joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x9c], edx
mov edi, eax
xor eax, eax
push ebp
push 0x406dfc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x97]
push eax
push 0x97
call sub.kernel32.dll_GetLogicalDriveStringsA
xor ebx, ebx
jmp 0x406dd5
mov esi, ebx
and esi, 0xff
lea eax, [ebp + esi - 0x97]
push eax
call sub.kernel32.dll_GetDriveTypeA
sub eax, 5
je 0x406dd2
mov al, byte [ebp + esi - 0x97]
call fcn.0040258c
cmp al, 0x41
je 0x406dd2
mov al, byte [ebp + esi - 0x97]
call fcn.0040258c
cmp al, 0x42
je 0x406dd2
lea eax, [ebp - 0x9c]
mov dl, byte [ebp + esi - 0x97]
call fcn.004031b4
mov edx, dword [ebp - 0x9c]
mov eax, edi
call fcn.00403214
add bl, 4
xor eax, eax
mov al, bl
cmp byte [ebp + eax - 0x97], 0
jne 0x406d79
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e03
lea eax, [ebp - 0x9c]
call fcn.00403094
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x2c195f82
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x54182d6e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x57a655ba
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2a857768
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10002f70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10002f94
xor eax, eax
jmp 0x10003014
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10002fab
xor eax, eax
jmp 0x10003014
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10002ff7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10002ff7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x10002fce
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10003003
xor eax, eax
jmp 0x10003014
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10003011
xor eax, eax
jmp 0x10003014
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100044e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
call fcn.10003470
push eax
lea ecx, [ebp - 0x14]
call fcn.100302f0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1000458c
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10004586
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10004586
cmp dword [ebp - 0xc], 0
jne 0x10004537
mov dword [ebp - 0x18], 0
jmp 0x1000456c
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov cx, word [eax]
mov word [ebp - 2], cx
add dword [ebp - 8], 2
cmp word [ebp - 2], 0
jne 0x10004546
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x1c]
sar edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0xc]
push edx
lea ecx, [ebp - 0x14]
call fcn.10030850
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0x14]
sub ecx, 0x10
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.100306c0
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add eax, 0x10
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x14]
sub edx, 0x10
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x2c]
call fcn.10003260
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x100045d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
lea eax, [edx + edx + 2]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10004625
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edx, dword [ebp + 8]
sub edx, 0x10
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
call fcn.10003260
jmp 0x1000467c
mov eax, dword [ebp - 8]
push eax
lea ecx, [ebp + 8]
call fcn.1002fbf0
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.10058200
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
push eax
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [ebp + 8]
sub edx, 0x10
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
call fcn.10003260
mov esp, ebp
pop ebp
ret

Function at 0x10004680
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [ecx + 0x1006c3b8], edx
mov dword [ebp - 4], 1
jmp 0x100046a7
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x270
jge 0x100046f0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x1006c3b4]
shr edx, 0x1e
mov eax, dword [ebp - 4]
xor edx, dword [eax*4 + 0x1006c3b4]
imul ecx, edx, 0x6c078965
add ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [edx*4 + 0x1006c3b8], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*4 + 0x1006c3b8]
mov dword [eax*4 + 0x1006c3b8], edx
jmp 0x1000469e
mov dword [0x1006aa00], 1
mov dword [0x1006bd68], 1
mov esp, ebp
pop ebp
ret
Function at 0x10004710
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov dword [ebp - 4], 0x1006c3b8
cmp dword [0x1006bd68], 0
jne 0x1000473a
push 0
call fcn.1004df9d
add esp, 4
push eax
call fcn.10004680
add esp, 4
mov dword [0x1006aa00], 0x270
mov dword [0x1006c354], 0x1006c3b8
mov dword [ebp - 8], 0xe4
jmp 0x10004760
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
je 0x100047d5
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + edx]
and ecx, 1
je 0x10004787
mov dword [ebp - 0xc], 0x9908b0df
jmp 0x1000478e
mov dword [ebp - 0xc], 0
mov edx, 4
imul eax, edx, 0x18d
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx]
and edx, 0x80000000
mov ecx, 4
shl ecx, 0
mov esi, dword [ebp - 4]
mov ecx, dword [esi + ecx]
and ecx, 0x7fffffff
or edx, ecx
shr edx, 1
xor edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
xor edx, dword [ecx + eax]
mov eax, dword [ebp - 4]
mov dword [eax], edx
jmp 0x10004757
mov dword [ebp - 8], 0x18d
jmp 0x100047e7
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
je 0x1000485b
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax]
and edx, 1
je 0x1000480e
mov dword [ebp - 0x10], 0x9908b0df
jmp 0x10004815
mov dword [ebp - 0x10], 0
mov eax, 4
imul ecx, eax, 0xffffff1d
mov edx, 4
imul eax, edx, 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax]
and eax, 0x80000000
mov edx, 4
shl edx, 0
mov esi, dword [ebp - 4]
mov edx, dword [esi + edx]
and edx, 0x7fffffff
or eax, edx
shr eax, 1
xor eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x100047de
mov edx, 4
imul eax, edx, 0
mov ecx, dword [eax + 0x1006c3b8]
and ecx, 1
je 0x10004877
mov dword [ebp - 0x14], 0x9908b0df
jmp 0x1000487e
mov dword [ebp - 0x14], 0
mov edx, 4
imul eax, edx, 0xffffff1d
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx]
and edx, 0x80000000
mov ecx, 4
imul ecx, ecx, 0
mov ecx, dword [ecx + 0x1006c3b8]
and ecx, 0x7fffffff
or edx, ecx
shr edx, 1
xor edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor edx, dword [ecx + eax]
mov eax, dword [ebp - 4]
mov dword [eax], edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100048d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1006aa00]
sub eax, 1
mov dword [0x1006aa00], eax
jne 0x100048e8
call fcn.10004710
mov ecx, dword [0x1006c354]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [0x1006c354]
add eax, 4
mov dword [0x1006c354], eax
mov ecx, dword [ebp - 4]
shr ecx, 0xb
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shl edx, 7
and edx, 0x9d2c5680
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x12
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shr eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10004a60
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1006a008]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
movss dword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], 0x20
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
cmp dword [ebp - 0x1c], 0
jbe 0x10004ac3
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x18]
imul eax, ecx, 0x64
xor edx, edx
div dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
cvtsi2sd xmm0, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
shr edx, 0x1f
addsd xmm0, qword [edx*8 + 0x10068770]
movsd qword [ebp - 0x34], xmm0
cvtsd2ss xmm0, qword [ebp - 0x34]
movss dword [ebp - 0x2c], xmm0
fld dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100491d6
mov esp, ebp
pop ebp
ret

Function at 0x10004ae0
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006a008]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x10004b9c
mov dword [ebp - 0x20], 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10004b92
cmp dword [ebp - 0x20], 0x10
jb 0x10004b79
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp + 0xc]
je 0x10004b79
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 8]
jne 0x10004b79
mov ecx, dword [ebp - 0x18]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10004b79
movzx edx, byte [ebp + 0x10]
cmp edx, 1
jne 0x10004b65
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x10004b6f
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10004b20
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100491d6
mov esp, ebp
pop ebp
ret
Function at 0x10005b40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x14], 0
push 4
mov eax, dword [ebp + 8]
push eax
call fcn.10003990
test eax, eax
jne 0x10005b64
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x10005cb9
mov dword [ebp - 0x18], 0
push 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.10003990
test eax, eax
jne 0x10005b92
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jbe 0x10005cb9
mov edx, dword [ebp - 4]
add edx, 0x1cc
mov dword [ebp - 0xc], edx
push 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.10003a80
test eax, eax
jne 0x10005bea
mov dword [ebp - 0x1c], 0
push 4
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10003990
test eax, eax
jne 0x10005bdb
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
je 0x10005bea
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x28], eax
mov edx, 1
test edx, edx
je 0x10005cb9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x28]
cmp eax, 0x1e
jbe 0x10005c13
jmp 0x10005cb9
cmp dword [ebp + 0xc], 0
jbe 0x10005c6d
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10003990
test eax, eax
jne 0x10005c63
lea edx, [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], 0
jmp 0x10005c49
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x14]
jge 0x10005c63
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [edx], cl
jmp 0x10005c40
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp + 0x10]
jne 0x10005c6d
jmp 0x10005cb9
mov eax, dword [ebp - 4]
add eax, 0x1cc
mov dword [ebp - 0x10], eax
push 4
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10003a80
test eax, eax
jne 0x10005cb4
mov dword [ebp - 0x24], 0
push 4
mov edx, dword [ebp - 0x10]
push edx
call fcn.10003990
test eax, eax
jne 0x10005ca5
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 1
je 0x10005cb4
mov edx, dword [ebp - 0x10]
mov dword [edx], 1
jmp 0x10005bf3
mov esp, ebp
pop ebp
ret
Function at 0x10007cb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
lea eax, [ebp - 0x30]
push eax
push 0x40
push 0x10
push 0xe62db0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10007e9d
cmp dword [ebp + 8], 0
jle 0x10007dc6
mov dword [ebp - 8], 1
jmp 0x10007ced
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 5
jae 0x10007dc1
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 8]
jne 0x10007d5c
mov eax, dword [ebp - 8]
lea ecx, [eax*4 + 0xe62dac]
mov dword [ebp - 0x10], ecx
push 4
mov edx, dword [ebp - 0x10]
push edx
call fcn.10003a80
test eax, eax
jne 0x10007d5a
xorps xmm0, xmm0
movss dword [ebp - 0x18], xmm0
push 4
mov eax, dword [ebp - 0x10]
push eax
call fcn.10003990
test eax, eax
jne 0x10007d3e
mov ecx, dword [ebp - 0x10]
movss xmm0, dword [ecx]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [ebp - 0x18]
ucomiss xmm0, dword [0x1006873c]
lahf
test ah, 0x44
jnp 0x10007d5a
mov edx, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [edx], xmm0
jmp 0x10007dbc
mov eax, dword [ebp - 8]
lea ecx, [eax*4 + 0xe62dac]
mov dword [ebp - 0x14], ecx
push 4
mov edx, dword [ebp - 0x14]
push edx
call fcn.10003a80
test eax, eax
jne 0x10007dbc
xorps xmm0, xmm0
movss dword [ebp - 0x1c], xmm0
push 4
mov eax, dword [ebp - 0x14]
push eax
call fcn.10003990
test eax, eax
jne 0x10007d9b
mov ecx, dword [ebp - 0x14]
movss xmm0, dword [ecx]
movss dword [ebp - 0x1c], xmm0
movss xmm0, dword [ebp - 0x1c]
ucomiss xmm0, dword [0x10068754]
lahf
test ah, 0x44
jnp 0x10007dbc
mov edx, dword [ebp - 0x14]
movss xmm0, dword [0x10068754]
movss dword [edx], xmm0
jmp 0x10007ce4
jmp 0x10007e88
mov dword [ebp - 0x2c], 0
mov eax, 0x10
test eax, eax
jle 0x10007e88
push 0x10
push 0xe62db0
call fcn.10003a80
test eax, eax
jne 0x10007e88
mov dword [ebp - 4], 0
jmp 0x10007e00
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x10
jge 0x10007e81
mov edx, dword [ebp - 4]
add edx, 0xe62db0
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], 0
push 1
mov eax, dword [ebp - 0x20]
push eax
call fcn.10003990
test eax, eax
jne 0x10007e58
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], 0
jmp 0x10007e40
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 1
jge 0x10007e58
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0xc]
mov dl, byte [ecx]
mov byte [eax], dl
jmp 0x10007e37
movzx eax, byte [ebp - 0x24]
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x1006aa24]
cmp eax, edx
je 0x10007e7c
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + 0x1006aa24]
mov byte [eax + 0xe62db0], dl
jmp 0x10007df7
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
push 0x10
push 0xe62db0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x10008b70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
mov dword [0x1006bdc4], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10007770
add esp, 4
mov edx, dword [ebp + 8]
push edx
call fcn.10007cb0
add esp, 4
mov eax, dword [ebp + 8]
push eax
call fcn.10007eb0
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.10008100
add esp, 4
lea edx, [ebp - 0x2c]
push edx
push 0x40
push 1
push 0xe61278
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10008de3
cmp dword [ebp + 8], 0
jle 0x10008cd5
push 1
push 0xe61278
call fcn.10003a80
test eax, eax
jne 0x10008cd0
mov dword [ebp - 0x1c], 0
push 1
push 0xe61278
call fcn.10003990
test eax, eax
jne 0x10008c2f
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], 0
jmp 0x10008c16
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 1
jge 0x10008c2f
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0xe61278]
mov byte [edx], cl
jmp 0x10008c0d
cmp dword [ebp - 0x1c], 0xff
je 0x10008cd0
mov dword [ebp - 4], 0
mov edx, 0xff
and edx, 0xff
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x14], dl
mov edx, 0xff
shr edx, 8
and edx, 0xff
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x14], dl
mov ecx, 0xff
shr ecx, 0x10
and ecx, 0xff
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x14], cl
mov eax, 0xff
shr eax, 0x18
and eax, 0xff
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x14], al
mov dword [ebp - 4], 0
jmp 0x10008cb8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x10008cd0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov al, byte [ebp + edx - 0x14]
mov byte [ecx + 0xe61278], al
jmp 0x10008caf
jmp 0x10008dce
push 1
push 0xe61278
call fcn.10003a80
test eax, eax
jne 0x10008dce
mov dword [ebp - 0x20], 0
push 1
push 0xe61278
call fcn.10003990
test eax, eax
jne 0x10008d31
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], 0
jmp 0x10008d18
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 1
jge 0x10008d31
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + 0xe61278]
mov byte [eax], dl
jmp 0x10008d0f
cmp dword [ebp - 0x20], 6
je 0x10008dce
mov dword [ebp - 8], 0
mov eax, 6
and eax, 0xff
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x18], al
mov eax, 6
shr eax, 8
and eax, 0xff
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x18], al
mov edx, 6
shr edx, 0x10
and edx, 0xff
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x18], dl
mov ecx, 6
shr ecx, 0x18
and ecx, 0xff
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x18], cl
mov dword [ebp - 8], 0
jmp 0x10008db6
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jge 0x10008dce
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov cl, byte [ebp + eax - 0x18]
mov byte [edx + 0xe61278], cl
jmp 0x10008dad
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 1
push 0xe61278
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret