joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007bdfa
Capabilities:
Log keystrokes
Parse credit card information

Disassembly:
push 4
mov eax, 0x1013b885
call fcn.1009ee9c
and dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov eax, dword [0x10191004]
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
xor edi, edi
and dword [ebp - 4], 0
inc edi
movzx edx, cx
mov dword [ebp - 0x10], edi
cmp edx, 0x25
ja 0x1007bea0
je 0x1007be96
mov eax, edx
sub eax, 0xd
je 0x1007be8c
sub eax, 0xe
je 0x1007be82
sub eax, 5
je 0x1007be78
sub eax, edi
je 0x1007be6e
sub eax, edi
je 0x1007be64
sub eax, edi
je 0x1007be5a
sub eax, edi
jne 0x1007bed9
push str.Home
jmp 0x1007bfdd
push 0x1014c588
jmp 0x1007bfdd
push str.PageDown
jmp 0x1007bfdd
push str.PageUp
jmp 0x1007bfdd
push str.Space
jmp 0x1007bfdd
push 0x1014c53c
jmp 0x1007bfdd
push 0x1014c544
jmp 0x1007bfdd
push str.Left
jmp 0x1007bfdd
mov eax, edx
sub eax, 0x26
je 0x1007bfd8
sub eax, 1
je 0x1007bfd1
sub eax, 1
je 0x1007bfca
dec eax
sub eax, 1
je 0x1007bfc3
sub eax, 3
je 0x1007bfbc
sub eax, 1
je 0x1007bfb5
cmp cx, 0x30
jb 0x1007bee5
cmp cx, 0x39
jbe 0x1007beee
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x1007bf05
movzx eax, cx
mov ecx, esi
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.10002960
jmp 0x1007bfe4
lea eax, [ecx - 0x60]
cmp ax, 9
ja 0x1007bf19
lea eax, [edx - 0x60]
push eax
push str.Num__d
jmp 0x1007bf5b
cmp cx, 0x6a
jne 0x1007bf29
push 0x1014c5fc
jmp 0x1007bfdd
cmp cx, 0x6b
jne 0x1007bf39
push str.Num_
jmp 0x1007bfdd
cmp cx, 0x6e
jne 0x1007bf49
push str.Num_Del
jmp 0x1007bfdd
lea eax, [ecx - 0x70]
cmp ax, 0xb
ja 0x1007bf72
lea eax, [edx - 0x6f]
push eax
push 0x1014c624
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.10007e90
add esp, 0x10
lea ecx, [ebp + 0xc]
call fcn.10002730
jmp 0x1007bfe4
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp al, 0x3d
jg 0x1007bf93
je 0x1007bf9f
cmp al, 0x27
je 0x1007bf9f
cmp al, 0x2b
jle 0x1007bfe4
cmp al, 0x2f
jle 0x1007bf9f
cmp al, 0x3b
je 0x1007bf9f
jmp 0x1007bfe4
cmp al, 0x5b
jl 0x1007bfe4
cmp al, 0x5d
jle 0x1007bf9f
cmp al, 0x60
jne 0x1007bfe4
cbw
mov ecx, esi
movzx eax, ax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.10008f10
jmp 0x1007bfe4
push str.Delete
jmp 0x1007bfdd
push str.Insert
jmp 0x1007bfdd
push str.Print
jmp 0x1007bfdd
push str.Down
jmp 0x1007bfdd
push str.Right
jmp 0x1007bfdd
push 0x1014c550
mov ecx, esi
call fcn.10002a10
mov eax, esi
call fcn.1009ee65
ret
Function at 0x1008317e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1003726f
mov esi, eax
test esi, esi
je 0x100831aa
mov edx, dword [esi]
mov ecx, esi
push str.menuItem
call dword [edx + 4]
test eax, eax
je 0x100831aa
mov eax, esi
jmp 0x100832ac
mov ecx, dword [0x10199ad0]
test ecx, ecx
je 0x100831bd
call fcn.10026b66
mov esi, eax
jmp 0x100831bf
xor esi, esi
push ebx
push edi
push 0x2800
call fcn.100ceda5
mov edi, eax
mov dword [esp], 0x5000
call fcn.100ceda5
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
push str.menuItem
push str.FindChildByID2_Failed__no_window_of_class___s__with_id_of___d__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.10043925
add esp, 0x20
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x10083224
xor ecx, ecx
push ecx
push ecx
push eax
push edi
push 0xffffffffffffffff
push ebx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.100e2439
pop ecx
test esi, esi
je 0x10083263
mov eax, dword [esi]
mov ecx, esi
push 3
push 0
call dword [eax + 0x2c]
test al, al
je 0x10083263
push dword [ebp + 4]
mov eax, dword [esi]
mov ecx, esi
push str.SOUI::SWindow::FindChildByID2
push 0x1e9
push str.d:workspace_soui_souiincludecore_swnd.h
push edi
push str.soui
push 3
push 0
call dword [eax + 0x34]
jmp 0x100832a1
mov ebx, 0x2800
push ebx
call fcn.100ceda5
mov dword [esp], 0x1e9
mov esi, eax
push str.d:workspace_soui_souiincludecore_swnd.h
push str.SOUI::SWindow::FindChildByID2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push ebx
push esi
call fcn.10043906
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.100e2439
pop ecx
push edi
call fcn.100e2439
pop ecx
pop edi
xor eax, eax
pop ebx
pop esi
pop ebp
ret 8
Function at 0x10093e13
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x10093e41
cmp eax, edi
jge 0x10093e35
push esi
call fcn.1009034f
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x10093e64
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x10093e4a
mov dword [esi + 8], edx
jmp 0x10093e79
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x10093e6f
xor dl, dl
jmp 0x10093e74
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x10093e64
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x10093eb2
mov dword [0x10199f60], str.zlib_corrupt
xor eax, eax
jmp 0x10093ef4
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x10093ec7
mov dword [0x10199f60], str.read_past_buffer
jmp 0x10093eae
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x10093ede
push edi
push esi
call fcn.10097ff5
pop ecx
pop ecx
test eax, eax
je 0x10093eae
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.100c2390
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x100a24c9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x100a2868
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
jne 0x100a2885
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100a2889
jmp 0x100a2891
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.100a32d5
push 0x1018b5f4
lea eax, [ebp - 0x10]
push eax
call fcn.100c661b
int3

Function at 0x100af1ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x1013d886
call fcn.1009ee9c
mov edi, ecx
mov dword [ebp - 0x10], edi
or dword [edi + 4], 0xfffffff
lea ecx, [edi + 0x3c]
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], SysReAllocString
mov dword [edi + 0x18], ebx
mov dword [edi + 0x38], ebx
call fcn.100a113c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x64]
mov dword [edi + 0x64], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
test dword [0x10191814], 0x80000000
je 0x100af25e
push dword [0x1019a4d4]
call fcn.100a28b7
pop ecx
test eax, eax
jne 0x100af263
call fcn.100a9b6c
mov dword [edi + 0xc], eax
mov eax, dword [eax + 0x34]
mov dword [edi], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
test eax, eax
je 0x100af27e
cmp eax, 2
je 0x100af27e
lock inc dword [eax + 4]
mov ecx, edi
call fcn.100b06c5
lea ecx, [edi + 0x3c]
call fcn.100a1bf8
cmp byte [ebp + 0xc], 0
je 0x100af2bf
mov edx, dword [edi + 0x64]
mov ecx, edi
add edx, 0x68
mov esi, dword [edx]
mov eax, esi
mov dword [edi + 0x68], esi
lock cmpxchg dword [edx], ecx
jmp 0x100af2b9
mov dword [edi + 0x68], eax
mov esi, eax
mov ecx, dword [edi + 0x64]
mov edx, edi
add ecx, 0x68
lock cmpxchg dword [ecx], edx
cmp eax, esi
jne 0x100af2a8
jmp 0x100af2c7
or dword [edi + 0x78], 1
and dword [edi + 0x68], 0
call fcn.100a9e8f
mov esi, eax
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x100af2df
mov ecx, esi
call fcn.100ad710
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x40]
and dword [edi + 4], 0xfffffff
mov dword [edi + 0x80], eax
mov eax, edi
call fcn.1009ee65
ret 8

Function at 0x100baa31
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1019a540], eax
cmp eax, 0xffffffff
jne 0x100baa53
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100baa57
jmp 0x100baa5f
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.100a32d5
push 0x1018b5f4
lea eax, [ebp - 0x10]
push eax
call fcn.100c661b
int3
Function at 0x100c6c56
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1015539c
push 0x10155394
push str.FlsAlloc
push 0
call fcn.100c6afd
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100c6c88
push dword [ebp + 8]
mov ecx, esi
call fcn.1009f894
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x100c6cca
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x101553ac
push 0x101553a4
push str.FlsGetValue
push 2
call fcn.100c6afd
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x100c6cfb
mov ecx, esi
call fcn.1009f894
call esi
jmp 0x100c6d01
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x100c6d04
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x101553b4
push 0x101553ac
push str.FlsSetValue
push 3
call fcn.100c6afd
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x100c6d38
mov ecx, esi
call fcn.1009f894
call esi
jmp 0x100c6d3e
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x10100bd7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101007dc

Function at 0x10100be2
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1010095d

Function at 0x10108ba7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10108381

Function at 0x10108bb2
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101085bc

Function at 0x101129f3
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1011277a

Function at 0x10115791
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.10125357
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x101157be
xor eax, eax
jmp 0x101158ba
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x100c682d
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.10117220
push esi
push eax
call fcn.100c6840
add esp, 0x14
test eax, eax
je 0x101157f9
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.10125516
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.10117202
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.1011915c
add esp, 0x28
test eax, eax
jne 0x10115830
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x10115871
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.101254e7
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x1011586c
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x101158a1
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.10125428
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.101253e0
add esp, 0x14
jmp 0x101157b7
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.101252a6
push dword [ebp - 4]
call fcn.10115bb4
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10118dfc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x10118e32
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x10118e25
push eax
call fcn.101253cc
push 2
call fcn.10125343
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.100c6320
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x1011ab70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.10125357
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x1011ab9d
xor eax, eax
jmp 0x1011ad41
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x100c682d
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.10117220
push esi
push eax
call fcn.100c6840
add esp, 0x14
test eax, eax
je 0x1011abea
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.10125516
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.10117202
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.1011915c
add esp, 0x28
test eax, eax
jne 0x1011ac21
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x1011ac5d
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.101254e7
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x1011ac5d
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x1011936b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.101193ba
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x1011acdd
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.1012df06
add esp, 0xc
cmp eax, 0xfffffffa
je 0x1011acc6
cmp eax, 0xfffffffc
je 0x1011acbf
cmp eax, 0xfffffffe
je 0x1011acb8
test eax, eax
je 0x1011acd8
push str.Unknown_zlib_error
jmp 0x1011accb
push str.zlib_stream_error
jmp 0x1011accb
push str.zlib_memory_error
jmp 0x1011accb
push str.zlib_version_error
push dword [ebp - 4]
call fcn.1011723c
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x1011ad0d
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.10125428
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.101253e0
add esp, 0x14
jmp 0x1011ab96
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.10120ea1
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1012e38d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x1012e39a
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.1012e493
Function at 0x10005880
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 0xc]
add esi, 0xffff0000
movzx eax, si
push edi
test eax, eax
je 0x1000589a
sub esi, eax
mov edi, dword [ebp + 8]
cmp esi, edi
jbe 0x10005937
cmp esi, dword [section..data]
jb 0x100058bd
cmp esi, dword [0x100ae004]
ja 0x100058bd
sub esi, 0x8000000
jmp 0x1000592f
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push esi
movdqu xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
je 0x10005937
cmp dword [ebp - 0xc], 0x10000
jne 0x1000591d
cmp dword [ebp - 0x10], 0x10000
jb 0x1000591d
push 0x40
push 0x3000
push 0x10000
push esi
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x10005939
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x10005937
sub esi, 0x10000
jmp 0x1000592f
mov esi, dword [ebp - 0x18]
add esi, 0xffff0000
movzx eax, si
test eax, eax
je 0x1000592f
sub esi, eax
cmp esi, edi
ja 0x100058a5
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10005940
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
movzx eax, si
push edi
test eax, eax
je 0x1000595a
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 0xc]
cmp esi, edi
jae 0x100059fc
cmp esi, dword [section..data]
jb 0x1000597d
cmp esi, dword [0x100ae004]
ja 0x1000597d
add esi, 0x8000000
jmp 0x100059f4
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push esi
movdqu xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
je 0x100059fc
cmp dword [ebp - 0xc], 0x10000
mov ecx, dword [ebp - 0x10]
jne 0x100059df
cmp ecx, 0x10000
jb 0x100059df
push 0x40
push 0x3000
push 0x10000
push esi
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x100059fe
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x100059fc
add esi, 0x10000
jmp 0x100059f4
mov esi, dword [ebp - 0x1c]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x100059f4
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x10005965
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005a10
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 8]
push eax
push esi
call fcn.10005b90
mov eax, dword [0x100b1eec]
add esp, 0xc
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov ecx, dword [0x100b1ee8]
test eax, eax
jne 0x10005a4d
test ecx, ecx
je 0x10005a60
mov eax, ecx
mov dword [0x100b1eec], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x10005a60
cmp edx, ebx
jb 0x10005a60
cmp edx, edi
jbe 0x10005ae6
mov eax, ecx
mov dword [0x100b1eec], eax
test ecx, ecx
je 0x10005a8a
test eax, eax
je 0x10005a7e
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10005a7e
cmp ecx, ebx
jb 0x10005a7e
cmp ecx, edi
jbe 0x10005ae6
mov eax, dword [eax + 4]
mov dword [0x100b1eec], eax
test eax, eax
jne 0x10005a6f
movzx eax, si
sub esi, eax
push esi
push ebx
call fcn.10005880
add esp, 8
test eax, eax
jne 0x10005aab
push edi
push esi
call fcn.10005940
add esp, 8
test eax, eax
je 0x10005b10
mov dword [eax], 0x52727464
xor edx, edx
mov dword [eax + 8], 0
mov esi, 0x38b
mov ecx, dword [0x100b1ee8]
mov dword [eax + 4], ecx
lea ecx, [eax + 0xffa8]
mov dword [0x100b1eec], eax
mov dword [0x100b1ee8], eax
mov dword [ecx + 0x40], edx
mov edx, ecx
sub ecx, 0x48
dec esi
jne 0x10005ad8
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, ebx
jb 0x10005b10
cmp esi, edi
ja 0x10005b10
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.10060c20
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005c50
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov ecx, dword [0x100b1ee8]
push ebx
mov ebx, 0x100b1ee8
test ecx, ecx
je 0x10005cbb
push esi
push edi
cmp dword [ecx], 0x52727464
jne 0x10005cb0
lea edi, [ecx + 0x10000]
xor edx, edx
lea esi, [ecx + 0x88]
mov eax, dword [esi]
test eax, eax
je 0x10005c86
cmp eax, ecx
jb 0x10005cb0
cmp eax, edi
jae 0x10005cb0
inc edx
add esi, 0x48
cmp edx, 0x38d
jb 0x10005c78
mov eax, dword [ecx + 4]
push 0x8000
push 0
push ecx
mov dword [ebx], eax
call sub.KERNEL32.dll_VirtualFree
mov dword [0x100b1eec], 0
jmp 0x10005cb3
lea ebx, [ecx + 4]
mov ecx, dword [ebx]
test ecx, ecx
jne 0x10005c62
pop edi
pop esi
pop ebx
ret
Function at 0x10005ec0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100a7ea8
push 0x10060d10
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x100afcf0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_VirtualQuery
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x10005f71
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10005f71
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp dword [ebp + 0xc], eax
jb 0x10005f71
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x10005f71
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x100b1ee8]
test esi, esi
je 0x1000600c
nop
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x10006013
mov esi, dword [esi + 4]
test esi, esi
jne 0x10005ff0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
pop esi
mov esp, ebp
pop ebp
ret