joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10037650
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0x10033b40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1007fae4], eax
cmp dword [0x1007fae4], 0
jne 0x1003774c
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10021e20
mov eax, dword [0x1007fae4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100410a2
mov esp, ebp
pop ebp
ret
Function at 0x10037bb0
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0x100270c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x10037ca7
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10021e20
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100410a2
mov esp, ebp
pop ebp
ret
Function at 0x10037cc0
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0x10033fb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1007fac8], eax
cmp dword [0x1007fac8], 0
jne 0x10037dbc
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10021e20
mov eax, dword [0x1007fac8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100410a2
mov esp, ebp
pop ebp
ret
Function at 0x10037dd0
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0x10037090
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1007fad4], eax
cmp dword [0x1007fad4], 0
jne 0x10037ecc
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10021e20
mov eax, dword [0x1007fad4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100410a2
mov esp, ebp
pop ebp
ret
Function at 0x10037ff0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064c83
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov eax, dword [0x1007fac8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xd4], eax
push 0
mov ecx, dword [0x1007facc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xd8], eax
push 0
mov edx, dword [0x1007fad0]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xdc], eax
push 0
mov eax, dword [0x1007fad4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xe0], eax
push 0
mov ecx, dword [0x1007fae4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xe4], eax
mov edx, dword [0x1007fac8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xf0], eax
mov eax, dword [0x1007facc]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xf4], eax
mov ecx, dword [0x1007fad0]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xf8], eax
mov edx, dword [0x1007fad4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0xfc], eax
mov eax, dword [0x1007fae4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0xd4], 0x102
jne 0x1003811b
cmp dword [ebp - 0xd8], 0x102
jne 0x1003811b
cmp dword [ebp - 0xdc], 0x102
jne 0x1003811b
cmp dword [ebp - 0xe0], 0x102
jne 0x1003811b
cmp dword [ebp - 0xe4], 0x102
je 0x1003818d
push 0x585882d1
lea ecx, [ebp - 0x6c]
call fcn.10037550
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xe8]
mov dword [ebp - 0xec], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0xec]
push edx
call fcn.10021b20
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xcc], 0
jmp 0x10038172
mov eax, dword [ebp - 0xcc]
add eax, 1
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x59
jge 0x10038188
mov ecx, dword [ebp - 0xcc]
mov byte [ebp + ecx - 0x6c], 0
jmp 0x10038163
call fcn.10021e20
cmp dword [ebp - 0xf0], 1
je 0x100381ba
cmp dword [ebp - 0xf4], 1
je 0x100381ba
cmp dword [ebp - 0xf8], 1
je 0x100381ba
cmp dword [ebp - 0xfc], 1
je 0x100381ba
cmp dword [ebp - 0x100], 1
jne 0x10038233
mov edx, 0x9d0828d
push edx
lea ecx, [ebp - 0xc8]
call fcn.100375d0
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x108], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x108]
push ecx
call fcn.10021b20
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xd0], 0
jmp 0x10038215
mov edx, dword [ebp - 0xd0]
add edx, 1
mov dword [ebp - 0xd0], edx
cmp dword [ebp - 0xd0], 0x59
jge 0x1003822e
mov eax, dword [ebp - 0xd0]
mov byte [ebp + eax - 0xc8], 0
jmp 0x10038206
call fcn.10021e20
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100410a2
mov esp, ebp
pop ebp
ret
Function at 0x1003a4a5
Capabilities:
Create thread

Disassembly:
jae 0x1003a4a3
jmp 0x1003a49e
call fcn.1003a4a5
jae 0x1003a49e
add esp, 4
jmp 0x1003a4aa
dec dword [esp]
jno 0x1003a4af
jns 0x1003a49a
jp 0x1003a4b3
add esp, 4
popf
jmp 0x1003a4ba
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1003a4d3
jne 0x1003a4d3
call 0x1fc3d827
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x1003a650
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x38], eax
clc
jae 0x1003a501
pop ss
add byte [esi - 0x64], ah
pushf
push 0xa
jae 0x1003a50e
jmp 0x1003a509
call 0x1003a510
jae 0x1003a509
add esp, 4
jmp 0x1003a515
dec dword [esp]
jno 0x1003a51a
jns 0x1003a505
jp 0x1003a51e
add esp, 4
popf
jmp 0x1003a525
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1003a53e
jne 0x1003a53e
add byte [ebx + eax - 0x15], bh
add eax, dword [eax]
jl 0x1003a543
jmp 0x1003a545
je 0x1003a540
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1003a55f
jne 0x1003a55e
call 0x930795e6
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1003a56d
jne 0x1003a56d
call 0x10cc22f4
cmp dword [ebp - 0x38], 0
jne 0x1003a63c
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10021e20
mov eax, dword [ebp - 0x38]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100410a2
mov esp, ebp
pop ebp
ret
Function at 0x1003a510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x1003a4a3
jmp 0x1003a49e
call fcn.1003a4a5
jae 0x1003a49e
add esp, 4
jmp 0x1003a4aa
dec dword [esp]
jno 0x1003a4af
jns 0x1003a49a
jp 0x1003a4b3
add esp, 4
popf
jmp 0x1003a4ba
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1003a4d3
jne 0x1003a4d3
call 0x1fc3d827
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x1003a650
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x38], eax
clc
jae 0x1003a501
pop ss
add byte [esi - 0x64], ah
pushf
push 0xa
jae 0x1003a50e
jmp 0x1003a509
call 0x1003a510
jae 0x1003a509
add esp, 4
jmp 0x1003a515
dec dword [esp]
jno 0x1003a51a
jns 0x1003a505
jp 0x1003a51e
add esp, 4
popf
jmp 0x1003a525
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1003a53e
jne 0x1003a53e
add byte [ebx + eax - 0x15], bh
add eax, dword [eax]
jl 0x1003a543
jmp 0x1003a545
je 0x1003a540
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1003a55f
jne 0x1003a55e
call 0x930795e6
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1003a56d
jne 0x1003a56d
call 0x10cc22f4
cmp dword [ebp - 0x38], 0
jne 0x1003a63c
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
call fcn.10021e20
mov eax, dword [ebp - 0x38]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100410a2
mov esp, ebp
pop ebp
ret
Function at 0x1003bed0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1003c080
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1003bf9d
mov edx, dword [ebp - 4]
cmp edx, dword [0x1007e200]
jb 0x1003bf1a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1007e204]
ja 0x1003bf1a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003beea
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10042d50
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1003bf40
jmp 0x1003bf9d
cmp dword [ebp - 0x14], 0x10000
jne 0x1003bf83
cmp dword [ebp - 0x18], 0x10000
jb 0x1003bf83
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003bf76
mov eax, dword [ebp - 8]
jmp 0x1003bf9f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1003bf98
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1003c080
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003beea
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003bfb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1003c0b0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1003c075
mov edx, dword [ebp - 4]
cmp edx, dword [0x1007e200]
jb 0x1003bff5
mov eax, dword [ebp - 4]
cmp eax, dword [0x1007e204]
ja 0x1003bff5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003bfc5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10042d50
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1003c01b
jmp 0x1003c075
cmp dword [ebp - 0x14], 0x10000
jne 0x1003c05e
cmp dword [ebp - 0x18], 0x10000
jb 0x1003c05e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003c051
mov eax, dword [ebp - 8]
jmp 0x1003c077
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1003c070
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1003c0b0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003bfc5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003c0e0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1003c4d0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x1007fb14], 0
jne 0x1003c11d
cmp dword [0x1007fb10], 0
je 0x1003c11d
mov eax, dword [0x1007fb10]
mov dword [0x1007fb14], eax
cmp dword [0x1007fb14], 0
je 0x1003c19a
mov ecx, dword [0x1007fb14]
cmp dword [ecx + 8], 0
je 0x1003c19a
mov edx, dword [0x1007fb14]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1003c19a
mov ecx, dword [0x1007fb14]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1003c19a
mov eax, dword [0x1007fb14]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x1003c169
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x1003c170
xor eax, eax
jmp 0x1003c2b9
mov ecx, dword [0x1007fb14]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.10042d50
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x1003c2b9
mov edx, dword [0x1007fb10]
mov dword [0x1007fb14], edx
jmp 0x1003c1b6
mov eax, dword [0x1007fb14]
mov ecx, dword [eax + 4]
mov dword [0x1007fb14], ecx
cmp dword [0x1007fb14], 0
je 0x1003c1f6
cmp dword [0x1007fb14], 0
je 0x1003c1f4
mov edx, dword [0x1007fb14]
cmp dword [edx + 8], 0
je 0x1003c1f4
mov eax, dword [0x1007fb14]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x1003c1f4
mov edx, dword [0x1007fb14]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1003c1f4
jmp 0x1003c14e
jmp 0x1003c1a8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1003c2c0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1003c2b7
mov eax, dword [ebp - 0x18]
mov dword [0x1007fb14], eax
mov ecx, dword [0x1007fb14]
mov dword [ecx], 0x52727464
mov edx, dword [0x1007fb14]
mov dword [edx + 8], 0
mov eax, dword [0x1007fb14]
mov ecx, dword [0x1007fb10]
mov dword [eax + 4], ecx
mov edx, dword [0x1007fb14]
mov dword [0x1007fb10], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x1007fb14]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x1003c287
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x1003c2a7
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1003c27e
mov eax, dword [0x1007fb14]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1003c14e
xor eax, eax
mov esp, ebp
pop ebp
ret