joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4142a6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov esi, ecx
xor ebx, ebx
push dword [ebp + 8]
mov byte [eax], bl
lea ecx, [esi - 4]
call fcn.00413f22
mov edi, ebx
cmp dword [esi + 0x78], ebx
jbe 0x41433a
cmp edi, dword [esi + 0x60]
je 0x414334
mov eax, dword [esi + 0x74]
mov eax, dword [eax + edi*4]
mov dword [ebp + 0xc], eax
lea ecx, [eax + 4]
call fcn.00408a53
mov ecx, eax
test ecx, ecx
jne 0x4143b2
mov ecx, dword [ebp + 0xc]
add ecx, 8
call fcn.00408a53
mov ecx, eax
test ecx, ecx
jne 0x4143b2
mov eax, dword [ebp + 0xc]
mov byte [eax + 0x10], bl
cmp dword [eax + 0xc], ebx
jne 0x414334
lea ecx, [ebp + 8]
push ecx
push ebx
push eax
push 0x417488
push ebx
push ebx
call fcn.0043f225
mov ecx, dword [ebp + 0xc]
add esp, 0x18
mov dword [ecx + 0xc], eax
test eax, eax
jne 0x414334
call fcn.0040896c
mov ecx, eax
test ecx, ecx
jne 0x4143b2
inc edi
cmp edi, dword [esi + 0x78]
jb 0x4142ca
mov edi, ebx
cmp dword [esi + 0x78], ebx
jbe 0x414363
cmp edi, dword [esi + 0x60]
je 0x41435d
mov eax, dword [esi + 0x74]
mov ecx, dword [eax + edi*4]
mov byte [ecx + 0x10], bl
add ecx, 4
call fcn.004089ba
mov ecx, eax
test ecx, ecx
jne 0x4143b2
inc edi
cmp edi, dword [esi + 0x78]
jb 0x414341
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x74]
push dword [ebp + 0x10]
mov ecx, dword [ecx + eax*4]
call fcn.00413b3d
mov edi, ebx
cmp dword [esi + 0x78], ebx
jbe 0x4143c4
cmp ebx, dword [esi + 0x60]
je 0x414393
mov eax, dword [esi + 0x74]
mov ecx, dword [eax + ebx*4]
mov ecx, dword [ecx + 8]
call fcn.0040899e
test edi, edi
cmove edi, eax
inc ebx
cmp ebx, dword [esi + 0x78]
jb 0x41437b
push 0
pop ebx
test edi, edi
je 0x4143c4
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
jmp 0x41446e
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x41446e
push 0x80004004
lea ecx, [esi - 4]
call fcn.00414276
test eax, eax
jne 0x41446e
push 0x8007000e
lea ecx, [esi - 4]
call fcn.00414276
test eax, eax
jne 0x41446e
mov edi, dword [esi + 0x78]
mov ecx, ebx
test edi, edi
je 0x41441e
mov edx, dword [esi + 0x74]
mov eax, dword [edx]
mov eax, dword [eax + 0x6c]
test eax, eax
je 0x414416
cmp eax, 0x20000010
je 0x414416
cmp eax, 1
je 0x414416
cmp eax, 0x80004005
jne 0x41446e
inc ecx
add edx, 4
cmp ecx, edi
jb 0x4143fa
push 1
lea ecx, [esi - 4]
call fcn.00414276
test eax, eax
jne 0x41446e
mov ecx, ebx
test edi, edi
je 0x41446c
mov edx, dword [esi + 0x74]
mov eax, dword [edx]
mov eax, dword [eax + 0x6c]
test eax, eax
je 0x414445
cmp eax, 0x20000010
jne 0x41446e
inc ecx
add edx, 4
cmp ecx, edi
jb 0x414435
test edi, edi
je 0x41446c
mov eax, dword [esi + 0x74]
push dword [ebp + 0x14]
mov ecx, dword [eax + ebx*4]
add ecx, 0x18
call fcn.0041369b
test eax, eax
jne 0x41446e
inc ebx
cmp ebx, dword [esi + 0x78]
jb 0x414451
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x41deec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44912c
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x45b008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi + 0xcc]
call fcn.0043940f
push dword [esi + 0xc0]
call fcn.0043940f
push dword [esi + 0x9c]
call fcn.0043940f
push dword [esi + 0x90]
call fcn.0043940f
push dword [esi + 0x30]
call fcn.0043940f
push dword [esi + 0x24]
call fcn.0043940f
push dword [esi + 0x18]
call fcn.0043940f
add esp, 0x1c
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41df69
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 1
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41df7d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 2
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41df91
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 3
mov ecx, dword [esi]
test ecx, ecx
je 0x41dfa4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423456
Capabilities:
Get file system object information

Disassembly:
push 0x1d0
mov eax, 0x449ad2
call fcn.00446bfd
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1d0]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1ac], eax
call fcn.004093d0
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x4234d9
push dword [edi + 0xc]
lea ecx, [ebp - 0x1b8]
push dword [edi + 8]
call fcn.00423318
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c4]
call fcn.004233b5
push eax
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 2
call fcn.00409516
push dword [ebp - 0x1c4]
call fcn.0043940f
pop ecx
mov byte [ebp - 4], 0
push dword [ebp - 0x1b8]
call fcn.0043940f
pop ecx
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1a8], eax
call fcn.004097d2
mov esi, eax
lea eax, [ebp - 0x1c4]
lea ecx, [esi + 1]
push ecx
push eax
lea ecx, [edi + 0x18]
call fcn.004147b5
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1b8]
mov eax, dword [edi + 0x18]
add eax, 2
lea eax, [eax + esi*2]
push eax
call fcn.004093f4
lea eax, [ebp - 0x1c4]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.004233f5
lea eax, [ebp - 0x1b8]
mov ecx, ebx
push eax
call fcn.004233f5
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040947d
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 5
call fcn.004096ad
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040971c
lea ecx, [ebp - 0x1a0]
call fcn.004096ad
lea eax, [ebp - 0x1d0]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040971c
lea ecx, [ebp - 0x1a0]
call fcn.004096ad
cmp byte [edi + 1], 0
je 0x4235f6
mov edx, 0x3f4
lea ecx, [ebp - 0x1dc]
call fcn.0040d127
push eax
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 6
call fcn.0040971c
mov byte [ebp - 4], 5
push dword [ebp - 0x1dc]
call fcn.0043940f
lea ecx, [ebp - 0x1a0]
mov dword [esp], 0x451514
call fcn.0040975a
push 0
lea eax, [ebp - 0x34]
push eax
lea ecx, [edi + 0x10]
call fcn.0040ce9d
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0040975a
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x1a4], eax
call fcn.0042069e
mov edx, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x1dc]
call fcn.0040a7e1
push 0x110
push 0x160
lea ecx, [ebp - 0x194]
push ecx
push 0x80
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1dc]
mov esi, eax
call fcn.0043940f
pop ecx
test esi, esi
je 0x42367b
push dword [ebp - 0x1ac]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x194]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x1a0]
call fcn.0043940f
pop ecx
push dword [ebp - 0x1b8]
call fcn.0043940f
pop ecx
push dword [ebp - 0x1c4]
call fcn.0043940f
pop ecx
push dword [ebp - 0x1d0]
call fcn.0043940f
pop ecx
call fcn.00446ba7
ret 0xc
Function at 0x425bee
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x28
mov eax, dword [edx]
push esi
mov esi, ecx
cmp eax, dword [esi + 0xb4]
jne 0x425c21
cmp dword [edx + 8], 0xffffff65
jne 0x425c21
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x425c5d
sub eax, 0x14
je 0x425c2a
dec eax
sub eax, 1
je 0x425c5d
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x425c21
push 2
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [esi + 0xb4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
jmp 0x425c23
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x425c21
mov ecx, esi
call fcn.00425c75
jmp 0x425c59

Function at 0x425da3
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x449e37
call fcn.00446bc9
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], esi
push eax
push esi
push edi
push 0x425d65
push esi
push esi
call fcn.0043f225
add esp, 0x18
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x425dee
call fcn.0040896c
test eax, eax
je 0x425dee
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x425dfd
push ecx
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.00425329
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 2
call fcn.0040897d
mov eax, esi
call fcn.00446b92
ret 8

Function at 0x4260fb
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d0
mov eax, dword [0x45b008]
xor eax, esp
mov dword [esp + 0x2cc], eax
cmp byte [0x78ddd1], 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
jne 0x42615e
mov edx, ecx
lea ecx, [esp + 0xc]
call fcn.004099e8
push 0x4010
push 0x160
lea ecx, [esp + 0x20]
or esi, 0x80
push ecx
push esi
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [esp + 0xc]
mov esi, eax
call fcn.0043940f
pop ecx
mov eax, esi
jmp 0x426180
mov eax, dword [0x78df0c]
test eax, eax
je 0x426180
push 0x4010
push 0x2b4
lea edx, [esp + 0x20]
or esi, 0x80
push edx
push esi
push ecx
call eax
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x2d4]
pop edi
pop esi
xor ecx, esp
call fcn.004393fe
mov esp, ebp
pop ebp
ret 4

Function at 0x426406
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x45b008]
xor eax, esp
mov dword [esp + 0x164], eax
test cl, cl
mov edx, 0x4011
mov eax, 0x4110
cmovne eax, edx
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x90
push 0x45081c
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.004393fe
mov esp, ebp
pop ebp
ret
Function at 0x427885
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x268
mov eax, 0x44a184
call fcn.00446bfd
mov dword [ebp - 0x274], ecx
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x238]
push ebx
push eax
call fcn.0043a930
add esp, 0xc
lea eax, [ebp - 0x238]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x238]
mov dword [ebp - 0x270], ebx
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x260], xmm0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [ebp - 0x258]
mov dword [ebp - 0x254], eax
push ecx
push eax
mov dword [ebp - 0x258], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x427925
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x427925
mov edi, dword [ebp - 0x260]
jmp 0x427937
mov eax, dword [ebp - 0x258]
xor edi, edi
add edi, esi
adc eax, ebx
mov dword [ebp - 0x25c], eax
lea eax, [edi + 0x80]
push eax
lea ecx, [ebp - 0x260]
call fcn.00419380
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x270]
mov ebx, dword [ebp - 0x260]
push 0
push eax
push edi
lea esi, [ebx + 0x80]
push esi
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x78c3a8]
mov ecx, ebx
mov dword [ebx], eax
call fcn.004080a6
push edi
mov edx, esi
call fcn.004084ee
push 7
mov byte [ebp - 0x30], 0
lea edi, [ebp - 0x2f]
xor eax, eax
lea edx, [ebp - 0x30]
pop ecx
rep stosd dword es:[edi], eax
mov ecx, ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00408579
xor eax, eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 0x254], al
push dword [ebp - 0x254]
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00439121
mov byte [ebp - 4], 1
push dword [ebp - 0x25c]
push 0
push ebx
call fcn.0043a930
add esp, 0xc
lea edx, [ebp - 0x26c]
lea ecx, [ebp - 0x250]
call fcn.00427801
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 0x10
jb 0x427a05
mov eax, dword [eax]
push 0x40
push eax
push dword [ebp - 0x274]
call fcn.0043a3b0
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 3
call fcn.00438be0
mov ecx, dword [ebp - 0x26c]
test ecx, ecx
je 0x427a42
mov edx, dword [ebp - 0x264]
sub edx, ecx
push 1
call fcn.00427284
mov dword [ebp - 4], 4
push dword [ebx - 4]
call fcn.0043f0c1
pop ecx
call fcn.00446ba7
ret
Function at 0x438d2f
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + edi]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 2
jb 0x438d3e
mov eax, dword [ecx + 0x18]
pop edi
and eax, esi
pop esi
pop ebp
ret 4
Function at 0x10005bcf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x3c4
mov eax, 0x1003132a
call fcn.10009696
mov edi, ecx
cmp dword [edi + 0x20], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3cc], eax
je 0x10005d61
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 0x3bc], 7
mov dword [ebp - 0x3b8], 1
jb 0x10005c14
mov eax, dword [esi]
lea ecx, [ebp - 0x3b8]
xor ebx, ebx
push ecx
push ebx
lea ecx, [ebp - 0x3bc]
push ecx
push ebx
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
cmp ecx, 2
je 0x10005d57
cmp dword [ebp - 0x3bc], 7
jne 0x10005d57
test ecx, ecx
je 0x10005c64
push esi
lea eax, [edi + 8]
push eax
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x3b4]
call fcn.10010482
jmp 0x10005d6e
mov eax, dword [ebp - 0x3b8]
add eax, 2
mov dword [ebp - 0x3c8], ebx
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3c4], ebx
mov dword [ebp - 0x3c0], ebx
lea ecx, [ebp - 0x3c8]
mov dword [ebp - 4], ebx
push ecx
push eax
call fcn.10010482
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 0x3c8]
sub eax, ecx
push 0
pop eax
cmove ecx, eax
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10005cba
mov eax, dword [esi]
lea edx, [ebp - 0x3b8]
push edx
push ecx
lea ecx, [ebp - 0x3bc]
push ecx
push ebx
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test ecx, ecx
jne 0x10005c4c
mov edx, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 0x3c8]
sub edx, ecx
mov esi, dword [ebp - 0x3cc]
xor eax, eax
test edx, edx
cmove ecx, eax
lea eax, [ecx + ebx*2]
push eax
lea ecx, [ebp - 0x28]
call fcn.10010482
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.10010482
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
inc eax
mov byte [ebp - 4], 1
add ebx, eax
call fcn.100023a0
mov edx, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 0x3c8]
sub edx, ecx
push 0
mov eax, ecx
pop edi
cmove eax, edi
cmp byte [eax + ebx*2], 0
jne 0x10005cf2
test ecx, ecx
je 0x10005d53
mov edx, dword [ebp - 0x3c0]
sub edx, ecx
call fcn.10002962
mov al, 1
jmp 0x10005d59
xor al, al
call fcn.10009655
ret 8
push ecx
push ecx
lea ecx, [ebp - 0x3b4]
call fcn.10005db1
push 0x100437bc
lea eax, [ebp - 0x3b4]
push eax
call fcn.10010482
int3

Function at 0x100063cd
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x10041bf0
call fcn.10009a30
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.kernel32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x10006443
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10006443
mov esi, dword [edx + ecx + 0xd8]
lea eax, [ecx + esi]
cmp edi, eax
jb 0x10006443
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x10006443
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1000644c
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000663a
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov edx, dword [0x10047b00]
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x10047af4]
test edx, edx
jne 0x10006682
test eax, eax
je 0x10006695
mov edx, eax
mov dword [0x10047b00], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x10006695
cmp ecx, ebx
jb 0x10006695
cmp ecx, edi
jbe 0x10006779
mov edx, eax
test eax, eax
jmp 0x100066b7
test edx, edx
je 0x100066b2
mov eax, dword [edx + 8]
test eax, eax
je 0x100066b2
cmp eax, ebx
jb 0x100066b2
cmp eax, edi
jbe 0x10006779
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x10047b00], edx
jne 0x1000669b
and esi, 0xffff0000
cmp esi, 0x40000000
jbe 0x100066f9
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.10010482
mov edx, eax
test edx, edx
jne 0x1000673f
lea edx, [esi - 0x40000000]
mov ecx, ebx
call fcn.10010482
mov edx, eax
test edx, edx
jne 0x1000673f
cmp esi, 0x40000000
jae 0x10006721
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.10010482
mov edx, eax
test edx, edx
jne 0x1000673f
mov edx, edi
lea ecx, [esi + 0x40000000]
call fcn.10010482
mov edx, eax
test edx, edx
jne 0x1000673f
mov edx, esi
mov ecx, ebx
call fcn.10010482
mov edx, eax
test edx, edx
jne 0x1000673f
mov edx, edi
mov ecx, esi
call fcn.10010482
mov edx, eax
test edx, edx
je 0x1000679e
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x10047af4]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x10047b00], edx
mov dword [0x10047af4], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x10006769
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x1000679e
cmp esi, edi
ja 0x1000679e
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.1000aff4
add esp, 0xc
mov eax, esi
jmp 0x100067a0
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x10006641
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov edx, dword [0x10047b00]
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x10047af4]
test edx, edx
jne 0x10006682
test eax, eax
je 0x10006695
mov edx, eax
mov dword [0x10047b00], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x10006695
cmp ecx, ebx
jb 0x10006695
cmp ecx, edi
jbe 0x10006779
mov edx, eax
test eax, eax
jmp 0x100066b7
test edx, edx
je 0x100066b2
mov eax, dword [edx + 8]
test eax, eax
je 0x100066b2
cmp eax, ebx
jb 0x100066b2
cmp eax, edi
jbe 0x10006779
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x10047b00], edx
jne 0x1000669b
and esi, 0xffff0000
cmp esi, 0x40000000
jbe 0x100066f9
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.10010482
mov edx, eax
test edx, edx
jne 0x1000673f
lea edx, [esi - 0x40000000]
mov ecx, ebx
call fcn.10010482
mov edx, eax
test edx, edx
jne 0x1000673f
cmp esi, 0x40000000
jae 0x10006721
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.10010482
mov edx, eax
test edx, edx
jne 0x1000673f
mov edx, edi
lea ecx, [esi + 0x40000000]
call fcn.10010482
mov edx, eax
test edx, edx
jne 0x1000673f
mov edx, esi
mov ecx, ebx
call fcn.10010482
mov edx, eax
test edx, edx
jne 0x1000673f
mov edx, edi
mov ecx, esi
call fcn.10010482
mov edx, eax
test edx, edx
je 0x1000679e
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x10047af4]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x10047b00], edx
mov dword [0x10047af4], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x10006769
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x1000679e
cmp esi, edi
ja 0x1000679e
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.1000aff4
add esp, 0xc
mov eax, esi
jmp 0x100067a0
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x10010482
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10010491
pop dword [ebp - 0x40]
mov eax, 0xf8e12cf
add eax, 0x72f1c2
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3fb27
push 0
mov eax, 0xf220f12e
add eax, 0x1de23f26
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x3721
mov ebx, eax
mov esi, 0xef4e1bee
sub esi, 0xdf4965ee
add esi, dword [ebp - 0x40]
mov edi, 0x5ace261b
sub edi, 0x938f2e77
xor dword [ebp - 0x20], edi
mov edx, dword [esi]
xor edx, edi
xor dword [ebp - 8], ecx
mov dword [ebx], edx
add dword [ebp - 0xc], ecx
add ebx, 0x9fe30c74
add ebx, 0x601cf390
add esi, 0xf3762e5f
add esi, 0xc89d1a5
loop 0x100104ea
add eax, 0x926bdf1a
add eax, 0x6d94f03d
mov ebx, eax
add eax, 0x42f7053b
sub eax, 0x42f70536
mov ecx, 0xcf2440ea
sub ecx, 0xbf2440ea
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x40217c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40218b
pop dword [ebp - 0x1c]
mov eax, 0x40218b
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x63075ba2
add dword [ebp - 0x2c], 0xeb4ae9a9
mov dword [ebp - 0x28], 0x7380988
add dword [ebp - 0x28], 0x2afb42bd
mov dword [ebp - 0x24], 0x65a2d852
add dword [ebp - 0x24], 0xe6a96bdc
mov dword [ebp - 0x20], 0xc9163638
sub dword [ebp - 0x20], 0xc9163638
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x3a3f796d
add eax, 0xc602b707
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x2e92d268
sub dword [ebp - 0x2c], 0xba206912
mov dword [ebp - 0x28], 0x9d472a2f
add dword [ebp - 0x28], 0xa4253746
mov dword [ebp - 0x24], 0x6e511943
add dword [ebp - 0x24], 0xf51e5329
mov dword [ebp - 0x20], 0x5286df7c
add dword [ebp - 0x20], 0xad792084
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b214
push 0
call eax
mov ecx, 0x3dbc
xor esi, esi
add esi, eax
mov edx, 0x434400
add edx, dword [ebp - 0x1c]
mov ebx, 0x177f8dc8
mov edi, dword [edx]
mov dword [ebp - 8], 0x6bdb0176
xor edi, ebx
mov dword [ebp - 0x10], 0x8daaf7d3
mov dword [esi], edi
xor dword [ebp - 0x10], edi
add esi, 4
add edx, 4
loop 0x402293
add eax, 0x593adba8
add eax, 0xa6c60e1b
mov ebx, eax
add eax, 0xf6a6bbd9
sub eax, 0xf6a6bbd4
mov ecx, 0x9a67e1ef
add ecx, 0x65d81e11
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c