joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e780
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor edx, edx
push esi
push edi
mov byte [ebp + 0x100], dl
mov byte [ebp + 0x101], dl
xor eax, eax
jmp 0x1002e7a0
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jne 0x1002e7a0
xor esi, esi
mov ecx, ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
movzx edi, dl
movzx edx, byte [edi + eax]
movzx eax, byte [ecx]
add edx, esi
add eax, edx
and eax, 0x800000ff
jns 0x1002e7d3
dec eax
or eax, 0xffffff00
inc eax
movzx esi, al
lea eax, [esi + ebp]
cmp ecx, eax
je 0x1002e7e5
mov bl, byte [eax]
mov dl, byte [ecx]
mov byte [ecx], bl
mov byte [eax], dl
xor edx, edx
lea eax, [edi + 1]
div dword [esp + 0x1c]
inc ecx
sub dword [esp + 0x14], 1
jne 0x1002e7b3
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 0xc

Function at 0x1002e800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov al, byte [ecx + 0x100]
mov dl, byte [ecx + 0x101]
sub esp, 8
push edi
xor edi, edi
cmp dword [esp + 0x14], edi
je 0x1002e8cf
push ebx
push ebp
push esi
movzx ebp, al
movzx esi, dl
jmp 0x1002e834
mov esi, dword [esp + 0x14]
lea edx, [ebp + 1]
and edx, 0x800000ff
jns 0x1002e847
dec edx
or edx, 0xffffff00
inc edx
movzx ebp, dl
movzx ebx, byte [ecx + ebp]
lea eax, [ecx + ebp]
add ebx, esi
and ebx, 0x800000ff
jns 0x1002e863
dec ebx
or ebx, 0xffffff00
inc ebx
movzx esi, bl
mov dword [esp + 0x14], esi
add esi, ecx
mov byte [esp + 0x13], bl
cmp eax, esi
je 0x1002e88b
movzx ebx, byte [eax]
mov byte [esp + 0x12], bl
movzx ebx, byte [esi]
mov byte [eax], bl
movzx ebx, byte [esp + 0x12]
mov byte [esi], bl
mov bl, byte [esp + 0x13]
movzx eax, byte [eax]
movzx esi, byte [esi]
add eax, esi
and eax, 0x800000ff
jns 0x1002e8a1
dec eax
or eax, 0xffffff00
inc eax
mov esi, dword [esp + 0x1c]
movzx eax, al
mov al, byte [eax + ecx]
xor byte [edi + esi], al
inc edi
cmp edi, dword [esp + 0x20]
jne 0x1002e830
pop esi
pop ebp
mov byte [ecx + 0x101], bl
pop ebx
mov byte [ecx + 0x100], dl
pop edi
add esp, 8
ret 8
mov byte [ecx + 0x100], al
mov byte [ecx + 0x101], dl
pop edi
add esp, 8
ret 8
Function at 0x1002efd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10037261
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1005a018]
xor eax, esp
mov dword [esp + 0x24], eax
push edi
mov eax, dword [0x1005a018]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 8], 0
cmp dword [0x1005ba34], 0
mov dword [esp + 0xc], esi
je 0x1002f035
cmp dword [0x1005ba38], 8
mov eax, dword [0x1005ba24]
jae 0x1002f027
mov eax, 0x1005ba24
push eax
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
jmp 0x1002f0b5
call fcn.1002ed00
mov edi, eax
test edi, edi
jne 0x1002f04d
push esi
mov edi, 0x1003c51c
call fcn.10028a90
jmp 0x1002f0b5
lea eax, [esp + 0x10]
push eax
call fcn.10028a90
push edi
mov dword [esp + 0x3c], 1
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x18]
mov edi, 8
add esp, 4
cmp dword [esp + 0x28], edi
jae 0x1002f07b
lea eax, [esp + 0x14]
push eax
mov ecx, 0x1005ba20
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], edi
jae 0x1002f095
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [esp + 0x10]
mov dword [esp + 8], 1
mov byte [esp + 0x38], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100344d1
add esp, 0x34
ret
Function at 0x1002fa00
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1002fa30
xor al, al
ret 0x10
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0xc]
test eax, eax
push ecx
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
ret 0x10

Function at 0x1002fa70
Capabilities:
Access peb ldr_data
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x10035a38
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x1005a018]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x10]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1002faec
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 0x28
cmp dword [esp + 0x48], 8
mov eax, dword [esp + 0x34]
jae 0x1002fafb
lea eax, [esp + 0x34]
mov ecx, dword [esp + 0x44]
lea edx, [ecx + ecx]
push edx
push eax
mov eax, dword [esp + 0x14]
push 1
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0xc]
test eax, eax
push ecx
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret 0x28
Function at 0x1002fb50
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x10035a10
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1005a018]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, dword [esp + 0x48]
mov ebp, dword [esp + 0x44]
mov ecx, dword [ebp]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push esi
push ecx
mov dword [esp + 0x2c], 0x9c40
call ebx
mov edx, dword [esp + 0x14]
add edx, 2
push edx
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x18]
add eax, 2
push eax
push 0
push edi
call sub.MSVCR90.dll_memset
mov edx, dword [ebp]
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
push edi
push 0
push 0
push esi
push edx
call ebx
test eax, eax
je 0x1002fbef
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
jmp 0x1002fc35
lea eax, [esp + 0x18]
push eax
call fcn.10028a90
mov ecx, dword [esp + 0x4c]
mov byte [esp + 0x3c], 1
cmp ecx, eax
je 0x1002fc1b
cmp dword [eax + 0x18], 8
jb 0x1002fc11
mov eax, dword [eax + 4]
jmp 0x1002fc14
add eax, 4
push eax
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__]
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push edi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc

Function at 0x1002fc50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [eax]
push 0
push 0
push edx
push ecx
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1002fc8f
xor al, al
add esp, 8
ret 0xc
mov eax, dword [esp]
mov edx, dword [esp + 0x14]
mov dword [edx], eax
mov al, 1
add esp, 8
ret 0xc
Function at 0x1002fd60
Capabilities:
Query or enumerate registry key

Disassembly:
push esi
push edi
push 0x13880
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
mov edi, dword [esp + 0x18]
add esp, 4
cmp dword [edi], 0
mov esi, eax
jne 0x1002fda9
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
push edi
push 8
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1002fda9
test esi, esi
je 0x1002fda2
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
pop edi
xor al, al
pop esi
ret 0x14
mov ecx, dword [edi]
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx]
push 0x9c3f
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x1002fdeb
mov edx, dword [edi]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi], 0
test esi, esi
je 0x1002fde3
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
pop ebx
pop edi
xor al, al
pop esi
ret 0x14
test eax, eax
jne 0x1002fdd6
mov ecx, dword [esp + 0x20]
push esi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::assign_wchar_t_const__]
inc dword [ebx]
test esi, esi
je 0x1002fe09
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
pop ebx
pop edi
mov al, 1
pop esi
ret 0x14
Function at 0x10030020
Capabilities:
Delete registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003005b
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
ret 0xc

Function at 0x10030070
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ebp
lea eax, [esp + 8]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
test ebp, ebp
jne 0x1003010d
mov ecx, dword [esp + 8]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
push ecx
mov dword [esp + 0x24], 0x9c40
call edi
mov eax, dword [esp + 0x14]
xor ecx, ecx
add eax, 2
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
push ebp
push ecx
call edi
mov edx, dword [esp + 0x18]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100300e6
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
mov eax, ebp
pop esi
pop ebp
ret 0xc
Function at 0x10030730
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1003721c
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push esi
mov eax, dword [0x1005a018]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov ecx, dword [0x1005b968]
xor eax, eax
test ecx, ecx
sete al
test ecx, ecx
je 0x10030846
push 1
push 2
lea ecx, [esp + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_int_]
mov dword [esp + 0xb8], 0
call dword [sym.imp.MSVCP90.dll_public:_static_class_std::locale_const____cdecl_std::locale::classic_void_]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx + 4]
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + ecx + 0x34]
call dword [sym.imp.MSVCP90.dll_public:_class_std::locale___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::imbue_class_std::locale_const__]
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::locale::destructor_void_]
call fcn.100337b0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call fcn.10033bb0
call fcn.10033c30
call fcn.100338d0
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
mov eax, str._hooked_successfully_n
jne 0x100307e4
mov eax, str._hook_failed_n
push eax
push ecx
lea edx, [esp + 0x34]
push str.GetCommandLineW
push edx
call fcn.10001d00
add esp, 0xc
push eax
call fcn.100026b0
add esp, 8
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::str_void_]
cmp dword [eax + 0x18], 8
jb 0x1003081b
mov eax, dword [eax + 4]
jmp 0x1003081e
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x2c]
mov dword [esp + 0xb8], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::vbase_dtor_void_]
mov eax, esi
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10031660
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x100365a2
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1005a018]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x64]
mov ebx, ecx
mov dword [esp + 0x40], 0
cmp dword [esp + 0x60], 8
mov eax, dword [esp + 0x4c]
jae 0x100316a4
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x100316d3
cmp dword [esp + 0x18], 1
jge 0x100316d3
lea ecx, [esp + 0x48]
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
jmp 0x10031737
mov edx, dword [edi]
push edx
mov ecx, ebp
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov esi, 1
cmp dword [esp + 0x18], esi
jle 0x1003171c
mov eax, dword [edi + esi*4]
push eax
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x44], 1
call fcn.10032360
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 0
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
inc esi
cmp esi, dword [esp + 0x18]
jl 0x100316e9
cmp dword [ebp + 0x14], 0
lea ecx, [esp + 0x48]
setne bl
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, bl
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x20
Function at 0x10032f10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1004e4e8
push 0x10034e11
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1005a018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov ecx, eax
mov dword [ebp + 8], ecx
xor esi, esi
cmp eax, esi
jne 0x10032f5d
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp + 8], eax
mov ecx, eax
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x10032f74
push 0xc1
jmp 0x10033051
mov edx, dword [ecx + 0x3c]
add edx, ecx
mov dword [ebp - 0x20], edx
cmp dword [edx], 0x4550
je 0x10032f8e
push 0xbf
jmp 0x10033051
movzx ecx, word [edx + 0x14]
cmp cx, si
je 0x1003304c
movzx ecx, cx
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 0x1c], esi
movzx edx, word [edx + 6]
cmp esi, edx
jae 0x1003304c
lea ecx, [esi + esi*4]
lea edi, [eax + ecx*8]
mov edx, str..detour
mov ecx, edi
mov edi, edi
mov bl, byte [ecx]
cmp bl, byte [edx]
jne 0x10032fe0
test bl, bl
je 0x10032fdc
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
jne 0x10032fe0
add ecx, 2
add edx, 2
test bl, bl
jne 0x10032fc0
xor ecx, ecx
jmp 0x10032fe5
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jne 0x1003303a
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x1003304c
cmp dword [edi + 0x10], 0
je 0x1003304c
mov edx, dword [ebp + 8]
lea esi, [ecx + edx]
mov eax, dword [esi]
cmp eax, 0x40
jb 0x1003304c
cmp dword [esi + 4], 0x727444
jne 0x1003304c
cmp dword [esi + 8], 0
jne 0x10033015
mov dword [esi + 8], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
inc esi
mov edx, dword [ebp - 0x20]
jmp 0x10032fa2
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100331e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1004e4c8
push 0x10034e11
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x1005a018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], dx
jne 0x10033282
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10033282
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x10033282
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x10033282
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10033330
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [0x1005b970]
test esi, esi
je 0x1003335a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x10033343
pop edi
pop esi
pop ecx
ret

Function at 0x100333b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x1c
push ebx
push esi
mov esi, eax
movzx eax, si
push edi
test eax, eax
je 0x100333c6
lea esi, [eax + esi - 0x10000]
cmp esi, dword [esp + 0x2c]
jae 0x1003346f
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea esp, [esp]
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x100333f4
mov esi, 0x80010000
jmp 0x10033465
xor eax, eax
push 0x1c
lea ecx, [esp + 0x10]
push ecx
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call ebx
test eax, eax
je 0x1003346f
cmp dword [esp + 0x1c], 0x10000
mov eax, dword [esp + 0x18]
jne 0x10033450
cmp eax, 0x10000
jb 0x10033450
push 0x40
push 0x3000
push 0x10000
push esi
call edi
test eax, eax
jne 0x10033471
add esi, 0x10000
jmp 0x10033465
mov edx, dword [esp + 0xc]
lea esi, [edx + eax]
movzx eax, si
test eax, eax
je 0x10033465
lea esi, [esi + eax - 0x10000]
cmp esi, dword [esp + 0x2c]
jb 0x100333e0
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x10033480
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, eax
add esi, 0xffff0000
movzx eax, si
push edi
test eax, eax
je 0x10033498
sub esi, eax
cmp esi, dword [esp + 0x30]
jbe 0x1003352b
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebp, 0x10000
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x100334c7
mov esi, 0x4fff0000
jmp 0x10033525
xor eax, eax
push 0x1c
lea ecx, [esp + 0x14]
push ecx
push esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call ebx
test eax, eax
je 0x1003352b
cmp dword [esp + 0x20], ebp
jne 0x10033512
cmp dword [esp + 0x1c], ebp
jb 0x10033512
push 0x40
push 0x3000
push ebp
push esi
call edi
test eax, eax
jne 0x1003352d
sub esi, ebp
jmp 0x10033525
mov esi, dword [esp + 0x14]
add esi, 0xffff0000
movzx eax, si
test eax, eax
je 0x10033525
sub esi, eax
cmp esi, dword [esp + 0x30]
ja 0x100334b3
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret