joyce8/EMBER2024-capa huggingface dataset:
Function at 0x114cbdd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.11365ad0
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
lea ebp, [eax - 1]
push edi
lea ecx, [ebp - 0x29]
cmp esi, ecx
jle 0x114cbe0f
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.114a32d0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp ebp, 0x29
jge 0x114cbe33
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.114a32d0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ebx, dword [esp + 0x28]
push 0
lea edx, [ebx + 1]
mov byte [ebx], 0
mov dword [esp + 0x30], edx
add ebx, 0x15
call fcn.1149d4a0
mov ecx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push 0
push ebx
push eax
push ecx
call fcn.1149d1f0
mov ecx, ebp
xor eax, eax
sub ecx, esi
lea edi, [ebx + 0x14]
sub ecx, 0x29
push 0x14
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, ebx
mov ecx, esi
sub eax, esi
mov esi, dword [esp + 0x4c]
add eax, ebp
mov edx, ecx
shr ecx, 2
lea edi, [eax - 0x14]
mov byte [eax - 0x15], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x48]
push esi
call fcn.11499e60
add esp, 0x20
test eax, eax
jg 0x114cbeb6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
add ebp, 0xffffffec
push 0x48
push str..crypto_rsa_rsa_oaep.c
push ebp
call fcn.114a2810
mov edi, eax
add esp, 0xc
test edi, edi
mov dword [esp + 0x2c], edi
jne 0x114cbef2
push 0x4b
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.114a32d0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
call fcn.1149d4a0
push eax
push 0x14
push esi
push ebp
push edi
call fcn.114cc1a0
add esp, 0x14
test ebp, ebp
jle 0x114cbf1c
mov eax, ebx
sub edi, ebx
mov ecx, ebp
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x114cbf0f
mov edi, dword [esp + 0x2c]
call fcn.1149d4a0
push eax
push ebp
push ebx
lea eax, [esp + 0x1c]
push 0x14
push eax
call fcn.114cc1a0
lea ecx, [esp + 0x24]
add esp, 0x14
mov eax, esi
sub ecx, esi
mov esi, 0x14
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x114cbf40
push edi
call fcn.114a2a90
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x114cc680
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, edx
push esi
jne 0x114cc755
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x114cc6a3
cmp al, 0x6b
jne 0x114cc755
cmp al, 0x6b
lea esi, [ecx + 1]
jne 0x114cc711
lea eax, [edx - 3]
xor edx, edx
test eax, eax
jle 0x114cc6c5
mov cl, byte [esi]
inc esi
cmp cl, 0xba
je 0x114cc6c5
cmp cl, 0xbb
jne 0x114cc6ee
inc edx
cmp edx, eax
jl 0x114cc6b3
sub eax, edx
test edx, edx
jne 0x114cc714
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.114a32d0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.114a32d0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
lea eax, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x114cc73d
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.114a32d0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov ecx, eax
push edi
mov edi, dword [esp + 0xc]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.114a32d0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x114d6660
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov ecx, dword [eax + 4]
push edi
cmp ecx, dword [ebx + 4]
jge 0x114d6679
mov edi, ebx
mov ebx, eax
jmp 0x114d667b
mov edi, eax
mov esi, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [esi + 8]
jg 0x114d668b
mov eax, esi
jmp 0x114d6695
push eax
push esi
call fcn.1149f370
add esp, 8
test eax, eax
jne 0x114d669d
pop edi
pop esi
pop ebx
ret
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x114d66c1
push ebp
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
mov ebp, dword [ecx + eax*4]
mov ecx, dword [esi]
xor edx, ebp
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
jl 0x114d66a7
pop ebp
cmp eax, dword [edi + 4]
jge 0x114d66d8
mov edx, dword [edi]
mov ecx, dword [esi]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
mov ecx, dword [edi + 4]
inc eax
cmp eax, ecx
jl 0x114d66c6
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x114d66fe
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x114d66fe
mov edx, dword [esi + 4]
dec edx
mov ecx, edx
mov dword [esi + 4], edx
test ecx, ecx
jg 0x114d66e8
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x114de500
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1151ba4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x11526534]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
mov dword [esp + 0x228], 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.1137e660
lea eax, [esp + 8]
push 1
push eax
mov ecx, esi
call fcn.11380940
mov ecx, dword [eax]
push 0x11567574
push ecx
call fcn.11365df4
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.1137e380
test edi, edi
je 0x114de5a0
push 0x11567574
mov ecx, esi
call fcn.1137efc0
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret

Function at 0x114de6e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x1151ba8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x11526534]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x104
push ecx
mov dword [esp + 0x228], 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.1137e660
lea eax, [esp + 8]
push 1
push eax
mov ecx, esi
call fcn.11380940
mov ecx, dword [eax]
push 0x11567574
push ecx
call fcn.11365df4
add esp, 8
lea ecx, [esp + 8]
mov edi, eax
call fcn.1137e380
test edi, edi
je 0x114de780
push 0x11567574
mov ecx, esi
call fcn.1137efc0
mov ecx, dword [esp + 0x218]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x114e0bf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x114e0bfd
xor eax, eax
ret 0xc
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x114e0d00
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x1153f59c]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1153f59c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1153f59c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1153f59c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1153f59c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x1153f59c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x1153f59c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1153f59c]
xor eax, edx
inc ecx
dec edi
jne 0x114e0c18
pop edi
test esi, esi
je 0x114e0d22
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1153f59c]
xor eax, edx
inc ecx
dec esi
jne 0x114e0d04
pop esi
pop ebx
not eax
ret 0xc
Function at 0x114e0f40
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x108]
push edi
mov dword [esp + 0x14], ecx
xor edx, edx
xor eax, eax
mov al, byte [edx + str.80_]
mov ecx, eax
and eax, 7
sar ecx, 3
mov bl, byte [eax*2 + 0x1153f99c]
mov cl, byte [ecx + esi]
test bl, cl
setne al
mov byte [esp + edx + 0x50], al
inc edx
cmp edx, 0x38
jl 0x114e0f57
mov eax, 0x1e
xor ebx, ebx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x110], 1
je 0x114e0f98
lea eax, [ebx + ebx]
lea edi, [esp + eax*4 + 0x8c]
lea ebp, [esp + eax*4 + 0x88]
xor eax, eax
xor ecx, ecx
mov cl, byte [ebx + 0x1153fa44]
mov dword [edi], 0
mov esi, ecx
mov dword [ebp], 0
mov edx, esi
cmp edx, 0x1c
jge 0x114e0fcc
mov cl, byte [esp + edx + 0x50]
jmp 0x114e0fd0
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x1c
jl 0x114e0fc1
mov eax, 0x1c
lea edx, [esi + 0x1c]
cmp edx, 0x38
jge 0x114e0fee
mov cl, byte [esp + edx + 0x50]
jmp 0x114e0ff2
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x38
jl 0x114e0fe3
xor edx, edx
mov eax, 0x1153f9ac
xor ecx, ecx
mov cl, byte [edx + 0x1153fa54]
cmp byte [esp + ecx + 0x18], 0
je 0x114e101d
mov ecx, dword [eax]
mov esi, dword [ebp]
or esi, ecx
mov dword [ebp], esi
xor ecx, ecx
mov cl, byte [edx + 0x1153fa6c]
cmp byte [esp + ecx + 0x18], 0
je 0x114e1034
mov ecx, dword [eax]
mov esi, dword [edi]
or esi, ecx
mov dword [edi], esi
add eax, 4
inc edx
cmp eax, str.80_
jl 0x114e1004
mov eax, dword [esp + 0x10]
inc ebx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x114e0f8b
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x88]
push edx
call fcn.114e1080
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf8
ret 8
Function at 0x114ea832
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x114ea854
cmp dword [edi + 0x3c], 0
jne 0x114ea854
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.114fe591
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.114ea893
pop edi
pop esi
pop ebx
ret 8

Function at 0x114ebf98
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x114ebfd0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.114ea46d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.114ea444
jmp 0x114ebfdc
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x114edd9d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x114edddf
call fcn.114fe591
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x114edddf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x114eddd6
xor eax, eax
jmp 0x114edde7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.114edded
pop edi
pop esi
pop ebx
ret 4
Function at 0x114f0bf1
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x114f0c21
push edi
call ebx
push eax
call fcn.114f1c86
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
je 0x114f0c4b
test byte [ebp - 4], 1
je 0x114f0c4b
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x114f0c4b
push edi
call ebx
push eax
call fcn.114f1c86
cmp dword [esi + 4], edi
lea eax, [esi + 4]
je 0x114f0cf1
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.114f0b3e
cmp dword [esi + 8], edi
lea eax, [esi + 8]
pop ecx
pop ecx
je 0x114f0c7d
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.114f0b3e
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
cmp dword [esi], edi
je 0x114f0c93
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.114f0b3e
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x114f0cbd
push 0
call ebx
push eax
call fcn.114f1c86
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x114f0cdb
push eax
call ebx
push eax
call fcn.114f1c86
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x114f0cef
push eax
call ebx
push eax
call fcn.114f1c86
xor edi, edi
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
pop esi
je 0x114f0d18
test byte [ebp - 4], 1
jne 0x114f0d18
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x114f0d18
push edi
call ebx
push eax
call fcn.114f1c86
pop edi
pop ebx
leave
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10088d32
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10088bb1
Function at 0x92ffac
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x92ffb2
pop ebp
sub ebp, 6
sub ebp, 0x52ffac
jmp 0x930010
jmp 0x930019
mov eax, 0x52ffac
add eax, ebp
add eax, 0x93
mov ecx, 0x634
mov edx, 0x518a7cfc
xor byte [eax], dl
inc eax
dec ecx
jne 0x930030
jmp 0x930043
xchg esi, eax
mov esp, 0xfcecfc94
cld
xchg esp, eax
cld
xor al, dl
cld
jge 0x93005d
add eax, 0x7dc1c478
or al, 5
js 0x93001e
ror edi, 0x3c
lodsb al, byte [esi]
add ebp, dword [ecx - 0x7c]
mov ebp, 0x77acfcb5
xor dword [edi + 0x75], esi
sar ah, 0xfc
cld
jge 0x9300ac
add al, 0xfc
cld
cld
push dword [ecx]
inc esp
cli
cld
cld
cld
inc esi
aam 0xfc
cld
cld
or ebx, dword [esi]
push dword [edi + esi*2]
jge 0x930076
cld
cld
cld
invalid
cld
adc eax, 0xfcfcfcd4
test eax, 0x79771077
ja 0x930126
jns 0x9300a2
hlt
cld
cld
cld
ja 0x93011c
invalid
mov eax, dword [0x77fcf03e]
jo 0x9300ab
clc
cld
cld
cld
xchg esp, eax
sub eax, ecx
cmc
cld
xchg esp, eax
sub dword [esi], esi
mov ch, 0xfc
std
rcr al, 1
lodsd eax, dword [esi]
adc al, 0xf9
cld
cld
cld
adc eax, 0xfcfcfec3
test eax, 0x8903a1a8
lock add ecx, dword [ecx - 0x371eb0c]
cld
cld
ja 0x930140
hlt
jg 0x930129
stc
mov ah, 0xf3
js 0x9300cc
cld
cld
cld
je 0x9300d4
cld
cld
cld
lcall 0x1407, 0x7cc5e077
lds edi, [edi + eax + 0x14]
adc al, 0xf3
js 0x930113
js 0x930113
cld
cld
cld
jl 0x930139
adc eax, 0xfced78f3
cld
cld
lcall 0x78f3, 0xd903077d
jmp 0xbe8ffe41
Function at 0x10001000
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x1000fbcc]
push esi
xor esi, esi
cmp eax, esi
je 0x1000101b
lea esp, [esp]
cmp dword [eax + 4], esi
jne 0x10001063
mov eax, dword [eax]
cmp eax, esi
jne 0x10001010
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, esi
je 0x10001063
lea ecx, [eax + 0x20]
mov edx, ecx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
sub edx, eax
nop
mov esi, dword [eax + 4]
mov dword [ecx], esi
mov dword [eax + 4], ecx
add edx, 0x20
add ecx, 0x20
cmp edx, 0xfe0
jbe 0x10001040
mov ecx, dword [0x1000fbcc]
mov dword [eax], ecx
mov dword [0x1000fbcc], eax
pop esi
ret
Function at 0x100019d0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1000e018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10001ab4
lea eax, [ebp - 0x20]
push eax
push ebx
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10001aad
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp dword [ebp - 0x20], 0x10
jb 0x10001a92
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x10001a92
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10001a92
mov eax, dword [esi]
test eax, eax
jne 0x10001a57
mov ecx, dword [0x1000fa48]
push 0x200
push eax
push ecx
mov dword [esi + 4], 0x80
call edi
mov dword [esi], eax
test eax, eax
je 0x10001aac
jmp 0x10001a84
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
jb 0x10001a84
lea edx, [ecx*8]
push edx
push eax
mov eax, dword [0x1000fa48]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x10001aac
mov ecx, dword [esi + 4]
add ecx, ecx
mov dword [esi + 4], ecx
mov dword [esi], eax
mov edx, dword [esi + 8]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x18]
mov dword [eax + edx*4], ecx
inc dword [esi + 8]
lea edx, [ebp - 0x20]
push edx
push ebx
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10001a17
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10003788
mov esp, ebp
pop ebp
ret

Function at 0x10001ad0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.100019d0
cmp dword [esi], ebx
je 0x10001b2b
cmp dword [esi + 8], ebx
jbe 0x10001b2b
push edi
mov eax, dword [esi]
mov ecx, dword [eax + ebx*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10001b24
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
push edi
call fcn.10001870
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x10001af0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10001b30
Capabilities:
Resume thread

Disassembly:
cmp dword [ebx], 0
je 0x10001b7d
push edi
xor edi, edi
cmp dword [ebx + 8], edi
jbe 0x10001b6b
push esi
mov edi, edi
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x10001b64
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [ebx + 8]
jb 0x10001b40
pop esi
mov edx, dword [ebx]
mov eax, dword [0x1000fa48]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
ret
Function at 0x10001b80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
imul esi, esi, 0x2c
add esi, dword [0x1000fbc0]
push edi
test byte [esi + 0x14], 1
mov edi, dword [esi]
mov ebx, 5
je 0x10001ba6
sub edi, ebx
mov ebx, 7
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001bc4
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov ecx, dword [esi + 4]
sub ecx, edi
sub ecx, 5
mov dword [edi + 1], ecx
test byte [esi + 0x14], 1
je 0x10001bdf
mov eax, dword [esi]
mov word [eax], 0xf9eb
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001c10
Capabilities:
Allocate or change rwx memory
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, dword [0x1000fbc8]
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [ebp - 4], esi
test ecx, ecx
je 0x10001d6d
mov eax, dword [0x1000fbc0]
add eax, 0x14
test byte [eax], 2
je 0x10001c4a
inc edi
add eax, 0x2c
cmp edi, ecx
jb 0x10001c35
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], edi
cmp edi, 0xffffffff
je 0x10001d6d
push ebx
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
call fcn.10001ad0
add esp, 8
cmp edi, dword [0x1000fbc8]
jae 0x10001d23
mov eax, edi
imul eax, eax, 0x2c
mov dword [ebp - 0x10], eax
lea ebx, [ebx]
mov ecx, dword [0x1000fbc0]
test byte [eax + ecx + 0x14], 2
lea esi, [eax + ecx]
jne 0x10001d01
test byte [esi + 0x14], 1
mov edi, dword [esi]
mov ebx, 5
je 0x10001ca4
sub edi, ebx
mov ebx, 7
lea edx, [ebp - 0xc]
push edx
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10001d19
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10001cd1
mov eax, dword [esi]
mov word [eax], 0xf9eb
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 0xc]
push ecx
push edx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
mov dword [ebp - 4], 0
inc edi
add eax, 0x2c
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], eax
cmp edi, dword [0x1000fbc8]
jb 0x10001c80
jmp 0x10001d20
mov dword [ebp - 4], 0xa
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x10001d6c
xor edi, edi
cmp dword [ebp - 0x14], edi
jbe 0x10001d5c
mov eax, dword [ebx + edi*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x10001d53
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [ebp - 0x14]
jb 0x10001d31
mov esi, dword [ebp - 4]
mov ecx, dword [0x1000fa48]
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret