joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d24f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001d2ec
push ebx
push esi
call fcn.1001d218
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001d1ac
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001d299
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d2eb
push edi
push eax
call fcn.1001e20a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001d2b9
call fcn.1001bcf4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001d2ea
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001d1ac
add esp, 0x20
test eax, eax
jne 0x1001d2d8
push edi
call fcn.1001bcf4
jmp 0x1001d2e0
push ebx
call fcn.1001bcf4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001d559
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024cc8
push 0x10024cc0
push str.FlsAlloc
push 0x1f
call fcn.1001d475
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d58d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10023150]
call esi
jmp 0x1001d593
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001d5d7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024cd8
push 0x10024cd0
push str.FlsGetValue
push 0x21
call fcn.1001d475
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d60e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10023150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001d616
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10024ce0
push 0x10024cd8
push str.FlsSetValue
push 0x22
call fcn.1001d475
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001d650
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10023150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10022cd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10022cfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10022cfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1002bbf0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x1002bd52
cmp edi, esi
je 0x1002bd52
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x1002bd42
add edi, 4
jmp 0x1002bca3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x1002bcb8
mov dword [ebp - 4], 2
jmp 0x1002bcd9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x1002bccf
mov dword [ebp - 4], 1
jmp 0x1002bcd9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x1002bd52
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x1002bd10
mov byte [ecx + 2], 0x3d
jmp 0x1002bd1d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x1002bd2c
mov byte [ecx], 0x3d
jmp 0x1002bd32
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x1002bca0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100cdec3
Capabilities:
Encode data using xor

Disassembly:
or ebp, 0x23534cf7
add dword [esp], 0xefcd402b
and eax, dword [ecx + 0x2b002444]
inc eax
int 0xef
mov ebp, dword [esp + 4]
push dword [esp + 8]
popfd
lea esp, [esp + 0xc]
call fcn.10334f36
sub al, 0x54
xchg esp, eax
in al, dx
xor dh, byte [esi]
sub dh, ch
xor byte [esi + eax], dh
mov esi, 0x325a132b
jp 0x100cdec8
xor bh, byte [edx - 0x2d]
in al, dx
je 0x100cdef2
int 0xc4
xor byte [edx], ch
ljmp 0xb528
Function at 0x101cc8e3
Capabilities:
Encode data using xor

Disassembly:
setl byte [esp + 0x4c]
add byte [esp + 0x4c], 0x8f
neg dword [esp + 0x44]
mov ebx, dword [esp + 0x24]
add dword [esp + 4], 0xefcd6194
add dword [esp + 0x18], 0xefcc2f3f
call fcn.1009ac14
add bl, bl
invalid
mov edi, 0x39e952ca
xor al, 0x32
fstp qword [edi + 0x2a]
and ah, byte [0x4d26465d]
invalid
jo 0x1006ba6b
xchg dword [esp + 0x24], ecx
movzx edx, dx
sub byte [esp + 0x14], dh
movsx edx, dx
jns 0x103bf106
imul ebx, dword [esi + 0x1b], 0xfffffff7
pushal
jge 0x101cc94b
mov dh, 0xd4
je 0x101cc8a4
adc al, 0xd4
or byte [esi + 0x2b0a80bc], bl
cmp byte [esp + eax*2 + 0x60f2d4f2], bh
in eax, 8
push 0xab4c094c
add eax, 0x77298b92
pop edx
arpl word [eax], bx
and eax, 0xb53ed6f7
ret 0x80d4
sub al, 0x33
xor al, 0x25
nop
push edx
pop edi
call 0xe5237763
cmp ecx, ecx
je 0x101cc9cf
out 0x6f, al
xor al, 0x32
iretd
pop esi
cmp ebp, dword [ebx + 0x455482f9]
xor ch, dh
add bh, al
clc
sbb al, 0x9d
adc ah, byte [ecx]
stosb byte es:[edi], al
sub ch, cl
push es
std
cmp cl, bh
mov bh, 0xd5
fdivp st(0)
std
mov dh, 0x64
and dword [esp + ebp], esi
in eax, 6
std
out 0x38, al
jno 0x101cc9c4
fiadd word [eax + 0x3e]
dec edi
lcall 0x4265, 0xc567b390
adc edx, dword [ebp + 0x3e]
mov cl, byte [edi + 0x605ee2f5]
les ecx, [edi]
or bl, byte [edx - 0x7293dde1]
aas
jns 0x101cca3f
iretd
push 0xffffffffffffffda
invalid
not dl
xor dl, dh
movsx dx, dx
add dword [esp], 0xefc5b08d
mov edx, dword [esp + 0x20]
neg word [esp + 0x14]
add word [esp + 0x14], 0x7576
test byte [esp + 0x14], 0x10
push dword [esp + 0x18]
popfd
lea esp, [esp + 0x24]
ret 4

Function at 0x101d917f
Capabilities:
Encode data using xor

Disassembly:
call fcn.10201591
sets byte [edi + 0x47]
mov ebx, 0x64fbd46b
sbb ah, byte [ecx + 0x59b89e56]
pop eax
lds edx, [edx + 0x6805ed38]
jne 0x101d91b7
mov dword [0xc7613829], eax
cmp eax, edi
inc edx
mov dl, 0xe4
and eax, ecx
inc ebx
add ebx, dword [ebx]
fldcw word [edi + 0x65]
neg dword [edi - 0x2c]
push 0xfffffffffffffff8
xor dword [eax + 0x5ff8d4d7], esi
clc
pop edi
in eax, dx
sub esi, dword [eax - 0x2f]
jnp 0x101d91b3
mov ebx, 0xe95f94a
lcall 0x5806, 0x75fcf25f
out dx, eax
and dl, cl
pop edi
mov edi, 0x6681b35e
cdq
jl 0x101d91df
not bl
pushal
mov al, byte [0x4a7fd1de]
dec edx
daa
push ecx
mov ecx, 0x645938bc
dec edx
dec edx
pop es
fistp dword [edx]
outsb dx, byte [esi]
sbb eax, 0x60f78373
stc
pushfd
retf 0x9c23
Function at 0x1027329d
Capabilities:
Encode data using xor

Disassembly:
pushfd
add dword [esp + 4], 0xeff504e9
mov dword [esp + 4], 0x6fbe9b48
push esi
mov esi, 0x6f5d4237
sub esi, 0x719e20ef
call fcn.10115a31
sub edi, dword [edx + 0x3a]
pop ss
add dword [esi - 0x24], edi
stc
push 0xe40fbd62
test al, 0xd9
cmp byte [0xc11d5704], al
xor eax, 0xb892573a
sub esp, edx
test al, 0xde
mov ebx, 0x4e8ce7e
invalid

Function at 0x102b5a1b
Capabilities:
Encode data using xor

Disassembly:
sub si, 0x1fa9
mov dword [esp + 0x1c], ebx
neg ecx
push edi
push edx
add dword [esp + 8], 0xffdcd295
mov edx, 0x2a9718b7
cmp edx, 0x14054d4
push ebp
push 0xff64967
mov ebp, 0x794f04cb
call int.100d39d5
mov ah, 0x8c
mov ebx, dword [edx + edi*8 + 0x2f39f609]
mov ecx, dword [ecx + 0x5e]
cmp byte [ecx], dh
mov dl, 0x37
aad 0xe0
xor dl, bh
lodsb al, byte [esi]
test al, 0xca
mov es, word [0xf29f71b]
pop edi
popfd
xor al, 0x38
push ecx
loope 0x102b5a54
invalid
Function at 0x103236e3
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x155bac
xor dl, byte [esp + 0xd]
or edx, dword [esp + 0xc]
and byte [esp + 0x10], 0xaa
lea edx, [edx + 0x2ff31a8c]
not dx
mov dword [esp + 8], esi
mov dword [esp + 8], 0x3fef58be
setbe byte [esp + 8]
mov ebx, dword [esp]
mov ebx, dword [ebx]
call fcn.1040ad25
in eax, dx
test dword [edx + 0x4e], edx
inc ebx
inc ebp
in eax, dx
xor dword [edx + 0x989895c], ecx
mov bl, dh
mov ss, word [eax - 0xe04751a]
and esp, esp
jne 0x103236fe
dec ecx
hlt

Function at 0x103fd1a0
Capabilities:
Access peb ldr_data

Disassembly:
mov esi, dword [esp + 0x10]
and word [esp + 0x10], si
cmp esi, edx
mov esi, dword [esp + 0xc]
cmovl dx, word [esp + 0x11]
not dl
movzx edx, dl
mov edx, dword [esp + 0x18]
neg byte [esp + 0x10]
mov ebx, 0x4c8e2b47
neg bx
neg bx
add dword [esp], 0xefe78d40
mov ebx, dword [esp + 8]
test dword [esp + 0x10], 0x105e3cb6
mov word [esp + 0x10], 0x6723
call fcn.103bf696

Function at 0x10417f2c
Capabilities:
Encode data using xor

Disassembly:
jmp fcn.103011ea
call fcn.1026cc16
push 0x13046109
pushfd
sub byte [esp + 4], 0x16
xor byte [esp + 4], 0x39
mov byte [esp + 4], 0x14
mov dword [esp + 4], 0x6ffce617
jbe 0x10417f31
call fcn.103954d9
stc
not ecx
cmc
neg ecx
stc
rol ecx, 1
bswap ecx
xor ebx, ecx
add esi, ecx
jmp 0x1039c97b

Function at 0x1042f874
Capabilities:
Encode data using xor

Disassembly:
call fcn.101b8fe1
adc eax, 0xc2ad91f1
xor eax, 0x7d41724d
sal dword [edx - 0x72], cl
jo 0x1042f8cc
rol dword [edi], cl
sbb ah, ah
sbb ecx, dword [esi - 0x62]
add cl, byte [edx + 0x18]
mov dh, 0xa8
jmp 0x634eba63
or byte [eax - 0x58], dl
lcall 0xe870, 0x51e11208
loope 0x1042f929
xor eax, 0xe1ef54
neg dword [eax]
wait
invalid
pop ss
cmc
mov cs, word [esi - 0x73]
ret
Function at 0x412281
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x412290
pop dword [ebp - 0x18]
mov eax, 0x2b287610
sub eax, 0x2ae75380
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3a93e
push 0
mov eax, 0x23f7ec9b
sub eax, 0x23b55c6f
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x4e20
mov ebx, eax
mov edx, 0x436e00
add edx, dword [ebp - 0x18]
mov edi, 0x304e2d
add edi, 0x5f4b2a95
add dword [ebp - 8], 0x819a26e4
mov esi, dword [edx]
add dword [ebp - 0x14], 0xd6a76c51
xor esi, edi
xor dword [ebp - 0x10], 0xf062aac
mov dword [ebx], esi
mov dword [ebp - 0xc], 0xba897c4f
add ebx, 0x3ff8058f
add ebx, 0xc007fa75
add edx, 0xcf798be3
add edx, 0x30867421
loop 0x4122e3
add eax, 0x2a3baa21
add eax, 0xd5c58132
mov ebx, eax
add eax, 0xe11ac49f
add eax, 0x1ee53b66
mov ecx, 0x98c92d5b
add ecx, 0x6776d2a5
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x10001074
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100010ab
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x100010ab
test eax, eax
je 0x100010ab
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
test eax, eax
je 0x100010ab
push eax
push dword [ebp + 0xc]
call fcn.1000789a
pop ecx
pop ecx
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
pop ebp
ret

Function at 0x10003361
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push 0x50
xor ebx, ebx
push ebx
mov esi, 0x100a3048
push esi
call fcn.10044b80
add esp, 0xc
cmp dword [0x100a1bf8], ebx
jne 0x10003385
xor eax, eax
jmp 0x1000343b
test byte [0x1014f600], 1
je 0x1000337e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x100a1c04]
add ecx, 0xbb8
cmp ecx, eax
jbe 0x100033ae
xor eax, eax
jmp 0x1000343a
call edi
push 0x50
push ebx
push esi
mov dword [0x100a1c04], eax
call fcn.10044b80
add esp, 0xc
push dword [0x10184a50]
push 0x1000317b
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esi]
cmp eax, ebx
je 0x100033ed
cmp byte [0x102d2d92], bl
jne 0x100033f8
push ebx
push 0x1000325f
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
add esi, 4
cmp esi, 0x100a3070
jl 0x100033d2
push dword [0x100a1c00]
push str.tc_OLonSend
push str.SOFTWARE_trueEP_tc_Env
push reloc.WS2_32.dll_bind
call fcn.10041961
add esp, 0x10
cmp dword [0x1015568c], ebx
je 0x10003437
push dword [0x100a1c00]
push dword [0x100a1c04]
push str.isUISend___d___d_
push ebx
call fcn.1004122a
add esp, 0x10
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
Function at 0x10008d4a
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
xor ecx, ecx
xor edi, edi
mov dword [ebp + 8], edx
cmp byte [edx], al
je 0x10008ddd
push ebx
mov edx, dword [ebp + 8]
movsx edx, byte [edx]
mov ebx, dword [edx*4 + 0x10077068]
cmp ebx, 0xffffffff
je 0x10008dd1
mov edx, edi
sub edx, 0
je 0x10008dcc
dec edx
je 0x10008db1
dec edx
je 0x10008d97
dec edx
jne 0x10008dcf
cmp eax, dword [ebp + 0x10]
jge 0x10008d93
shl cl, 6
or cl, bl
mov byte [eax + esi], cl
inc eax
xor edi, edi
jmp 0x10008dcf
cmp eax, dword [ebp + 0x10]
jge 0x10008dad
mov edx, ebx
sar edx, 2
and dl, 0xf
shl cl, 4
or dl, cl
mov byte [eax + esi], dl
inc eax
push 3
jmp 0x10008dc9
cmp eax, dword [ebp + 0x10]
jge 0x10008dc7
mov edx, ebx
sar edx, 4
and dl, 3
shl cl, 2
or dl, cl
mov byte [eax + esi], dl
inc eax
push 2
pop edi
jmp 0x10008dcf
xor edi, edi
inc edi
mov ecx, ebx
inc dword [ebp + 8]
mov edx, dword [ebp + 8]
cmp byte [edx], 0
jne 0x10008d63
pop ebx
pop edi
mov byte [eax + esi], 0
pop esi
pop ebp
ret
Function at 0x1000cd51
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x1015568c], 0
je 0x1000cd75
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.try_MyDetourCreateProcessWithDllExW_lpApplicationName__ls__lpCommandLine__ls_
push 0
call fcn.1004122a
add esp, 0x10
push ebx
mov ebx, dword [ebp + 0x38]
push esi
push edi
test ebx, ebx
jne 0x1000cd85
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [ebp + 0x2c]
test esi, esi
jne 0x1000cd97
lea esi, [ebp - 0x14]
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
push esi
push dword [ebp + 0x28]
or eax, 4
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x1000cdc4
xor eax, eax
jmp 0x1000ce8b
mov eax, dword [ebp + 0x34]
mov dword [ebp - 4], eax
test esi, esi
je 0x1000ce0d
mov eax, dword [esi]
test eax, eax
je 0x1000ce0d
cmp byte [0x1015088b], 0
je 0x1000ce0d
push eax
call fcn.1002c3f8
pop ecx
test eax, eax
jne 0x1000ce0d
push 0xffffffffffffffff
push dword [esi]
call dword [0x10186978]
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
jmp 0x1000cdbd
push 1
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.10058610
test eax, eax
jne 0x1000ce2e
push ebx
push dword [ebp - 4]
push dword [esi + 8]
call fcn.1005a170
test eax, eax
je 0x1000cde8
cmp dword [0x1015568c], 0
je 0x1000ce4f
push dword [esi + 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Success_MyDetourCreateProcessWithDllExW_lpApplicationName__ls__lpCommandLine__ls__hThread__08x_
push 0
call fcn.1004122a
add esp, 0x14
test byte [ebp + 0x1c], 4
je 0x1000ce69
mov eax, dword [esi + 4]
mov dword [0x10150838], eax
mov dword [0x1015083c], 0x20394853
jmp 0x1000ce72
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x14]
cmp esi, eax
jne 0x1000ce88
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x34
Function at 0x1000ce92
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x1015568c], ebx
je 0x1000ceb9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.try_MyDetourCreateProcessInternalWithDllExW_lpApplicationName__ls__lpCommandLine__ls_
push ebx
call fcn.1004122a
add esp, 0x10
mov esi, dword [ebp + 0x30]
mov ecx, dword [0x10186960]
cmp esi, ebx
jne 0x1000ced1
lea esi, [ebp - 0x14]
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push dword [ebp + 0x34]
mov eax, dword [ebp + 0x20]
push esi
push dword [ebp + 0x2c]
or eax, 4
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x1000cf04
xor eax, eax
jmp 0x1000cfb8
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 4], eax
cmp esi, ebx
je 0x1000cf4c
mov eax, dword [esi]
cmp eax, ebx
je 0x1000cf4c
cmp byte [0x1015088b], bl
je 0x1000cf4c
push eax
call fcn.1002c3f8
pop ecx
test eax, eax
jne 0x1000cf4c
push 0xffffffffffffffff
push dword [esi]
call dword [0x10186978]
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
jmp 0x1000cefd
push 1
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.10058610
test eax, eax
je 0x1000cf27
cmp dword [0x1015568c], ebx
je 0x1000cf7c
push dword [esi + 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.Success_MyDetourCreateProcessInternalWithDllExW_lpApplicationName__ls__lpCommandLine__ls__hThread__08x_
push ebx
call fcn.1004122a
add esp, 0x14
test byte [ebp + 0x20], 4
je 0x1000cf96
mov eax, dword [esi + 4]
mov dword [0x10150838], eax
mov dword [0x1015083c], 0x20394853
jmp 0x1000cf9f
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x14]
cmp esi, eax
jne 0x1000cfb5
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x3c
Function at 0x1000cfbf
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x1015568c], ebx
je 0x1000cfe6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.try_MyDetourCreateProcessInternalWithDllExW_lpApplicationName__ls__lpCommandLine__ls_
push ebx
call fcn.1004122a
add esp, 0x10
mov esi, dword [ebp + 0x30]
mov ecx, dword [0x10186964]
cmp esi, ebx
jne 0x1000cffe
lea esi, [ebp - 0x14]
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push dword [ebp + 0x34]
mov eax, dword [ebp + 0x20]
push esi
push dword [ebp + 0x2c]
or eax, 4
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x1000d031
xor eax, eax
jmp 0x1000d0e5
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 4], eax
cmp esi, ebx
je 0x1000d079
mov eax, dword [esi]
cmp eax, ebx
je 0x1000d079
cmp byte [0x1015088b], bl
je 0x1000d079
push eax
call fcn.1002c3f8
pop ecx
test eax, eax
jne 0x1000d079
push 0xffffffffffffffff
push dword [esi]
call dword [0x10186978]
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
jmp 0x1000d02a
push 1
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.10058610
test eax, eax
je 0x1000d054
cmp dword [0x1015568c], ebx
je 0x1000d0a9
push dword [esi + 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.Success_MyDetourCreateProcessInternalWithDllExA_lpApplicationName__ls__lpCommandLine__ls__hThread__08x_
push ebx
call fcn.1004122a
add esp, 0x14
test byte [ebp + 0x20], 4
je 0x1000d0c3
mov eax, dword [esi + 4]
mov dword [0x10150838], eax
mov dword [0x1015083c], 0x20394853
jmp 0x1000d0cc
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x14]
cmp esi, eax
jne 0x1000d0e2
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x3c
Function at 0x1000d0ec
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x1015568c], 0
je 0x1000d110
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.try_MyDetourCreateProcessWithDllExA_lpApplicationName__s__lpCommandLine__s_
push 0
call fcn.1004122a
add esp, 0x10
push ebx
mov ebx, dword [ebp + 0x38]
push esi
push edi
test ebx, ebx
jne 0x1000d120
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, dword [ebp + 0x2c]
test esi, esi
jne 0x1000d132
lea esi, [ebp - 0x14]
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
push esi
push dword [ebp + 0x28]
or eax, 4
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x1000d15f
xor eax, eax
jmp 0x1000d226
mov eax, dword [ebp + 0x34]
mov dword [ebp - 4], eax
test esi, esi
je 0x1000d1a8
mov eax, dword [esi]
test eax, eax
je 0x1000d1a8
cmp byte [0x1015088b], 0
je 0x1000d1a8
push eax
call fcn.1002c3f8
pop ecx
test eax, eax
jne 0x1000d1a8
push 0xffffffffffffffff
push dword [esi]
call dword [0x10186978]
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
jmp 0x1000d158
push 1
lea eax, [ebp - 4]
push eax
push dword [esi]
call fcn.10058610
test eax, eax
jne 0x1000d1c9
push ebx
push dword [ebp - 4]
push dword [esi + 8]
call fcn.10059b00
test eax, eax
je 0x1000d183
cmp dword [0x1015568c], 0
je 0x1000d1ea
push dword [esi + 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Success_MyDetourCreateProcessWithDllExA_lpApplicationName__s__lpCommandLine__s__hThread__08x_
push 0
call fcn.1004122a
add esp, 0x14
test byte [ebp + 0x1c], 4
je 0x1000d204
mov eax, dword [esi + 4]
mov dword [0x10150838], eax
mov dword [0x1015083c], 0x20394853
jmp 0x1000d20d
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x14]
cmp esi, eax
jne 0x1000d223
push dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 4]
call edi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x34