joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10142a1e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1018e280
cmp edx, dword [eax]
je 0x10142a40
add eax, 8
inc ecx
cmp eax, 0x1018e310
jl 0x10142a31
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1018e280]
jne 0x10142b6e
mov eax, dword [0x101946bc]
cmp eax, 1
je 0x10142b48
test eax, eax
jne 0x10142a71
cmp dword [0x101946c0], 1
je 0x10142b48
cmp edx, 0xfc
je 0x10142b6e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10142aa8
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.1013c980
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1013ca70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10142aeb
lea eax, [ebp - 0x1a4]
push eax
call fcn.1013ca70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1016bf9c
push edi
call fcn.101485e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.1013c980
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.1013c990
lea eax, [ebp - 0xa0]
push 0x1016bf7c
push eax
call fcn.1013c990
push dword [esi + 0x1018e284]
lea eax, [ebp - 0xa0]
push eax
call fcn.1013c990
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.10149890
add esp, 0x2c
pop edi
jmp 0x10142b6e
lea eax, [ebp + 8]
lea esi, [esi + 0x1018e284]
push 0
push eax
push dword [esi]
call fcn.1013ca70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1000afc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000afcf
pop dword [ebp - 8]
mov eax, 0xeabfad56
add eax, 0x25410279
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x2502bed7
add dword [ebp - 0x18], 0x294f8674
mov dword [ebp - 0x14], 0x36454314
sub dword [ebp - 0x14], 0x411f6cf
mov dword [ebp - 0x10], 0x2b882688
sub dword [ebp - 0x10], 0xdf3be25a
mov dword [ebp - 0xc], 0xc7c300f5
sub dword [ebp - 0xc], 0xc7c300f5
lea eax, [ebp - 0x18]
push eax
mov eax, 0xc29fa549
sub eax, 0xb29e64f9
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x78ec4939
add dword [ebp - 0x18], 0xfb86201d
mov dword [ebp - 0x14], 0x5ba38c9b
sub dword [ebp - 0x14], 0x1a372b26
mov dword [ebp - 0x10], 0x17a5f211
sub dword [ebp - 0x10], 0xb43685a5
mov dword [ebp - 0xc], 0xb4d3e0b4
add dword [ebp - 0xc], 0x4b2c1f4c
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x9ebf1528
sub eax, 0x8ebdd4d4
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3a6e8
push 0
call eax
mov ecx, 0x40e0a677
sub ecx, 0x40e05cbb
mov edx, eax
mov esi, 0xee8be8d8
sub esi, 0xde8a06d8
add esi, dword [ebp - 8]
mov ebx, 0x2421f2f4
xor dword [ebp - 4], 0xecb16274
mov edi, dword [esi]
add dword [ebp - 4], 0x6defc8d4
add edi, ebx
mov dword [ebp - 4], 0x473d0a09
mov dword [edx], edi
xor dword [ebp - 4], 0xb6cd1bb7
add edx, 0x3bba807c
add edx, 0xc4457f88
add esi, 0xb38ad415
add esi, 0x4c752bef
loop 0x1000b0eb
add eax, 0x119c3
xor ebx, ebx
add ebx, eax
add eax, 0x776d7be4
add eax, 0x88928421
mov ecx, 0x6491686d
sub ecx, 0x5491686d
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x1000194e
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 0x24], 0
jne 0x100019ce
push str.avifil32.dll
call fcn.10003770
test al, al
jne 0x10001967
pop edi
ret
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileInit
push dword [edi + 4]
call esi
push str.AVIFileExit
push dword [edi + 4]
mov dword [edi + 8], eax
call esi
push str.AVIFileRelease
push dword [edi + 4]
mov dword [edi + 0xc], eax
call esi
push str.AVIFileOpen
push dword [edi + 4]
mov dword [edi + 0x10], eax
call esi
push str.AVIStreamInfo
push dword [edi + 4]
mov dword [edi + 0x14], eax
call esi
push str.AVIStreamOpenFromFile
push dword [edi + 4]
mov dword [edi + 0x18], eax
call esi
push str.AVIStreamRelease
push dword [edi + 4]
mov dword [edi + 0x1c], eax
call esi
mov dword [edi + 0x20], eax
mov byte [edi + 0x24], 1
pop esi
mov al, 1
pop edi
ret

Function at 0x10001a04
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 0x24], 0
jne 0x10001a84
push str.winmm.dll
call fcn.10003770
test al, al
jne 0x10001a1d
pop edi
ret
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioInstallIOProcA
push dword [edi + 4]
call esi
push str.mmioOpenA
push dword [edi + 4]
mov dword [edi + 8], eax
call esi
push str.mmioClose
push dword [edi + 4]
mov dword [edi + 0xc], eax
call esi
push str.mmioAscend
push dword [edi + 4]
mov dword [edi + 0x10], eax
call esi
push str.mmioRead
push dword [edi + 4]
mov dword [edi + 0x14], eax
call esi
push str.mmioDescend
push dword [edi + 4]
mov dword [edi + 0x18], eax
call esi
push str.mciSendCommandA
push dword [edi + 4]
mov dword [edi + 0x1c], eax
call esi
mov dword [edi + 0x20], eax
mov byte [edi + 0x24], 1
pop esi
mov al, 1
pop edi
ret
Function at 0x10003770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000377f
pop dword [ebp - 0x50]
mov eax, 0x1000377f
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x73aa56fb
sub dword [ebp - 0x60], 0x255811b0
mov dword [ebp - 0x5c], 0x2e359715
add dword [ebp - 0x5c], 0x3fdb530
mov dword [ebp - 0x58], 0xc1e4328a
add dword [ebp - 0x58], 0x8a6811a4
mov dword [ebp - 0x54], 0xbdac3742
sub dword [ebp - 0x54], 0xbdac3742
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xc9cf94aa
add dword [ebp - 0x60], 0xaaa2d4ac
mov dword [ebp - 0x5c], 0x5089aaf7
sub dword [ebp - 0x5c], 0xf1d4982
mov dword [ebp - 0x58], 0xb929cf7e
sub dword [ebp - 0x58], 0x55ba6312
mov dword [ebp - 0x54], 0x74159290
sub dword [ebp - 0x54], 0x74159290
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3a2d6
push 0
call eax
mov ecx, 0x5152
mov ebx, eax
mov edi, 0xf1b3bd96
add edi, 0x1e4de66a
add edi, dword [ebp - 0x50]
mov edx, 0xac03ef46
xor dword [ebp - 0x24], edi
mov esi, dword [edi]
xor dword [ebp - 0x30], esi
sub esi, edx
mov dword [ebp - 0x18], 0xb31d7fdb
mov dword [ebx], esi
xor dword [ebp - 8], ecx
add ebx, 4
add edi, 0x74a858e6
add edi, 0x8b57a71e
loop 0x10003886
add eax, 0xa94801b3
sub eax, 0xa946c998
xor ebx, ebx
add ebx, eax
add eax, 0xafc72446
sub eax, 0xafc72441
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10004310
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10016040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp dword [edi + 0xe8], eax
jne 0x1000433e
cmp dword [edi + 0xec], ebx
je 0x10004429
and dword [ebp - 0x14], 0
lea ecx, [edi + 0x30]
and dword [ebp - 0x10], 0
mov dword [edi + 0xe8], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push esi
push eax
mov dword [edi + 0xec], ebx
mov dword [ebp - 8], ebx
call fcn.10003770
mov esi, dword [edi + 4]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, esi
push esi
sete byte [ebp - 0x25]
and dword [ebp - 0x2c], 0
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10004391
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x2c], eax
mov edx, dword [edi + 0x9c]
mov ecx, dword [edi + 0xa4]
mov esi, dword [edi + 0x98]
sub ecx, edx
mov eax, dword [edi + 0xa0]
push 0x10
push ecx
sub eax, esi
push eax
push edx
push esi
xor esi, esi
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
push esi
push 0x491
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
test eax, eax
je 0x100043db
mov ecx, edi
call fcn.10003770
cmp dword [ebp - 0x2c], 0
je 0x100043ec
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [ebp - 0x25], 0
je 0x100043fb
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x10004429
mov eax, dword [edi + 0x98]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0xa4]
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 0xa0]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
mov eax, dword [ecx]
push edx
call dword [eax + 0x34]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.10009a12
mov esp, ebp
pop ebp
ret 8

Function at 0x10008ab3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
cmp eax, 0x1a
jl 0x10008b0b
mov eax, dword [edi + 8]
cmp eax, dword [edi]
jl 0x10008b0b
push 0
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
push 0x10
push eax
mov eax, dword [edi + 8]
sub eax, dword [edi]
push eax
push dword [edi + 4]
push dword [edi]
push 0
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, ebx
call fcn.10003770
push 1
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
pop ebp
ret 4

Function at 0x10009075
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push str.4___fss23o3_039r_31s0000r4_10c_9._4ay
call 0x40105d
test eax, eax
je 0x401056
push 0x403100
push str.4___fss23o3_039r_31s0000r4_10c_9._4ay
call fcn.00401080
test eax, eax
je 0x401056
xor ecx, ecx
xor ebx, ebx
push str.4___fss23o3_039r_31s0000r4_10c_9._4ay
call fcn.004010a6
xor byte [ecx + str.4___fss23o3_039r_31s0000r4_10c_9._4ay], 0x5c
inc ecx
mov ebx, ecx
cmp ebx, eax
je 0x40103f
jmp 0x40102f
push 5
push 0
push 0
push str.4___fss23o3_039r_31s0000r4_10c_9._4ay
push str.OPEN
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
push esi
cld
mov esi, dword [ebp + 8]
test esi, 0xff
je 0x401074
mov eax, 0
jmp 0x40107b
mov eax, 1
jmp 0x40107b
pop esi
leave
ret 4
Function at 0x414838
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44ec90]
jne 0x414842
repz ret
jmp fcn.0041a6eb

Function at 0x42b7d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439fa8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x44ec90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call main
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x10]
call main
push eax
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call main
cmp dword [ebp - 0x14], 0
jne 0x42b84e
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call main
push str.AdobeARM1.0AdobeARM.exe
mov ecx, dword [ebp + 8]
call main
jmp 0x42b898
push str.SHGetFolderPath_in_GetARMExePath_failed:
lea ecx, [ebp - 0x18]
call main
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
push 1
call main
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call main
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call main
mov eax, dword [ebp - 0x1c]
jmp 0x42b8b1
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call main
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x436d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x436d6f
pop dword [ebp - 0x10]
mov eax, 0x436d6f
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x51aba
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0xba3d2b8
add ecx, 0xf45c850f
mov esi, eax
mov edi, 0x32b58d7b
add edi, 0xcd912485
add edi, dword [ebp - 0x10]
mov ebx, 0x5143cf14
add ebx, 0xdfb59293
xor dword [ebp - 0xc], 0xfb567ca4
mov edx, dword [edi]
sub dword [ebp - 4], edx
sub edx, ebx
mov dword [esi], edx
xor dword [ebp - 0xc], 0x8eba5155
add esi, 0xb0a7cc42
add esi, 0x4f5833c2
add edi, 4
loop 0x436dc4
add eax, 0x48b779a1
add eax, 0xb749d84e
xor ebx, ebx
add ebx, eax
add eax, 0x3e627226
add eax, 0xc19d8ddf
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x437730
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], vtable.CArmReport.0
push 0x104
push 0
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
call fcn.004148c0
add esp, 0xc
mov edx, dword [ebp - 8]
add edx, 4
push edx
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x43777b
jmp 0x4377a7
push str.AdobeARM_
push 0x104
mov eax, dword [ebp - 8]
add eax, 4
push eax
call main
push str.ArmReport.ini
push 0x104
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
call main
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10003af0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
add eax, 5
mov esi, esp
push eax
call dword [sym.imp.MSVCR100D.dll_malloc]
add esp, 4
cmp esi, esp
call fcn.10021000
mov dword [ebp - 8], eax
mov esi, esp
lea eax, [ebp - 0x14]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10021000
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.MSVCR100D.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov byte [eax], 0xe9
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0x10]
sub eax, dword [ebp - 8]
sub eax, 5
mov ecx, dword [ebp - 8]
mov dword [ecx + 1], eax
mov eax, dword [ebp + 8]
mov byte [eax], 0xe9
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov ecx, dword [ebp + 8]
mov dword [ecx + 1], eax
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10021000
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 0x10]
push edx
mov ecx, ebp
push eax
lea edx, [0x10003bdc]
call fcn.10021030
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.10021000
mov esp, ebp
pop ebp
ret

Function at 0x10003c00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10021000
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov byte [eax], 0xe9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 1], ecx
mov dword [ebp - 0x2c], 5
jmp 0x10003c68
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0x10]
jae 0x10003c7b
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x2c]
mov byte [eax], 0x90
jmp 0x10003c5f
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10021000
mov eax, dword [ebp + 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x10003cc4]
call fcn.10021030
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.10021000
mov esp, ebp
pop ebp
ret
Function at 0x10003db0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0xe4]
mov ecx, 0x39
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
add ecx, 0x14
cmp dword [ebp - 0x20], ecx
je 0x10003e30
cmp dword [ebp - 0x20], 0
je 0x10003e30
mov eax, dword [ebp - 0x20]
sub eax, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x28]
push edx
call fcn.10003e50
add esp, 8
test eax, eax
je 0x10003e26
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
jmp 0x10003e32
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
jmp 0x10003dea
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.10021000
mov esp, ebp
pop ebp
ret
Function at 0x10004130
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
push ebx
push esi
push edi
lea edi, [ebp - 0x2fc]
mov ecx, 0xbf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10031424]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x48], 0
push 0x31
push 0
lea eax, [ebp - 0x47]
push eax
call sub.MSVCR100D.dll_memset
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x10004179
xor eax, eax
jmp 0x100042a6
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.10021000
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100041a3
xor eax, eax
jmp 0x100042a6
mov esi, esp
push 0x10027a60
mov edi, esp
push 0x10027a50
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, esp
call fcn.10021000
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.10021000
mov dword [ebp - 0x60], eax
mov esi, esp
push 4
push 0x3000
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100D.dll_strlen
add esp, 4
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp esi, esp
call fcn.10021000
mov dword [ebp - 0x54], eax
mov esi, esp
push 0
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100D.dll_strlen
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.10021000
mov esi, esp
push 0
push 0
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x60]
push ecx
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp esi, esp
call fcn.10021000
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
push str._s_tried_to_be_loaded__n
lea ecx, [ebp - 0x168]
push ecx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0xc
cmp esi, esp
call fcn.10021000
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10021000
mov esi, esp
push 0xc000
push 0
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp esi, esp
call fcn.10021000
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x100042d8]
call fcn.10021030
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10021220
add esp, 0x2fc
cmp ebp, esp
call fcn.10021000
mov esp, ebp
pop ebp
ret
Function at 0x10004470
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, esp
call fcn.10021000
mov dword [ebp - 8], eax
mov esi, esp
lea eax, [ebp - 0x14]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp esi, esp
call fcn.10021000
mov byte [ebp - 0x1d], 0x90
mov dword [ebp - 0x2c], 0
jmp 0x100044d7
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0xc]
jae 0x10004503
mov esi, esp
push 0
push 1
lea eax, [ebp - 0x1d]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.10021000
jmp 0x100044ce
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp esi, esp
call fcn.10021000
push edx
mov ecx, ebp
push eax
lea edx, [0x1000454c]
call fcn.10021030
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.10021000
mov esp, ebp
pop ebp
ret