joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0xc]
shr ecx, 5
cmp ecx, 4
jb 0x10001175
cmp ecx, 0xe
ja 0x10001175
push ebp
push esi
test ecx, ecx
push edi
jbe 0x1000103b
mov edx, dword [esp + 0x14]
mov eax, 0x10007ca0
sub edx, eax
mov esi, ecx
mov edi, dword [edx + eax]
mov dword [eax], edi
add eax, 4
dec esi
jne 0x10001030
lea eax, [ecx + 1]
mov dword [ecx*4 + 0x10007ca0], ecx
cmp eax, 0xf
jae 0x1000105c
mov ecx, 0xf
lea edi, [eax*4 + 0x10007ca0]
sub ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
xor edx, edx
lea ecx, [ebx + 4]
xor eax, eax
mov esi, dword [eax + 0x1000786c]
mov edi, dword [eax + 0x100078a8]
mov esi, dword [esi*4 + 0x10007ca0]
mov ebp, dword [edi*4 + 0x10007ca0]
xor esi, ebp
mov ebp, dword [eax + 0x10007ca0]
rol esi, 3
lea edi, [eax + edx]
add eax, 4
xor esi, edi
xor ebp, esi
cmp eax, 0x3c
mov dword [eax + 0x10007c9c], ebp
jl 0x10001063
mov esi, 4
xor eax, eax
mov edi, dword [eax + 0x10007830]
mov ebp, dword [eax + 0x10007ca0]
add eax, 4
mov edi, dword [edi*4 + 0x10007ca0]
and edi, 0x1ff
mov edi, dword [edi*4 + 0x10007030]
add edi, ebp
rol edi, 9
mov dword [eax + 0x10007c9c], edi
cmp eax, 0x3c
jl 0x100010a4
dec esi
jne 0x100010a2
mov eax, 0x100078e4
mov esi, dword [eax]
add eax, 4
add ecx, 4
cmp eax, 0x1000790c
mov esi, dword [esi*4 + 0x10007ca0]
mov dword [ecx - 4], esi
jl 0x100010df
inc edx
cmp edx, 4
jb 0x10001061
lea esi, [ebx + 0x18]
mov edi, 0x10
mov ecx, dword [esi]
mov edx, ecx
or edx, 3
mov eax, edx
mov ebx, edx
not eax
and eax, 0x7fffffff
shr ebx, 1
xor eax, ebx
mov ebx, eax
mov ebp, eax
shr ebx, 2
shr ebp, 1
and ebx, ebp
and eax, ebx
mov ebx, eax
mov ebp, eax
shr ebx, 6
shr ebp, 3
and ebx, ebp
and eax, ebx
je 0x1000116a
shl eax, 1
and ecx, 3
lea ebx, [eax + eax]
or eax, ebx
lea ebx, [eax*4]
or eax, ebx
mov ebx, dword [ecx*4 + 0x10007920]
mov ecx, dword [esi - 4]
rol ebx, cl
mov ecx, eax
shl ecx, 4
or ecx, eax
and ebx, ecx
and ebx, 0xfffffffc
xor edx, ebx
mov dword [esi], edx
add esi, 8
dec edi
jne 0x1000110a
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x10002410
Capabilities:
Acquire debug privileges
Hide graphical window
Terminate process

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x14
cmp eax, 1
push esi
jne 0x10002498
push str.Windows
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x10002448
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esp + 4]
push 1
push eax
call fcn.100028d0
add esp, 8
test eax, eax
je 0x10002468
push 0x10007930
call fcn.10002a10
add esp, 4
lea ecx, [esp + 4]
push 2
push ecx
call fcn.100028d0
add esp, 8
test eax, eax
je 0x10002480
call fcn.10002700
lea edx, [esp + 4]
push 3
push edx
call fcn.100028d0
add esp, 8
test eax, eax
je 0x10002498
call fcn.100024b0
mov eax, 1
pop esi
add esp, 0x14
ret 0xc
Function at 0x10002700
Capabilities:
Terminate process

Disassembly:
sub esp, 0x120
lea eax, [esp]
push 0x1c
push eax
push fcn.10002410
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [esp + 4]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
push 0x10002760
push 0
push 0x65
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
je 0x10002757
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
add esp, 0x120
ret

Function at 0x100028d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1f0
xor eax, eax
push ebx
mov dword [esp + 9], eax
lea ecx, [esp + 0x30]
mov dword [esp + 0xd], eax
push 0x1c
mov dword [esp + 0x15], eax
push ecx
push fcn.10002410
mov byte [esp + 0x14], 0
mov dword [esp + 0x21], eax
mov dword [esp + 0x58], 0x10006108
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [esp + 0x34]
lea edx, [esp + 0xf0]
push 0x104
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x8000000
push 3
push 0
push 3
lea ecx, [esp + 0x104]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10002a02
mov edx, dword [esp + 0x1fc]
push 0
add edx, 0xa00
push 0
shl edx, 4
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 4]
push 0
push eax
lea ecx, [esp + 0x10]
push 0x10
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100029fb
cmp dword [esp + 4], 0x10
jb 0x100029fb
push esi
push edi
mov edi, 0x10007958
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x80
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x5c]
call section..text
mov edi, dword [esp + 0x200]
lea edx, [esp + 0x10]
push edi
push edx
lea ecx, [esp + 0x5c]
call fcn.10001a80
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
mov eax, ecx
pop esi
neg eax
sbb eax, eax
pop ebx
neg eax
add esp, 0x1f0
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
add esp, 0x1f0
ret
Function at 0x100035ce
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x100079a0
cmp edx, dword [eax]
je 0x100035f0
add eax, 8
inc ecx
cmp eax, 0x10007a30
jl 0x100035e1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x100079a0]
jne 0x1000371e
mov eax, dword [0x10007cf8]
cmp eax, 1
je 0x100036f8
test eax, eax
jne 0x10003621
cmp dword [0x10007cfc], 1
je 0x100036f8
cmp edx, 0xfc
je 0x1000371e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10003658
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.10003990
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.10003a80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1000369b
lea eax, [ebp - 0x1a4]
push eax
call fcn.10003a80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x100063e8
push edi
call fcn.10004b00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.10003990
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.100039a0
lea eax, [ebp - 0xa0]
push 0x100063c8
push eax
call fcn.100039a0
push dword [esi + 0x100079a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.100039a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.10004a6e
add esp, 0x2c
pop edi
jmp 0x1000371e
lea eax, [ebp + 8]
lea esi, [esi + 0x100079a4]
push 0
push eax
push dword [esi]
call fcn.10003a80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10002900
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1007a8bc], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x100029ba
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x1007a8b8], eax
inc ebx
cmp ebx, 0x100
jb 0x10002920
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x100029e6
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1007a8b8]
sub edi, 1
jne 0x100029c5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10002a18
nop dword [eax]
cmp cl, 0x23
jne 0x100029ff
cmp byte [esi], cl
jne 0x100029ff
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1007a8b8]
test cl, cl
jne 0x100029f0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10002bb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10002bc2
mov dword [edi], 0
mov edx, 0x10076800
call fcn.10002a20
mov esi, eax
test esi, esi
jne 0x10002bd6
pop edi
pop esi
pop ebp
ret
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002c89
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10002c89
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002c89
mov eax, dword [0x1007acc0]
test eax, eax
je 0x10002c23
inc dword [eax + 0x394]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x10002c89
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x10002c72
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1007acc0]
add esp, 4
test eax, eax
je 0x10002c5f
dec dword [eax + 0x394]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x10002c81
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x100114d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x1007acc0]
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [esi + 0x2c2c], 0
test eax, eax
je 0x100115cc
push edi
lea edi, [esi + 0x2c30]
mov dword [esi + 0x2c2c], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10011527
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10012290
mov ecx, dword [edi + 4]
xor edx, edx
mov dword [edi], 0
test ecx, ecx
jne 0x1001153e
push 8
mov ecx, edi
call fcn.10012290
mov edx, dword [edi]
mov eax, dword [edi + 8]
push ebx
mov dword [ebp - 4], 0
mov byte [edx + eax], 0
inc dword [edi]
cmp dword [esi + 0x2c3c], 0
jle 0x10011585
xor ebx, ebx
nop word [eax + eax]
mov eax, dword [esi + 0x2c44]
add eax, ebx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x2c3c]
jl 0x10011560
cmp dword [edi + 8], 0
je 0x10011590
mov edi, dword [edi]
dec edi
jmp 0x10011592
xor edi, edi
mov eax, dword [esi + 0x2c38]
mov ebx, 0x1007acbc
mov ecx, dword [ebp - 8]
test eax, eax
mov edx, 0x10076804
cmovne ebx, eax
call fcn.10002a20
mov esi, eax
test esi, esi
je 0x100115ca
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001f770
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov dword [0x1007b188], 0x10054480
mov ecx, 0x10054490
mov dword [0x1007b190], edi
mov dword [0x1007b194], edi
lea ebx, [edi + 0x286ac]
mov dword [0x1007b18c], ebx
call fcn.1001f350
mov dword [ebp - 0x14], eax
cmp eax, 0x10054490
je 0x1001f7cd
cmp dword [0x1007b194], ebx
ja 0x1001f93e
mov ecx, eax
mov esi, eax
call fcn.1001f350
mov dword [ebp - 0x14], eax
cmp eax, esi
jne 0x1001f7b1
cmp byte [eax], 5
jne 0x1001f93e
cmp byte [eax + 1], 0xfa
jne 0x1001f93e
cmp dword [0x1007b194], ebx
jne 0x1001f93e
mov dword [ebp - 0x10], 0x286ac
mov ecx, 1
xor esi, esi
mov dword [ebp - 4], 0x11bc
mov dword [ebp - 0xc], edi
xor ebx, ebx
movzx eax, byte [edi]
mov edx, edi
add ecx, eax
sub edx, dword [ebp - 0xc]
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
add edx, 0xf
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
add ebx, 8
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
add edi, 8
mov eax, dword [ebp - 4]
add esi, ecx
cmp edx, eax
jb 0x1001f806
xor edx, edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], 0
cmp ebx, eax
jae 0x1001f8cd
sub eax, ebx
cmp eax, 2
jb 0x1001f8b9
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov esi, ebx
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add ebx, ecx
add edi, 2
add ecx, eax
add esi, ecx
sub edx, 1
jne 0x1001f887
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0x1c]
cmp eax, dword [ebp - 4]
jae 0x1001f8c5
movzx eax, byte [edi]
mov edx, dword [ebp - 8]
add ecx, eax
add esi, ecx
inc edi
jmp 0x1001f8c8
movzx eax, byte [edi]
mov ebx, edx
add ecx, eax
add esi, ecx
inc edi
jmp 0x1001f8c8
mov edx, dword [ebp - 8]
lea eax, [edx + ebx]
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0x15b0
jne 0x1001f801
mov edi, dword [ebp - 0x14]
shl esi, 0x10
add esi, ecx
movzx edx, byte [edi + 2]
movzx eax, byte [edi + 3]
shl edx, 8
add edx, eax
movzx eax, byte [edi + 4]
shl edx, 8
add edx, eax
movzx eax, byte [edi + 5]
shl edx, 8
add edx, eax
cmp esi, edx
jne 0x1001f93e
pop edi
pop esi
mov eax, 0x286ac
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034a60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xorps xmm0, xmm0
push esi
push edi
xor esi, esi
mov dword [ebp - 0x30], edx
mov edi, 0x20000000
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], esi
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0xc], esi
movq qword [ebp - 0x14], xmm0
mov dword [ebp - 0x28], edi
nop dword [eax + eax]
push 0x1c
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10034b7f
cmp dword [ebp - 0x14], 0x1000
jne 0x10034b7f
cmp dword [ebp - 0x10], 1
je 0x10034b7f
lea eax, [ebp - 8]
push eax
push 0x40
push dword [ebp - 0x18]
push dword [ebp - 0x24]
call ebx
test eax, eax
je 0x10034b7f
mov edx, dword [ebp - 0x30]
mov esi, edx
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10034af0
mov eax, dword [ebp - 0x18]
sub esi, ecx
xor ebx, ebx
mov dword [ebp - 0x34], esi
sub eax, esi
mov dword [ebp - 0x38], eax
je 0x10034b67
xor eax, eax
test esi, esi
je 0x10034b42
mov ecx, dword [ebp - 0x2c]
mov edi, edx
sub edi, ecx
add ecx, eax
cmp byte [edi + ecx], 0x3f
je 0x10034b2d
mov esi, dword [ebp - 0x28]
lea edx, [eax + ebx]
mov cl, byte [ecx]
cmp cl, byte [edx + esi]
mov esi, dword [ebp - 0x34]
jne 0x10034b37
inc eax
cmp eax, esi
jae 0x10034b42
mov ecx, dword [ebp - 0x2c]
jmp 0x10034b15
inc ebx
cmp ebx, dword [ebp - 0x38]
jae 0x10034b64
mov edx, dword [ebp - 0x30]
jmp 0x10034b08
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov eax, dword [ebp - 0x18]
push eax
push dword [ebp - 0x24]
lea esi, [ebx + edi]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
test esi, esi
jne 0x10034b91
jmp 0x10034b7f
mov edi, dword [ebp - 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov eax, dword [ebp - 0x18]
xor esi, esi
push eax
push dword [ebp - 0x24]
call ebx
add edi, dword [ebp - 0x18]
mov dword [ebp - 0x28], edi
cmp edi, 0xa0000000
jb 0x10034aa0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004edb4
mov esp, ebp
pop ebp
ret
Function at 0x1004e170
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1004e19d
sub eax, 1
jne 0x1004e20d
push eax
push eax
push eax
push 0x1004ddb0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
push esi
push 0x100348c0
push 0xfffffffffffffffc
push dword [0x1007ae34]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x1007b1a8], 0
call fcn.100205e0
mov esi, dword [0x1007acc0]
mov ecx, esi
mov dword [0x1007b1a0], 0
call fcn.10006340
mov eax, dword [0x1007acc0]
xor ecx, ecx
cmp eax, esi
cmove eax, ecx
mov dword [0x1007acc0], eax
test esi, esi
je 0x1004e20c
mov ecx, esi
call fcn.100124f0
mov eax, dword [0x1007acc0]
test eax, eax
je 0x1004e202
dec dword [eax + 0x394]
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop esi
mov eax, 1
pop ebp
ret 0xc

Function at 0x1004e220
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
lea esi, [eax + ecx]
lea edx, [eax + 0x11]
inc eax
xor byte [esi], dl
cmp eax, 5
jb 0x1004e223
mov byte [ecx + 5], 0
mov eax, ecx
pop esi
ret

Function at 0x1004e280
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
lea esi, [eax + ecx]
lea edx, [eax + 0x11]
inc eax
xor byte [esi], dl
cmp eax, 0x12
jb 0x1004e283
mov byte [ecx + 0x12], 0
mov eax, ecx
pop esi
ret

Function at 0x1004e350
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
lea esi, [eax + ecx]
lea edx, [eax + 0x11]
inc eax
xor byte [esi], dl
cmp eax, 0xf
jb 0x1004e353
mov byte [ecx + 0xf], 0
mov eax, ecx
pop esi
ret

Function at 0x1004e410
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
lea esi, [eax + ecx]
lea edx, [eax + 0x11]
inc eax
xor byte [esi], dl
cmp eax, 0x11
jb 0x1004e413
mov byte [ecx + 0x11], 0
mov eax, ecx
pop esi
ret

Function at 0x1004e680
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
lea esi, [eax + ecx]
lea edx, [eax + 0x11]
inc eax
xor byte [esi], dl
cmp eax, 0xb
jb 0x1004e683
mov byte [ecx + 0xb], 0
mov eax, ecx
pop esi
ret

Function at 0x1004e720
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
lea esi, [eax + ecx]
lea edx, [eax + 0x11]
inc eax
xor byte [esi], dl
cmp eax, 7
jb 0x1004e723
mov byte [ecx + 7], 0
mov eax, ecx
pop esi
ret

Function at 0x1004e790
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
lea esi, [eax + ecx]
lea edx, [eax + 0x11]
inc eax
xor byte [esi], dl
cmp eax, 9
jb 0x1004e793
mov byte [ecx + 9], 0
mov eax, ecx
pop esi
ret

Function at 0x1004e810
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
lea esi, [eax + ecx]
lea edx, [eax + 0x11]
inc eax
xor byte [esi], dl
cmp eax, 4
jb 0x1004e813
mov byte [ecx + 4], 0
mov eax, ecx
pop esi
ret

Function at 0x1004e870
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
lea esi, [eax + ecx]
lea edx, [eax + 0x11]
inc eax
xor byte [esi], dl
cmp eax, 3
jb 0x1004e873
mov byte [ecx + 3], 0
mov eax, ecx
pop esi
ret
Function at 0x1004e8c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
lea esi, [eax + ecx]
lea edx, [eax + 0x11]
inc eax
xor byte [esi], dl
cmp eax, 6
jb 0x1004e8c3
mov byte [ecx + 6], 0
mov eax, ecx
pop esi
ret

Function at 0x1004eca0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100533bd
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1007a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.1004f481
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x1004ed60
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x1004ed22
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004edb4
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1004ff50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10050100
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1005001d
mov edx, dword [ebp - 4]
cmp edx, dword [0x1007a014]
jb 0x1004ff9a
mov eax, dword [ebp - 4]
cmp eax, dword [0x1007a018]
ja 0x1004ff9a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004ff6a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1004ffc0
jmp 0x1005001d
cmp dword [ebp - 0x14], 0x10000
jne 0x10050003
cmp dword [ebp - 0x18], 0x10000
jb 0x10050003
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004fff6
mov eax, dword [ebp - 8]
jmp 0x1005001f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10050018
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10050100
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004ff6a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10050030
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10050130
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100500f5
mov edx, dword [ebp - 4]
cmp edx, dword [0x1007a014]
jb 0x10050075
mov eax, dword [ebp - 4]
cmp eax, dword [0x1007a018]
ja 0x10050075
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10050045
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1005009b
jmp 0x100500f5
cmp dword [ebp - 0x14], 0x10000
jne 0x100500de
cmp dword [ebp - 0x18], 0x10000
jb 0x100500de
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100500d1
mov eax, dword [ebp - 8]
jmp 0x100500f7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x100500f0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10050130
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10050045
xor eax, eax
mov esp, ebp
pop ebp
ret