mov dword [ebp - 4], edi
mov byte [ebp - 4], 2
mov ecx, dword [0x100afb30]
mov edx, dword [ecx]
mov eax, dword [edx + 0x70]
mov ecx, dword [eax + 0x1ec]
mov eax, dword [ecx + 4]
add eax, 0x34
mov dword [ebp - 0x1c], eax
push eax
push 0x100afb2c
lea edx, [ebp - 0x20]
push edx
call fcn.1007bb15
mov bl, 3
mov byte [ebp - 4], bl
push 0x100981b8
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1007bb15
mov byte [ebp - 4], 4
push eax
mov ecx, 0x100afb2c
call fcn.1007b9b9
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x24]
call fcn.1007b8cc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.1007b8cc
mov dword [ebp - 4], edi
push 0x104
lea ecx, [ebp - 0x18]
call fcn.1007bc3c
mov ecx, dword [0x100afb2c]
push ecx
push 0x104
push 0
lea ecx, [ebp - 0x18]
call fcn.1007bc3c
push eax
push 0x100a3ee0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.1007bc8b
lea ecx, [ebp - 0x18]
push ecx
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.1007b641
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.1007b8cc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030f50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x10083ad0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.10077384
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.1007b93a
mov byte [esp + 0x34], 0
lea ecx, [esp + 0x18]
push ecx
call fcn.10024260
mov ebx, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 8
mov eax, dword [0x100afd80]
test eax, eax
jne 0x10030fcb
push str.Exchange_Frame
call fcn.10028240
add esp, 4
mov dword [0x100afd80], eax
mov eax, dword [0x100afd88]
test eax, eax
jne 0x10030fe6
push str.Exchange_Checkbox_Locked
call fcn.10028240
add esp, 4
mov dword [0x100afd88], eax
mov eax, dword [0x100afd90]
test eax, eax
jne 0x10031001
push str.Trade_Accept_Button
call fcn.10028240
add esp, 4
mov dword [0x100afd90], eax
mov edx, dword [0x100afd80]
push edx
call fcn.10028480
add esp, 4
test eax, eax
jne 0x100310c4
lea eax, [esp + 0x14]
push 1
push eax
call fcn.10030eb0
add esp, 8
test eax, eax
je 0x1003117a
push ebx
call fcn.10023790
add esp, 4
cmp eax, 0xffffffff
jne 0x10031056
push 0x1009c524
call fcn.1001bc90
add esp, 4
push 0x2710
call esi
jmp 0x10030fb0
push eax
call fcn.1002e260
add esp, 4
push 0x320
call esi
call fcn.1001bdd0
push 0xbb8
call esi
call ebp
mov ecx, dword [0x100afd80]
mov edi, eax
push ecx
call fcn.10028480
add esp, 4
test eax, eax
jne 0x100310ae
call ebp
sub eax, edi
cmp eax, 0x2710
ja 0x100310ae
push 0x3e8
call esi
mov edx, dword [0x100afd80]
push edx
call fcn.10028480
add esp, 4
test eax, eax
je 0x10031089
mov eax, dword [0x100afd80]
push eax
call fcn.10028480
add esp, 4
test eax, eax
je 0x10030fb0
call fcn.10028720
test eax, eax
je 0x100310fa
mov ecx, dword [0x100afd80]
push ecx
call fcn.10028480
add esp, 4
test eax, eax
je 0x100310fa
lea edx, [esp + 0x14]
push edx
call fcn.1002e6d0
add esp, 4
test eax, eax
je 0x100310fa
call fcn.10028720
test eax, eax
jne 0x100310cd
mov eax, dword [0x100afd80]
push eax
call fcn.10028480
add esp, 4
test eax, eax
je 0x10030fb0
mov ecx, dword [0x100afd88]
push ecx
call fcn.100284e0
add esp, 4
test eax, eax
jne 0x10031134
call fcn.1001b720
push 0x3e8
call esi
jmp 0x10030fb0
mov edx, dword [0x100afd88]
push edx
call fcn.100284e0
add esp, 4
test eax, eax
je 0x10030fb0
mov eax, dword [0x100afd90]
push eax
call fcn.10028540
add esp, 4
test eax, eax
je 0x1003116e
call fcn.1001b770
push 0x3e8
call esi
jmp 0x10030fb0
push 0x7d0
call esi
jmp 0x10030fb0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.100773b7
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret
Function at 0x10031560
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
mov ecx, 0x100afa38
call fcn.10005e30
cmp eax, 0x222
jne 0x100315ff
mov eax, dword [0x100afd64]
mov ecx, dword [eax + 0x110]
test ecx, ecx
je 0x10031591
push 3
jmp 0x10031593
push 0
call fcn.10031930
add esp, 4
mov ecx, 0x100afa38
call fcn.10005e30
cmp eax, 0x222
jne 0x100315ff
push 1
push 1
push 0x3f800000
push 0x42080000
push 0x41600000
mov ecx, 0x100afa38
call fcn.10005230
push 0x1f4
call ebx
push 0x1009ae80
mov ecx, 0x100afa38
call fcn.10005cb0
push 0x1f4
call ebx
push 0x1009c4f0
call fcn.1001b3b0
add esp, 4
push 0x1770
call ebx
jmp 0x10031569
push 0x47a
call fcn.10026360
add esp, 4
cmp eax, 0xffffffff
jne 0x1003167c
push 0
push 0x50
push 0x83
push 0x1009678c
push 0x1009ae80
mov ecx, 0x100afa38
call fcn.10007150
push str.SXRW_090119_002
call fcn.1001b3b0
add esp, 4
push 0x3e8
call ebx
push 0
mov edi, str.SXRW_090119_175
call fcn.1002c2a0
add esp, 4
mov esi, eax
mov ecx, 0x13
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x10031663
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100317a2
call fcn.1001b8a0
push 0x3e8
call ebx
jmp 0x10031569
cmp eax, 2
jne 0x1003169a
push 0x47a
call fcn.1002bd80
add esp, 4
push 0x7d0
call ebx
jmp 0x10031569
cmp eax, 1
jne 0x100316ed
push 0
push 0x50
push 0x83
push 0x1009678c
push 0x1009ae80
mov ecx, 0x100afa38
call fcn.10007150
push str.SXRW_090119_002
call fcn.1001b3b0
add esp, 4
push 0x3e8
call ebx
call fcn.1002bd10
push 0x3e8
call ebx
call fcn.1002bd10
push 0x3e8
call ebx
jmp 0x10031569
test eax, eax
jne 0x1003168e
call fcn.10021480
test eax, eax
mov ecx, 0x100afa38
jne 0x10031754
push eax
push 0x50
push 0x83
push 0x1009678c
push 0x1009ae80
call fcn.10007150
mov ecx, 0x100afa38
call fcn.10008410
push 0xbb8
call ebx
push str.SXRW_090119_002
call fcn.1001b3b0
add esp, 4
push 0x3e8
call ebx
push str.SXRW_090119_015
call fcn.1001b3b0
add esp, 4
push 0x1f40
call ebx
jmp 0x10031569
push 0x400
push 0x400
push 0x1009678c
call fcn.100071f0
push 1
push 1
push 0x3f800000
push 0x42a00000
push 0x43030000
mov ecx, 0x100afa38
call fcn.10005230
push 0xbb8
call ebx
mov ecx, 0x100afa38
call fcn.10005e30
cmp eax, 0x222
jne 0x10031785
jmp 0x10031569
mov ecx, dword [0x100afd4c]
pop edi
pop esi
pop ebx
jmp fcn.100106d0

Function at 0x100330c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [0x100afc48]
test esi, esi
jne 0x100330d1
xor eax, eax
pop esi
pop ecx
ret
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 6
push esi
call edi
mov ecx, 0x10033070
mov byte [esi], 0xe9
sub ecx, esi
mov byte [esi + 5], 0x90
sub ecx, 5
lea edx, [esp + 8]
mov dword [esi + 1], ecx
mov eax, dword [esp + 8]
push edx
push eax
push 6
push esi
call edi
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x10033110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [0x100afc48]
test esi, esi
jne 0x10033121
xor eax, eax
pop esi
pop ecx
ret
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 6
push esi
call edi
mov dword [esi], 0x830104db
mov word [esi + 4], 0x8c4
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
push edx
push 6
push esi
call edi
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x100331a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push 0x42c80000
push esi
push edi
call fcn.10021cb0
add esp, 0xc
test eax, eax
je 0x1003324b
mov eax, dword [esp + 0xc]
push 0
push esi
push edi
push eax
call fcn.10021550
push 0
call fcn.1001b550
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x14
push 0x5dc
call esi
mov ecx, dword [0x100afd9c]
push ecx
call fcn.10028480
add esp, 4
test eax, eax
jne 0x1003320c
mov edx, dword [0x100afda0]
push edx
call fcn.10028480
add esp, 4
test eax, eax
je 0x10033211
call fcn.1001b370
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push ebp
call edi
mov ebp, dword [esp + 0x20]
mov ebx, eax
push 0x7d0
call esi
call edi
sub eax, ebx
cmp eax, 0x3a98
ja 0x10033242
push ebp
mov ecx, 0x100afa38
call fcn.10005dc0
test eax, eax
je 0x10033221
push 0x3e8
call esi
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x100479c0
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0
mov ecx, 0x100afb2c
call fcn.1007bc3c
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push 0x28
push 0x1009db00
push 0x10098168
call edi
push 0
mov ecx, 0x100afb2c
mov dword [esi + 0x104], eax
call fcn.1007bc3c
push eax
push 0xa
push 0x1009daf4
push 0x10098168
call edi
push 0
mov ecx, 0x100afb2c
mov dword [esi + 0x10c], eax
call fcn.1007bc3c
push eax
push 0
push 0x1009dae8
push 0x10098168
call edi
push 0
mov ecx, 0x100afb2c
mov dword [esi + 0xfc], eax
call fcn.1007bc3c
push eax
push 0
push 0x1009dadc
push 0x10098168
call edi
push 0
mov ecx, 0x100afb2c
mov dword [esi + 0x108], eax
call fcn.1007bc3c
push eax
push 0
push 0x1009dad0
push 0x10098168
call edi
push 0
mov ecx, esi
mov dword [esi + 0xf8], eax
call fcn.10079c7c
mov eax, dword [esi + 0xf8]
cmp eax, 5
ja case.default.0x10047a84
jmp dword [eax*4 + 0x10047b28]
mov ecx, esi
call fcn.10045590
jmp case.default.0x10047a84
mov ecx, esi
call fcn.100456c0
jmp case.default.0x10047a84
mov ecx, esi
call fcn.100457f0
jmp case.default.0x10047a84
mov ecx, esi
call fcn.100458f0
jmp case.default.0x10047a84
mov ecx, esi
call fcn.10045a50
jmp case.default.0x10047a84
mov ecx, esi
call fcn.10045b30
push 0
mov ecx, 0x100afb2c
call fcn.1007bc3c
push eax
push 0xffffffffffffffff
push 0x1009dac4
push 0x10098168
call edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
mov eax, dword [esi + 0xd8]
push 0x14e
push eax
call ebx
mov ecx, esi
call fcn.10045c10
push 0
mov ecx, 0x100afb2c
call fcn.1007bc3c
push eax
push 0
push 0x1009dab8
push 0x10098168
call edi
mov ecx, dword [esi + 0x9c]
push 0
push eax
push 0x14e
push ecx
call ebx
pop edi
pop esi
pop ebx
ret
Function at 0x10057628
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c1e8
push 0x10048df8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x100576ae
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
je 0x10057686
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x100576b4
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x1005767e
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x1005767e
mov al, 1
jmp 0x10057680
or dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10057713
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [0x100b2384]
jmp 0x10057733
lea eax, [esp + 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
test esi, esi
jne 0x1005771d
pop esi
pop ecx
ret

Function at 0x1005773a
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100b2390], eax
je 0x10057750
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x100b23a0]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x1005779d
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x1005778e
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x1005778e
push eax
call fcn.10057804
pop ecx
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.10077adb
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x1005775f
mov dword [0x100b23a0], ebx
call fcn.100577dd
mov esi, dword [0x100b239c]
cmp esi, ebx
je 0x100577ca
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.10077adb
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x100577b2
pop edi
mov dword [0x100b239c], ebx
mov dword [0x100b2390], ebx
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10057a83
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x100b2394]
push esi
test eax, eax
push edi
jne 0x10057aed
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x10057aeb
push 8
call fcn.10077ab2
mov esi, eax
pop ecx
test esi, esi
jne 0x10057aaf
push 8
pop edi
jmp 0x10057aca
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10057adb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.10077adb
pop ecx
and dword [0x100b2398], 0
mov dword [0x100b2394], edi
mov eax, edi
jmp 0x10057aed
mov dword [esi + 4], edi
mov eax, dword [0x100b239c]
mov dword [esi], eax
mov dword [0x100b239c], esi
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x10057daa
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
mov ebx, 0x10000
jbe 0x10057dce
lea eax, [esi - 0x7ff80000]
mov dword [ebp + 8], eax
jmp 0x10057dd1
mov dword [ebp + 8], ebx
cmp esi, 0x80000000
jae 0x10057de4
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x10057deb
mov dword [ebp - 4], 0xfff80000
mov eax, dword [0x100b2388]
mov ecx, dword [0x100b2384]
test eax, eax
jne 0x10057e05
test ecx, ecx
je 0x10057e1a
mov eax, ecx
mov dword [0x100b2388], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x10057e1a
cmp edx, dword [ebp + 8]
jb 0x10057e1a
cmp edx, dword [ebp - 4]
jbe 0x10057f06
mov eax, ecx
test ecx, ecx
jmp 0x10057e3e
test eax, eax
je 0x10057e39
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10057e39
cmp ecx, dword [ebp + 8]
jb 0x10057e39
cmp ecx, dword [ebp - 4]
jbe 0x10057f06
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x100b2388], eax
jne 0x10057e20
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp + 8]
mov edi, esi
jbe 0x10057fa1
cmp edi, 0x70000000
jb 0x10057e6e
cmp edi, 0x80000000
ja 0x10057e6e
mov edi, 0x6fff0000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10057fa1
cmp dword [ebp - 0x10], ebx
jne 0x10057e8d
cmp dword [ebp - 0x14], ebx
jae 0x10057ea0
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0x10000]
cmp edi, dword [ebp + 8]
ja 0x10057e59
jmp 0x10057fa1
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x100b2388], eax
je 0x10057fa1
mov dword [eax], 0x52727464
mov eax, dword [0x100b2388]
xor ecx, ecx
mov dword [eax + 8], ecx
mov eax, dword [0x100b2388]
mov edx, dword [0x100b2384]
mov dword [eax + 4], edx
mov eax, dword [0x100b2388]
mov dword [0x100b2384], eax
add eax, 0xffe0
mov edx, 0x7fd
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec edx
jne 0x10057eee
mov eax, dword [0x100b2388]
mov dword [eax + 8], ecx
mov eax, dword [0x100b2388]
mov esi, dword [eax + 8]
cmp esi, dword [ebp + 8]
jb 0x10057fa6
cmp esi, dword [ebp - 4]
ja 0x10057fa6
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.10049e50
add esp, 0xc
mov eax, esi
jmp 0x10057fa8
cmp esi, 0x70000000
jb 0x10057f4a
cmp esi, 0x80000000
ja 0x10057f4a
mov esi, 0x80010000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10057fa6
cmp dword [ebp - 0x10], ebx
jne 0x10057f98
cmp dword [ebp - 0x14], ebx
jb 0x10057f98
mov ecx, esi
and ecx, 0xffff
je 0x10057f7c
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x14], eax
add dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x100b2388], eax
jne 0x10057ebc
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
cmp esi, dword [ebp - 4]
jb 0x10057f35
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10057fad
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c1f8
push 0x10048df8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10058022
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
cmp word [ecx], 0x5a4d
jne 0x1005801e
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x38], eax
cmp dword [eax], 0x4550
jne 0x1005801e
cmp word [eax + 0x14], 0
jne 0x10058013
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x10058024
mov eax, ecx
jmp 0x1005800d
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10058033
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100b2390], eax
je 0x10058052
mov eax, 0x10dd
jmp 0x10058128
mov eax, dword [0x100b2394]
test eax, eax
jne 0x10058128
mov edi, dword [ebp + 8]
test edi, edi
jne 0x1005806e
push 6
pop eax
jmp 0x10058128
cmp dword [edi], 0
jne 0x10058080
push 6
pop eax
mov dword [0x100b2394], eax
jmp 0x10058122
push 0x18
call fcn.10077ab2
mov esi, eax
pop ecx
test esi, esi
jne 0x10058093
push 8
pop edi
jmp 0x1005810c
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.100575c2
movzx ecx, byte [edi + 0x17]
mov ebx, dword [edi + 0x18]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x10058101
cmp ecx, 0x17
ja 0x10058101
cmp dword [edi + 0x1c], eax
jne 0x10058101
lea eax, [ebp - 4]
mov dword [ebp - 4], edx
push eax
push 0x40
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100580d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1005810c
mov eax, dword [ebp + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x100b23a0]
mov dword [esi], eax
mov dword [0x100b23a0], esi
xor eax, eax
jmp 0x10058128
cmp dword [0x100b238c], edx
push 9
pop edi
jne 0x10058112
mov dword [0x100b2394], edi
test esi, esi
je 0x1005811d
push esi
call fcn.10077adb
pop ecx
mov eax, edi
mov edi, dword [ebp + 8]
mov dword [0x100b2398], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1005812f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
xor edi, edi
cmp dword [0x100b23cc], edi
jne 0x100582cf
mov eax, dword [0x100b23c8]
cmp eax, edi
jne 0x100582d1
push 0x24
mov ebx, 0x100b23a4
push edi
push ebx
call fcn.10049e50
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.dbghelp.dll
mov dword [0x100b23a4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [0x100b23a8], eax
je 0x10058290
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImagehlpApiVersionEx
push eax
call esi
push str.SymInitialize
mov dword [0x100b23ac], eax
push dword [0x100b23a8]
call esi
push str.SymSetOptions
mov dword [0x100b23b0], eax
push dword [0x100b23a8]
call esi
push str.SymGetOptions
mov dword [0x100b23b4], eax
push dword [0x100b23a8]
call esi
push str.SymLoadModule64
mov dword [0x100b23b8], eax
push dword [0x100b23a8]
call esi
push str.SymGetModuleInfo64
mov dword [0x100b23bc], eax
push dword [0x100b23a8]
call esi
push str.SymFromName
mov dword [0x100b23c0], eax
push dword [0x100b23a8]
call esi
mov dword [0x100b23c4], eax
push 8
lea eax, [ebp - 8]
push edi
push eax
call fcn.10049e50
mov eax, dword [0x100b23ac]
add esp, 0xc
cmp eax, edi
mov word [ebp - 8], 7
pop esi
je 0x1005828b
cmp dword [0x100b23b0], edi
je 0x1005828b
cmp dword [0x100b23bc], edi
je 0x1005828b
cmp dword [0x100b23c0], edi
je 0x1005828b
cmp dword [0x100b23c4], edi
je 0x1005828b
lea ecx, [ebp - 8]
push ecx
call eax
cmp word [ebp - 8], 7
jb 0x1005828b
push edi
push edi
push dword [0x100b23a4]
call dword [0x100b23b0]
test eax, eax
je 0x1005828b
mov eax, dword [0x100b23b8]
cmp eax, edi
je 0x10058281
cmp dword [0x100b23b4], edi
je 0x10058281
call eax
and al, 0xfc
or al, 4
push eax
call dword [0x100b23b4]
mov dword [0x100b23c8], ebx
mov eax, ebx
jmp 0x100582d1
mov eax, dword [0x100b23a8]
cmp eax, edi
mov dword [0x100b23cc], 1
je 0x100582a5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x100b23ac], edi
mov dword [0x100b23b0], edi
mov dword [0x100b23b4], edi
mov dword [0x100b23b8], edi
mov dword [0x100b23bc], edi
mov dword [0x100b23c0], edi
mov dword [0x100b23c4], edi
xor eax, eax
pop edi
pop ebx
leave
ret