joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a943f00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.2a8b8f90
mov eax, dword [0x2a9b0720]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
mov ebx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xb4]
test edi, edi
je 0x2a9440a3
push ebp
dec edi
lea ebp, [ebx + 0xc]
add ebx, 0x14
shr edi, 3
push esi
mov esi, dword [esp + 0xb8]
inc edi
mov dword [esp + 0x18], ebx
jmp 0x2a943f50
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ecx, byte [esi - 8]
shl eax, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [esi - 3]
shl eax, 8
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ecx
movzx ecx, byte [esi - 4]
or ecx, eax
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [ebp]
and al, 0xdf
mov dword [esp + 0x14], ecx
or al, 0x40
mov dword [esp + 0x28], ecx
mov byte [ebp], al
movzx eax, byte [ebx]
and al, 0xbf
mov dword [esp + 0x20], ecx
or al, 0x20
push ebp
mov byte [ebx], al
call fcn.2a8f5260
lea eax, [esp + 0x30]
push eax
push ebp
call fcn.2a8f5020
push 1
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.2a8024c0
push ebx
call fcn.2a8f5260
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.2a8f5020
push 1
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.2a8024c0
mov ecx, dword [esp + 0x44]
add esp, 0x30
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
xor edx, ecx
xor ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
xor ebx, eax
mov dword [esp + 0x14], ecx
xor eax, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x10], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [esp + 0x10]
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
shr eax, 8
mov byte [ecx], bl
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [ecx + 3], bl
mov ebx, ecx
shr eax, 8
mov byte [ecx + 4], dl
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
dec edi
jne 0x2a943f50
pop esi
pop ebp
mov ecx, dword [esp + 0xa4]
pop edi
pop ebx
xor ecx, esp
call fcn.2a84c0e0
add esp, 0xa0
ret
Function at 0x2a9476f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push edi
mov eax, dword [ebx + 4]
cmp eax, dword [ecx + 4]
jge 0x2a947707
mov edi, ecx
jmp 0x2a94770b
mov edi, ebx
mov ebx, ecx
push dword [edi + 4]
mov ebp, dword [esp + 0x14]
push ebp
call fcn.2a8cf1c0
add esp, 8
test eax, eax
jne 0x2a947723
pop edi
pop ebp
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x2a947747
push esi
jmp 0x2a947730
mov ecx, dword [ebx]
mov edx, dword [edi]
mov esi, dword [ecx + eax*4]
mov ecx, dword [ebp]
xor esi, dword [edx + eax*4]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, dword [ebx + 4]
jl 0x2a947730
pop esi
cmp eax, dword [edi + 4]
jge 0x2a947761
lea esp, [esp]
mov ecx, dword [edi]
mov edx, dword [ebp]
mov ecx, dword [ecx + eax*4]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, dword [edi + 4]
jl 0x2a947750
mov eax, dword [edi + 4]
push ebp
mov dword [ebp + 4], eax
call fcn.2a8cefd0
add esp, 4
mov eax, 1
pop edi
pop ebp
pop ebx
ret
Function at 0x411d9d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x411dac
pop dword [ebp - 0x40]
mov eax, 0x411dac
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x4062a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xcef2294
sub ecx, 0xceed289
xor edi, edi
add edi, eax
mov ebx, 0x9d06e2f4
sub ebx, 0x9cc38ef4
add ebx, dword [ebp - 0x40]
mov edx, 0x20b6099
sub edx, 0x94e53cf4
sub dword [ebp - 0x18], eax
mov esi, dword [ebx]
xor dword [ebp - 0x3c], esi
xor esi, edx
xor dword [ebp - 4], edx
mov dword [edi], esi
sub dword [ebp - 8], ebx
add edi, 4
add ebx, 0x473b68c0
add ebx, 0xb8c49744
loop 0x411e03
add eax, 0x132ff
mov ebx, eax
add eax, 0x4973dd51
sub eax, 0x4973dd4c
mov ecx, 0x2b42d312
sub ecx, 0x2b02d312
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x41d3b3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41d3f2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41d3f2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41d3f2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41d3f2
cmp dword [ecx + 0x74], 0xe
jbe 0x41d3f2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42f530
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42f55d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42f55d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4022b8
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x40230d
push dword [esp + 0x10]
push 0x402237
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x404528]
test esi, esi
je 0x402366
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x402305
cmp byte [esi + 0x10], 0
je 0x402305
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x4022e1
jmp 0x402366
mov esi, dword [0x404528]
test esi, esi
je 0x402366
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x40235f
cmp byte [esi + 0x11], 0
je 0x40233b
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x402352
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x404528
call fcn.004024b0
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x40231a
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x402510
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x402585
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x40252e
mov esi, 0x403008
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
lea ebp, [eax*2 + 2]
push ebp
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40257c
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40257c
push ebp
push esi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
ret 4
Function at 0x409ebb
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x52
cmc
jecxz 0x409ed8
aaa
xchg byte [ecx + 0xe], dh
invalid
sbb dword [eax - 0x43], edi
popfd
add eax, 0xb28fec47
fld qword [edx]
stc
jmp 0x409f4e
popal
invalid

Function at 0x40dac0
Capabilities:
Encode data using xor

Disassembly:
and esi, edi
test byte [edx - 0x72], 1
sbb eax, dword [ebx]
fcomi st(2)
push 0x53fc949a
out dx, al
sar dword [ebx - 8], 1
and al, byte [eax - 0x7a86d677]
xchg esi, eax
xor ebp, edx
or byte [edx - 0x1573f3fd], ch
add bh, byte [ebp + 0x65e686b1]
and eax, 0x8d0e3fe9
push cs
lea eax, [esp + 0xa]
push cs
lea eax, [esp + 0xa]
in eax, 0x43
popfd
pop esp
push 0x150aa3d9
ja 0x40da95
in al, dx
arpl word [edx + 0x4e], bp
xor eax, 0x24ade2af
xchg ebp, eax
out dx, al
mov eax, 0x9992a564
cmpsb byte [esi], byte es:[edi]
out 0xe0, eax
leave
mov word [edi + esi + 0x32], ds
sub ebx, dword [edi + 0x2b]
loopne 0x40dad1
mov ch, 2
stosb byte es:[edi], al
aad 0xf7
mov ebx, 0x30cec506
retf 0xde51

Function at 0x44e97b
Capabilities:
Encode data using xor

Disassembly:
aaa
aas
fisttp qword [edi - 0x728af575]
push esp
cmp edi, esi
lea ecx, [eax - 0x1a76ece3]
or eax, 0xb5212d33
daa
fst qword [edx + 0x7d]
xor eax, 0x865fb493
cli
call 0x1ea29e3d
idiv dword [edi + eax*8]
invalid

Function at 0x44ee2b
Capabilities:
Encode data using xor

Disassembly:
xor ebp, ecx
xor bh, ah
mov esi, 0x1088627d
in eax, 0x27
xchg esi, eax
aas
push 0xda0ff6d1
push es
lahf
inc ecx
xor eax, esp
std
adc byte [edi], dh
mov byte [0xf6ec1aa2], al
dec esp
add dword [eax + esi*4 - 0x17], ecx
pop ecx
jge 0x44edfb
daa
test dword [edi], esi
xor ah, bh
mov bh, 0x39
aad 0x47
push ebx
dec eax
loopne 0x44edd3
stosd dword es:[edi], eax
fdiv qword [ecx - 0x52]
mov esp, 0xbab13b2a
outsb dx, byte [esi]
out dx, eax
jmp 0x44ee5d
cmp al, 5
and ebp, esp
and ebp, esp
and ebp, ebp
xor al, 0xa8
sub byte [ebp + 0x37], 0xe9
adc esi, dword [esi - 0x79a29f03]
invalid
adc dl, byte [eax]
cmp eax, 0x8d73cc89
mov ch, 0xe2
invalid
loop 0x44edad
in al, 0x3b
add eax, 0xed51dd5f
jne 0x44ee16
sbb ebx, dword [eax + esi*2 + 0x2de5baf1]
popal
jo 0x44ee1e
mov edx, 0x61612de5
popal
add al, 0xc
in eax, dx
mov edx, 0x44eac1e9
lodsd eax, dword [esi]
insb byte es:[edi], dx
inc ebx
aam 0x6c
and dword [edi + 0x13b1fff9], edi
add eax, 0x34ac15f9
fsub dword [ecx - 0x14]
jl 0x44ee31
int1
mov ax, 0x3fef
adc dword [edx + eax*8 + 0x21], edi
pushal
xor byte [eax + 0x4d216931], ch
fstp dword [edx + 0x55]
and dword [ebp - 0x27], ecx
pop edx
push ebp
movsb byte es:[edi], byte [esi]
adc dword [edx + 0x61], esi
in eax, 0x9a
popal
inc ebp
add eax, 0x8131b374
xor eax, 0xafec1198
fnsave dword [edx - 0x3f]
xor dl, byte [0xede5ecad]
and byte [ebp + 0x646ee10e], cl
xor dword [0x58341c35], edi
mov edx, 0xbc060acd
out 0xca, eax
adc dword [eax], edi
int3
Function at 0x4983ad
Capabilities:
Encode data using xor

Disassembly:
push ebx
xlatb
push eax
xor al, 0x90
adc eax, 0x5ade3591
fidivr word [ebx]
pushfd
sbb dword [edx + 0x58df5b3f], ebx
cmp al, 0x99
sbb eax, 0x52d632a6
xlatb
xor dword [ebp + 0x53379211], edx
xlatb
push eax
xor al, 0x91
adc eax, 0x5bde3a91
fistp qword [eax]
pushfd
sbb byte [ebp + 0x5bdf5a39], bl
cmp dword [edx - 0x21], ebx
pop ebx
aas
cwde
xchg edi, eax
xor ah, dl
push eax
aad 0x31
xchg ebp, eax
push ss
xchg edx, eax
aaa
push ebx
xlatb
push eax
xor al, 0x91
adc eax, 0x5ade3591
fistp qword [ebx]
lahf
sbb byte [eax + edi + 0x3f5ad95d], bl
cwde
sbb al, 0x99
loop 0x4983dc
push edx
xlatb
xor byte [ecx + edx - 0x2bacc86b], dl
push ecx
cmp dword [ebx - 0x23c461de], ebx
pop eax
fnstsw word [ecx]
lcall 0x55d1, 0x5502981c
xor dword [ebp - 0x2cc86dea], edx
push edi
sal dword [edi], cl
xchg ebx, eax
pop ss
xchg ebx, eax
aaa
push eax
aam 0x50
xor al, 0x91
adc eax, 0x59dd3b9e
fnstsw word [edi]
cwde
sbb al, 0x98
cmp eax, 0x3256e259
xchg edi, eax
adc edx, dword [eax + ebp*2 + 0x6fb009b7]
dec esp
bound edi, qword [0xf8663e83]
clc
inc esi
stc
mov edx, 0xfb65bb04
jp 0x498450
imul esi, dword [0xf16e3688], 0x42
std
popal
mov edi, 0xf866bf01
inc esi
stc
cmp dword [bx + 0x653b], eax
les ecx, [edx - 0xc]
push 0xffffffffffffffb5
or esi, dword [esi - 0xfb10898]
outsb dx, byte [esi]
xor byte [edi + 0x4df16f31], cl
std
pushal
mov edi, 0xf966b801
inc esp
les ebp, [edx + 0x34]
mov esi, dword [0xf648f56b]
push 0x6fb708b6
outsd dx, dword [esi]
inc edx
std
pushal
cmp byte ds:[esi], 0x67
cli
jp 0x498498
push 0x69b708b6
int1
dec esp
repne insd dword es:[edi], dx
xor eax, dword [edx + 0x46f8613d]
clc
mov edx, 0xc45aba04
dec ebx
cmc
insd dword es:[edi], dx
xor eax, dword [ecx + 0x4fc4643f]
les ebp, [edx - 0x4c]
or esi, dword [ebp - 0x9b70a95]
imul esi, dword [edi], 0xf0693789
dec esi
invalid
Function at 0x4aecb3
Capabilities:
Access peb ldr_data

Disassembly:
push edi
jb 0x4aec5b
mov eax, 0x3dc597f8
clc
insb byte es:[edi], dx
adc al, 0xc3
xor al, 0xfa
je 0x4aec7a
xor al, byte [edi + edx*8 + 0x3bd636a2]
and eax, 0x61eb317c
salc
cmp esp, dword [0x61eb317c]
out 0x34, eax
popfd
adc dword [edi + eax], ebp
insb byte es:[edi], dx
jecxz 0x4aece8
or dword [ecx - 0x1c], ebp
jnp 0x4aec45
cld
xchg ecx, eax
clc
cmp edi, ebp
mov dh, pe_nt_image_headers32
and dword [ebx + 0x35], 0xf61fbb09
or ecx, dword [ecx - 0x6eca2c89]
imul edi, dword [esp + esi*2 + 0x152cf03d], 0x54683576
mov ecx, 0x41290ab6
or dword [ebx - 0x73f409e1], edi
loope 0x4aecf9
mov ecx, fs
ja 0x4aec56
sal dword [0x74bc6991], cl
xor eax, 0x74bc6991
cmp eax, 0x76152cf0
xor eax, 0xb6b95468
or ch, byte [ecx]
inc ecx
add byte [edx + 0xd016011], dh
into
inc esp
jmp 0x2b250f4a
push edx
dec ebp
jns 0x4aec7f
xchg dword [esi], edi
test eax, 0x1fb2872a
insb byte es:[edi], dx
jne 0x4aecfd
dec eax
rol byte [ebp + 0x398e648e], 1
lcall 0x2d0c, 0x2fb7fab2
mov bh, 0xda
cmp byte [edx + 0x80f3f14], cl
mov dl, byte [edi + edi]
invd
mov al, byte [0xa2bce54a]
test al, 0xf9
test al, 0xf9
and ch, byte [eax - 0x1ef26f70]
xor esp, dword [edx - 0x5b]
adc ah, byte [edi - 0x14d2dd84]
jmp 0x4aed1c
invalid
leave
xchg edx, eax
xchg edx, eax
popfd
clc
jl 0x4aecdd
jecxz 0x4aecf3
clc
xchg ebp, eax
cwde
jecxz 0x4aecf0
ljmp 0x4ab8:0x758e56c0
push edi
stosd dword es:[edi], eax
or dword [edi + 0x7f], ebp
push 0x19
sub eax, 0xe2193999
dec esp
mov ah, 0x66
mov edx, 0x6235d4b6
or edx, dword [eax + 0x64b128e2]
loop 0x4aecd2
push 0xfffffffffffffff2
rcr ebp, 1
in eax, 0x8b
cwde
enter 0xffffffffffff94bc, 0xfffffffffffffff8
or al, 0xe7
std
invalid
Function at 0x10054320
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.100544c0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x100543e4
cmp dword [ebp - 4], 0x50000000
jb 0x10054361
cmp dword [ebp - 4], 0x80000000
ja 0x10054361
mov dword [ebp - 4], 0x4fff0000
jmp 0x1005433a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1005e990
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10054387
jmp 0x100543e4
cmp dword [ebp - 0x14], 0x10000
jne 0x100543ca
cmp dword [ebp - 0x18], 0x10000
jb 0x100543ca
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100543bd
mov eax, dword [ebp - 8]
jmp 0x100543e6
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100543df
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.100544c0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1005433a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100543f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.100544f0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100544ac
cmp dword [ebp - 4], 0x50000000
jb 0x1005442c
cmp dword [ebp - 4], 0x80000000
ja 0x1005442c
mov dword [ebp - 4], 0x80010000
jmp 0x10054405
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1005e990
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10054452
jmp 0x100544ac
cmp dword [ebp - 0x14], 0x10000
jne 0x10054495
cmp dword [ebp - 0x18], 0x10000
jb 0x10054495
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10054488
mov eax, dword [ebp - 8]
jmp 0x100544ae
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100544a7
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.100544f0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10054405
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10054c20
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10054c35
xor eax, eax
jmp 0x10054caa
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x10054c62
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10054ca5
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10054ca3
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x10054c9f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10054ca3
xor eax, eax
jmp 0x10054caa
jmp 0x10054c59
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10054e70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10198468]
mov dword [ebp - 4], eax
jmp 0x10054e89
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10054ea6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10054e80
mov esp, ebp
pop ebp
ret
Function at 0x100552f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10198478], eax
je 0x1005530e
mov eax, 0x10dd
jmp 0x100553ef
mov eax, dword [0x10198488]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1005538c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1005536a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1005536a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10054990
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10056789
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10055316
mov dword [0x10198488], 0
call fcn.10054cb0
mov ecx, dword [0x10198484]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x100553d9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10056789
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x100553a4
mov dword [0x10198484], 0
mov dword [0x10198478], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100558e0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1019847c], 0
je 0x100558f9
mov eax, dword [0x1019847c]
jmp 0x10055999
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1005590b
xor eax, eax
jmp 0x10055999
push 8
call fcn.100568c8
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10055961
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1005594a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10056789
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x1019847c], eax
mov dword [0x10198480], 0
mov eax, dword [ebp - 8]
jmp 0x10055999
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1005597b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1005592b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10198484]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10198484], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1006c95e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10195820]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10064602
mov dword [ebp - 0x14], eax
cmp dword [0x101991d8], edi
jne 0x1006ca4f
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x1006c9dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006cb2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1006cb2f
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006cb2f
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x101991d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x101991dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x101991e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101991e8], eax
test eax, eax
je 0x1006ca4c
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x101991e4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006ca74
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006ca67
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1006ca89
push 4
pop eax
jmp 0x1006cb31
cmp dword [ebp - 0x14], edi
je 0x1006ca89
push dword [0x101991d8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006ca6e
mov eax, dword [0x101991e4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x1006cae7
cmp dword [0x101991e8], esi
je 0x1006cae7
push eax
call ebx
push dword [0x101991e8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006cae7
test eax, eax
je 0x1006cae7
call ecx
test eax, eax
je 0x1006cadc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006cadc
test byte [ebp - 8], 1
jne 0x1006cae7
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x1006cb17
mov eax, dword [0x101991dc]
cmp eax, esi
je 0x1006cb14
push eax
call ebx
test eax, eax
je 0x1006cb14
call eax
mov edi, eax
test edi, edi
je 0x1006cb14
mov eax, dword [0x101991e0]
cmp eax, esi
je 0x1006cb14
push eax
call ebx
test eax, eax
je 0x1006cb14
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x101991d8]
call ebx
test eax, eax
je 0x1006cb2f
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x1006cb31
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10056240
leave
ret