joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x10096410]
xor eax, eax
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x18], 0x4e546852
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0x585d59
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0x16
jb 0x10024ba6
mov byte [ebp - 0x10], 0x45
mov al, 0x2b
xor al, byte [ebp - 0x10]
mov bl, 0x29
mov ah, bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x10]
mov dl, 0x21
mov bh, ah
mov byte [ebp - 1], ah
xor bl, al
mov byte [ebp - 6], 0
xor ah, al
mov byte [ebp - 0x11], 0
xor bh, al
mov byte [ebp - 0xb], ah
mov dh, dl
mov byte [ebp - 0xc], bl
xor dl, al
mov byte [ebp - 8], bh
xor dh, al
mov byte [ebp - 0xd], dl
mov cl, 0x31
mov byte [ebp - 9], dh
xor cl, al
mov byte [ebp - 6], 0
mov ch, 0x6b
mov byte [ebp - 0xe], cl
xor ch, al
mov al, byte [ebp - 1]
xor al, byte [ebp - 0x10]
mov byte [ebp - 7], al
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0xf]
mov byte [ebp - 0xa], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x10024c2f
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x11
test esi, esi
jne 0x10024c4e
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
test eax, eax
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call edi
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10024c60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x10024c9e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10024ca2
cmp edx, esi
jne 0x10024c87
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10024cc2
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10024cc6
cmp edx, esi
jne 0x10024cab
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10024ce6
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10024cea
cmp edx, esi
jne 0x10024ccf
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b3e0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
mov eax, dword [0x100a1084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
test eax, eax
je 0x1002631e
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esi + 0x20], 1
mov word [esi + 0x28], ax
call fcn.10026780
movaps xmm0, xmmword [0x10095ed0]
xor ecx, ecx
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], 0x11117a01
mov dword [ebp - 0x34], 0x7c11111b
mov byte [ebp - 0x30], 0
nop
mov al, byte [ebp - 0x48]
xor byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0x17
jb 0x100261c0
cmp byte [ebp - 0x47], 0
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
jne 0x100261ed
xor ecx, ecx
jmp 0x100261fc
lea ecx, [ebp - 0x47]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100261f3
sub ecx, edx
push ecx
lea eax, [ebp - 0x47]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100028b0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x2c]
mov ecx, dword [esi + 0xc]
call fcn.10015b30
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x10026231
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.10002790
cmp dword [ebp + 0x1c], 0
jne 0x100262ad
mov byte [ebp - 0x20], 0x2b
mov al, 0x78
xor al, byte [ebp - 0x20]
mov cl, 0x42
xor cl, byte [ebp - 0x20]
mov dl, 0x4e
mov byte [ebp - 0x1f], al
mov ah, dl
mov byte [ebp - 0x1e], cl
mov ch, 0xb
mov cl, byte [ebp - 0x20]
mov dh, 0x68
mov byte [ebp - 0x11], 0x4a
xor ah, cl
mov al, byte [ebp - 0x11]
xor ch, cl
xor al, cl
mov byte [ebp - 0x12], 0x45
mov byte [ebp - 0x17], al
mov bl, 0x4c
mov al, byte [ebp - 0x12]
mov bh, 0x47
xor al, cl
mov byte [ebp - 0x1b], ah
mov byte [ebp - 0x16], al
xor dl, cl
xor bl, cl
mov byte [ebp - 0x1a], ch
xor dh, cl
mov byte [ebp - 0x15], 0
xor bh, cl
mov byte [ebp - 0x1d], dl
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x1c], bl
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x19], dh
mov byte [ebp - 0x18], bh
mov byte [ebp - 0x15], 0
call fcn.100029b0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x48]
jmp 0x10026301
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x10095f10]
cmovae eax, dword [ebp + 0xc]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 0x31
nop dword [eax]
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x10
jb 0x100262d0
sub esp, 0x18
mov byte [ebp - 0x17], 0
lea eax, [ebp - 0x27]
mov ecx, esp
push eax
call fcn.100029b0
lea eax, [ebp - 0x48]
push eax
call fcn.10005a00
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10015b30
mov eax, dword [ebp - 0x34]
cmp eax, 0x10
jb 0x1002631e
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.10002790
mov eax, dword [ebp + 0x20]
cmp eax, 0x10
jb 0x10026333
inc eax
lea ecx, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
call fcn.10002790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x100265b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b468
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x100a1084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ax, word [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [ebp + 0x1c], 0
mov word [esi + 0x28], ax
jne 0x100266a2
mov bh, 0xb
mov byte [ebp - 0x24], 0x6a
mov byte [ebp - 0x12], bh
mov al, 3
xor al, byte [ebp - 0x24]
mov cl, 0xf
mov byte [ebp - 0x11], 0x39
mov bl, cl
mov bh, byte [ebp - 0x11]
mov dl, 0xd
xor bh, byte [ebp - 0x24]
mov ah, 0x4a
mov byte [ebp - 0x11], bh
mov ch, 0x29
mov byte [ebp - 0x22], al
mov dh, 6
mov al, byte [ebp - 0x24]
mov byte [ebp - 0x23], bh
xor cl, al
mov bh, byte [ebp - 0x12]
xor dl, al
xor bl, al
mov byte [ebp - 0x13], 4
xor ah, al
mov byte [ebp - 0x19], 0
xor ch, al
mov byte [ebp - 0x21], cl
xor dh, al
mov byte [ebp - 0x20], dl
xor bh, al
mov byte [ebp - 0x1f], bl
mov al, byte [ebp - 0x13]
xor al, byte [ebp - 0x24]
cmp byte [ebp - 0x11], 0
mov byte [ebp - 0x1e], ah
mov byte [ebp - 0x1d], ch
mov byte [ebp - 0x1c], dh
mov byte [ebp - 0x1b], bh
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x1002667a
xor ecx, ecx
jmp 0x10026689
lea ecx, [ebp - 0x23]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10026680
sub ecx, edx
push ecx
lea eax, [ebp - 0x23]
push eax
lea ecx, [ebp - 0x40]
call fcn.100028b0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
jmp 0x1002672b
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x10095d60]
cmovae eax, dword [ebp + 0xc]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 0x2d
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x10
jb 0x100266c1
sub esp, 0x18
mov byte [ebp - 0x17], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
cmp dword [edx + 0x14], 0x10
jb 0x100266ef
mov eax, dword [edx]
jmp 0x100266f1
mov eax, edx
mov byte [eax], 0
cmp byte [ebp - 0x27], 0
jne 0x100266fe
xor ecx, ecx
jmp 0x1002670d
lea ecx, [ebp - 0x27]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10026704
sub ecx, edi
push ecx
lea eax, [ebp - 0x27]
mov ecx, edx
push eax
call fcn.100028b0
lea eax, [ebp - 0x40]
push eax
call fcn.10005a00
add esp, 0x20
mov byte [ebp - 4], 2
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.10015b30
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x10026748
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.10002790
mov eax, dword [ebp + 0x20]
cmp eax, 0x10
jb 0x1002675d
inc eax
lea ecx, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
call fcn.10002790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10028950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b692
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push esi
push edi
mov eax, dword [0x100a1084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], 0
cmp byte [esi + 0x140], 0
movzx eax, word [esi + 0x144]
movzx ecx, word [esi + 0x136]
push eax
mov word [esi + 0x142], cx
push ecx
je 0x10028a35
movaps xmm0, xmmword [0x10096200]
xor ecx, ecx
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x622f6e63
mov byte [ebp - 0x24], 0
nop dword [eax]
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x13
jb 0x100289c0
sub esp, 0x18
mov byte [ebp - 0x24], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
cmp dword [edx + 0x14], 0x10
jb 0x100289ee
mov eax, dword [edx]
jmp 0x100289f0
mov eax, edx
mov byte [eax], 0
cmp byte [ebp - 0x37], 0
jne 0x100289fd
xor ecx, ecx
jmp 0x10028a0c
lea ecx, [ebp - 0x37]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10028a03
sub ecx, edi
push ecx
lea eax, [ebp - 0x37]
mov ecx, edx
push eax
call fcn.100028b0
lea eax, [ebp - 0x68]
push eax
call fcn.10005a00
add esp, 0x24
mov dword [ebp - 4], 0
mov ebx, 1
jmp 0x10028add
mov byte [ebp - 0x20], 0x46
mov al, 0x63
mov dh, al
mov byte [ebp - 0x17], 0
xor al, byte [ebp - 0x20]
mov dl, 0x66
mov byte [ebp - 0x1f], al
mov ch, dl
mov al, byte [ebp - 0x20]
mov cl, 0x22
xor dl, al
mov byte [ebp - 0x17], 0
xor dh, al
mov byte [ebp - 0x1d], dl
mov byte [ebp - 0x19], dh
sub esp, 0x18
mov edx, esp
mov bh, cl
mov bl, 0x29
mov ah, 0x20
xor cl, al
xor bl, al
xor ah, al
mov byte [ebp - 0x1e], cl
xor ch, al
mov byte [ebp - 0x1c], bl
xor bh, al
mov byte [ebp - 0x1b], ah
mov byte [ebp - 0x1a], ch
mov byte [ebp - 0x18], bh
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
cmp dword [edx + 0x14], 0x10
jb 0x10028a9a
mov eax, dword [edx]
jmp 0x10028a9c
mov eax, edx
mov byte [eax], 0
cmp byte [ebp - 0x1f], 0
jne 0x10028aa9
xor ecx, ecx
jmp 0x10028ab9
lea ecx, [ebp - 0x1f]
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10028ab0
sub ecx, edi
push ecx
lea eax, [ebp - 0x1f]
mov ecx, edx
push eax
call fcn.100028b0
lea eax, [ebp - 0x50]
push eax
call fcn.10005a00
add esp, 0x24
mov dword [ebp - 4], 1
mov ebx, 2
mov ecx, dword [esi + 0xc]
mov edx, eax
mov dword [ebp - 0x10], ebx
call fcn.10015b30
test bl, 2
je 0x10028b19
mov eax, dword [ebp - 0x3c]
and ebx, 0xfffffffd
cmp eax, 0x10
jb 0x10028b07
inc eax
lea ecx, [ebp - 0x50]
push eax
push dword [ebp - 0x50]
call fcn.10002790
mov dword [ebp - 0x3c], 0xf
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x50], 0
test bl, 1
je 0x10028b33
mov eax, dword [ebp - 0x54]
cmp eax, 0x10
jb 0x10028b33
inc eax
lea ecx, [ebp - 0x68]
push eax
push dword [ebp - 0x68]
call fcn.10002790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100391b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007c3a8
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x100a1084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x7c]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x7c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
call fcn.10038f50
lea ecx, [ebp - 0x7c]
call fcn.10039000
push esi
lea ecx, [ebp - 0x7c]
call fcn.100390f0
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x1003925a
inc ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.10002790
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003e245
mov esp, ebp
pop ebp
ret

Function at 0x1003b570
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1003b740
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1003b64d
mov edx, dword [ebp - 4]
cmp edx, dword [0x100a1064]
jb 0x1003b5ba
mov eax, dword [ebp - 4]
cmp eax, dword [0x100a1068]
ja 0x1003b5ba
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003b58a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100568a0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1003b5df
jmp 0x1003b64d
cmp dword [ebp - 0x14], 0x10000
jne 0x1003b633
cmp dword [ebp - 0x18], 0x10000
jb 0x1003b633
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003b616
mov eax, dword [ebp - 8]
jmp 0x1003b64f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1003b626
xor eax, eax
jmp 0x1003b64f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1003b648
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1003b740
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003b58a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003b660
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1003b770
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1003b735
mov edx, dword [ebp - 4]
cmp edx, dword [0x100a1064]
jb 0x1003b6a5
mov eax, dword [ebp - 4]
cmp eax, dword [0x100a1068]
ja 0x1003b6a5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003b675
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.100568a0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x1003b6ca
jmp 0x1003b735
cmp dword [ebp - 0x14], 0x10000
jne 0x1003b71e
cmp dword [ebp - 0x18], 0x10000
jb 0x1003b71e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003b701
mov eax, dword [ebp - 8]
jmp 0x1003b737
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1003b711
xor eax, eax
jmp 0x1003b737
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1003b730
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1003b770
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003b675
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003b7a0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1003bb90
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x100a5268], 0
jne 0x1003b7dd
cmp dword [0x100a5264], 0
je 0x1003b7dd
mov eax, dword [0x100a5264]
mov dword [0x100a5268], eax
cmp dword [0x100a5268], 0
je 0x1003b85a
mov ecx, dword [0x100a5268]
cmp dword [ecx + 8], 0
je 0x1003b85a
mov edx, dword [0x100a5268]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1003b85a
mov ecx, dword [0x100a5268]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1003b85a
mov eax, dword [0x100a5268]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x1003b829
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x1003b830
xor eax, eax
jmp 0x1003b979
mov ecx, dword [0x100a5268]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.100568a0
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x1003b979
mov edx, dword [0x100a5264]
mov dword [0x100a5268], edx
jmp 0x1003b876
mov eax, dword [0x100a5268]
mov ecx, dword [eax + 4]
mov dword [0x100a5268], ecx
cmp dword [0x100a5268], 0
je 0x1003b8b6
cmp dword [0x100a5268], 0
je 0x1003b8b4
mov edx, dword [0x100a5268]
cmp dword [edx + 8], 0
je 0x1003b8b4
mov eax, dword [0x100a5268]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x1003b8b4
mov edx, dword [0x100a5268]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x1003b8b4
jmp 0x1003b80e
jmp 0x1003b868
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1003b980
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1003b977
mov eax, dword [ebp - 0x18]
mov dword [0x100a5268], eax
mov ecx, dword [0x100a5268]
mov dword [ecx], 0x52727464
mov edx, dword [0x100a5268]
mov dword [edx + 8], 0
mov eax, dword [0x100a5268]
mov ecx, dword [0x100a5264]
mov dword [eax + 4], ecx
mov edx, dword [0x100a5268]
mov dword [0x100a5264], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x100a5268]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x1003b947
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x1003b967
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x1003b93e
mov eax, dword [0x100a5268]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1003b80e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003c6c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100a5264]
mov dword [ebp - 4], eax
jmp 0x1003c6d9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1003c700
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1003c6fe
call sub.KERNEL32.dll_GetLastError
jmp 0x1003c702
jmp 0x1003c6d0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003cba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100a5274], eax
je 0x1003cbc4
mov eax, 0x10dd
jmp 0x1003cd6c
cmp dword [0x100a5278], 0
je 0x1003cbd7
mov eax, dword [0x100a5278]
jmp 0x1003cd6c
cmp dword [ebp + 0xc], 0
jne 0x1003cbe7
mov eax, 0x57
jmp 0x1003cd6c
cmp dword [ebp + 8], 0
jne 0x1003cbf7
mov eax, 6
jmp 0x1003cd6c
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1003cc20
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x100a5278], ecx
mov edx, dword [ebp + 8]
mov dword [0x100a527c], edx
mov eax, dword [ebp - 8]
jmp 0x1003cd6c
push 0x18
call fcn.1003e256
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003cc7b
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x100a5278], ecx
cmp dword [ebp - 4], 0
je 0x1003cc6a
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.1003e813
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x100a527c], ecx
mov eax, dword [ebp - 8]
jmp 0x1003cd6c
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.1003cb80
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1003cb80
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1003ccbb
cmp dword [ebp - 0xc], 0x1e
jbe 0x1003ccd7
mov dword [ebp - 8], 9
cmp dword [0x100a526c], 0
je 0x1003ccd2
jmp 0x1003cc49
jmp 0x1003cc40
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1003ccfe
mov dword [ebp - 8], 9
cmp dword [0x100a526c], 0
je 0x1003ccf9
jmp 0x1003cc49
jmp 0x1003cc40
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1003cd29
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1003cc40
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x100a5284]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x100a5284], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8