joyce8/EMBER2024-capa huggingface dataset:
Function at 0x530498
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x530598
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0052f560
mov eax, dword [ebp - 0xc]
call fcn.0047d594
mov eax, dword [ebp - 0xc]
call fcn.00403120
call fcn.004030e4
lea eax, [ebp - 8]
mov ecx, 0x5305ac
mov edx, dword [ebp - 0xc]
call fcn.00405444
lea eax, [ebp - 4]
mov ecx, 0x5305c8
mov edx, dword [ebp - 0xc]
call fcn.00405444
mov eax, dword [0x57e214]
mov eax, dword [eax]
mov ebx, dword [eax + 0xc]
cmp ebx, 0xc
je 0x53050a
mov eax, dword [0x57e214]
cmp ebx, 2
jne 0x530523
mov eax, dword [ebp - 8]
call fcn.0040c0d8
test al, al
je 0x530523
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004051d0
jmp 0x53052e
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.004051d0
mov eax, dword [ebp - 4]
call fcn.0047c678
test eax, eax
jne 0x53054c
push 1
mov eax, dword [ebp - 0xc]
call fcn.004055f8
push eax
call sub.kernel32.dll_WinExec
jmp 0x53057d
mov edx, 1
mov eax, 0x5305d8
call fcn.0047d39c
cmp eax, 6
jne 0x53057d
mov eax, dword [ebp - 4]
call fcn.0047c678
call fcn.0047cec0
push 1
mov eax, dword [ebp - 0xc]
call fcn.004055f8
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53059f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040515c
ret

Function at 0x536ef8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x536fd9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00536e1c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x536ff0
call fcn.00405444
mov eax, dword [ebp - 8]
call fcn.0040c0d8
test al, al
jne 0x536f97
mov eax, dword [0x57e214]
mov eax, dword [eax]
cmp dword [eax + 0xc], 0x2b
jne 0x536f61
lea eax, [ebp - 0x10]
call fcn.0047e3c4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x53700c
call fcn.00405444
jmp 0x536f79
lea eax, [ebp - 0x14]
call fcn.0047e3c4
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov ecx, 0x53702c
call fcn.00405444
mov eax, dword [ebp - 4]
call fcn.0040c0d8
test al, al
je 0x536f97
mov eax, dword [0x57dc3c]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0048a1c8
push 0
lea eax, [ebp - 0x18]
mov ecx, 0x53704c
mov edx, dword [ebp - 8]
call fcn.00405444
mov eax, dword [ebp - 0x18]
call fcn.004055f8
push eax
call sub.kernel32.dll_WinExec
mov eax, ebx
call fcn.00534eac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x536fe0
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040515c
ret
Function at 0x53c0e0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x53c229
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
mov edx, 0x53c240
call fcn.0040c648
push 0
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
ja 0x53c154
lea edx, [ebp - 0x130]
mov eax, ebx
call fcn.0053c080
mov ecx, dword [ebp - 0x130]
mov dl, 1
mov eax, dword [0x40a5f0]
call fcn.0040fd04
call fcn.00404a8c
lea eax, [ebp - 0x12c]
xor ecx, ecx
mov edx, 0x2c
call fcn.004039fc
mov dword [ebp - 0x12c], 0x2c
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.user32.dll_GetWindowPlacement
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x53c1ab
lea edx, [ebp - 0x134]
mov eax, ebx
call fcn.0053c080
mov ecx, dword [ebp - 0x134]
mov dl, 1
mov eax, dword [0x40a5f0]
call fcn.0040fd04
call fcn.00404a8c
cmp dword [ebp - 0x110], 0
jle 0x53c1bd
mov byte [ebx + 0x32c], 1
jmp 0x53c1fe
mov eax, dword [0x57e67c]
mov eax, dword [eax]
call fcn.00476620
cmp eax, dword [ebp - 0x108]
jg 0x53c1f7
mov eax, dword [0x57e67c]
mov eax, dword [eax]
call fcn.00476614
cmp eax, dword [ebp - 0x104]
jg 0x53c1ee
mov byte [ebx + 0x32c], 3
jmp 0x53c1fe
mov byte [ebx + 0x32c], 2
jmp 0x53c1fe
mov byte [ebx + 0x32c], 0
lea esi, [ebp - 0x12c]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53c230
lea eax, [ebp - 0x134]
mov edx, 2
call fcn.0040515c
ret

Function at 0x53ffc8
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0053fa68
test byte [ebx + 0x23d], 4
jne 0x54005d
mov edx, esp
mov eax, ebx
call fcn.00457014
push esp
mov eax, ebx
call fcn.0045dc90
push eax
push 0
mov eax, ebx
test eax, eax
je 0x53fffd
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x54002e
mov ecx, dword [0x57def8]
mov dl, 1
mov eax, dword [0x47a644]
call fcn.0040fdc0
call fcn.00404a8c
mov eax, ebx
call fcn.0054059c
cmp byte [ebx + 0x57], 0
jne 0x540064
mov eax, ebx
call fcn.0045de94
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x540064
push 0
mov eax, ebx
call fcn.0045de94
push eax
call sub.user32.dll_ShowWindow
jmp 0x540064
mov eax, ebx
call fcn.0045ae14
add esp, 0x10
pop ebx
ret
Function at 0x5448a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x54499e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov eax, ebx
call fcn.005447b8
test al, al
jne 0x544904
cmp dword [ebx + 4], 0
je 0x5448da
lea eax, [ebx + 4]
call fcn.00411bdc
mov ecx, dword [0x57e214]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x544460]
call fcn.00471254
mov esi, eax
mov dword [ebx + 4], esi
mov eax, esi
call fcn.004755c4
mov eax, dword [ebx + 4]
call fcn.004578d4
jmp 0x544983
mov eax, dword [0x57e1b0]
mov eax, dword [eax]
call fcn.004ed9fc
xor eax, eax
push ebp
push 0x54497c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0047cc94
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x5449b4
call fcn.00405444
mov eax, dword [0x57e1b0]
mov eax, dword [eax]
call fcn.004edbb8
mov eax, dword [ebp - 4]
call fcn.0047c678
call fcn.0047cec0
mov eax, 0x5449c8
call fcn.004b697c
push 1
mov eax, dword [ebp - 4]
call fcn.004055f8
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x544983
call fcn.004b69f8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5449a5
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040515c
ret

Function at 0x54a46c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x54a4d3
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 8]
call fcn.00405784
push edi
mov eax, dword [ebp - 8]
call fcn.004055f8
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040518c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54a4da
lea eax, [ebp - 8]
call fcn.00405138
ret

Function at 0x54ec14
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x54ec9e
xor edx, edx
push ebp
push 0x54ec7f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54ec9e
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x54ffe0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055e8
mov eax, dword [ebp - 8]
call fcn.004055e8
xor eax, eax
push ebp
push 0x5500fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x14
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x3c], 2
mov eax, dword [ebp - 8]
call fcn.004055f8
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 3
mov eax, 0x55010c
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004055f8
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x5500e2
xor eax, eax
push ebp
push 0x5500db
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x4b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x5500bb
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x5500bf
xor eax, eax
jmp 0x5500c1
mov al, 1
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5500e2
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x550104
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040515c
ret
Function at 0x550114
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004055e8
mov eax, dword [ebp - 8]
call fcn.004055e8
mov eax, dword [ebp - 0xc]
call fcn.004055e8
mov eax, dword [ebp + 0xc]
call fcn.004055e8
xor eax, eax
push ebp
push 0x550288
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x2c], 0x14
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x44], 2
mov eax, dword [ebp - 8]
call fcn.004055f8
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 3
mov eax, 0x55029c
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.004055f8
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x550265
xor eax, eax
push ebp
push 0x55025e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.004055f8
push eax
mov eax, dword [ebp - 0xc]
call fcn.004055f8
push eax
mov ax, word [ebp + 8]
push eax
mov eax, dword [ebp - 8]
call fcn.004055f8
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x550247
push ebx
lea eax, [ebp - 0x2c]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x55023e
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x550242
xor eax, eax
jmp 0x550244
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x550265
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55028f
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040515c
lea eax, [ebp + 0xc]
call fcn.00405138
ret
Function at 0x5502a4
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x55036c
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x550370
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x55036c
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x550363
xor eax, eax
push ebp
push 0x55035c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x550363
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x550564
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55077f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.00402ef0
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5505e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x5505cb
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.00405330
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5505e8
mov eax, dword [ebp - 8]
call fcn.00402f20
ret

Function at 0x551a94
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.004039fc
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x551ace
cmp byte [ebp - 0xa], 0x31
jne 0x551acc
mov bl, 1
jmp 0x551ace
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x553110
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0045e198
test al, al
je 0x5531c9
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
jmp 0x5531a7
cmp word [esi + 0x5da], 0
je 0x553161
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5dc]
call dword [esi + 0x5d8]
cmp byte [ebp - 9], 0
jne 0x55317e
cmp dword [ebp - 4], 0
jbe 0x55317a
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x55317e
xor ebx, ebx
jmp 0x553180
mov bl, 1
test bl, bl
jne 0x5531c9
mov eax, dword [0x57e214]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x5531c9
mov eax, dword [0x57e214]
mov eax, dword [eax]
call fcn.00478ae8
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x5531c9
cmp byte [esi + 0x584], 0
jne 0x5531c9
mov edx, 0xfffffdf3
mov eax, esi
call fcn.005403d4
cmp eax, 4
jne 0x55313e
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x55785b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x57d50e
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5578b3
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x57d52f
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x5578a9
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x5578b7
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x10002137
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x100021ea
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x10006729
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x1000674b
mov eax, 0xfffffffd
jmp 0x10006828
mov ebx, dword [0x101f0708]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x100067f6
mov ebx, dword [0x101f0708]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x1000679a
mov ebx, dword [0x101f0708]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x1000679a
mov eax, 1
jmp 0x1000679c
xor eax, eax
test eax, eax
je 0x100067c8
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x100067b1
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x101f0708]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x1000681e
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10006828
mov esp, ebp
pop ebp
ret 4

Function at 0x1000734b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10002137
test eax, eax
je 0x1000738e
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x1000738e
cmp word [eax], 0x5a4d
jne 0x1000738e
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x1000738e
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10002209
mov eax, dword [ebp + 8]
jmp 0x100073a7
mov esp, ebp
pop ebp
ret 4

Function at 0x1001a755
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x1001a78d
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x1001a77b
mov al, 1
jmp 0x1001a7de
cmp dword [ebx + 0x54], ecx
jne 0x1001a784
mov al, 2
jmp 0x1001a7de
cmp dword [ebx + 0x7c], ecx
jne 0x1001a7de
mov al, 3
jmp 0x1001a7de
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x1001a7a2
mov al, 4
jmp 0x1001a7de
cmp ecx, 5
jne 0x1001a7c2
cmp ebx, 0
jne 0x1001a7b0
mov al, 5
jmp 0x1001a7de
cmp ebx, 1
jne 0x1001a7b9
mov al, 6
jmp 0x1001a7de
cmp ebx, 2
jne 0x1001a7c2
mov al, 7
jmp 0x1001a7de
cmp ecx, 6
jne 0x1001a7ce
cmp ebx, 0
jne 0x1001a7d0
mov al, 8
jmp 0x1001a7de
cmp ebx, 1
jne 0x1001a7d7
mov al, 9
cmp ebx, 2
jne 0x1001a7de
mov al, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021afe
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.10021c95
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x10021bfc
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10021b9f
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x10021be2
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x10021bb6
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x10021bd1
test al, 0x40
je 0x10021bc8
mov ecx, dword [edi + 0x20]
jmp 0x10021bcf
test al, 0x80
je 0x10021be2
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x10021be2
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x10021b6e
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x10022c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x10022c95
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x10022c9b
add eax, 4
pop esi
dec esi
push esi
jne 0x10022c7d
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8

Function at 0x10062b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, ecx
test ecx, ecx
je 0x10062b5d
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x10062b2c
cmp word [ecx], ax
je 0x10062b31
jmp 0x10062b20
add ecx, 2
inc eax
cmp word [ecx], 0
jne 0x10062b20
jmp 0x10062b31
mov eax, edx
lea ecx, [ecx + edx*2]
cdq
sub eax, edx
sar eax, 1
sub ecx, 2
test eax, eax
jle 0x10062b5d
lea ecx, [ecx]
mov dx, word [esi]
xor word [ecx], dx
movzx edx, word [ecx]
xor word [esi], dx
movzx edx, word [esi]
xor word [ecx], dx
dec eax
sub ecx, 2
add esi, 2
test eax, eax
jg 0x10062b40
pop esi
pop ebp
ret 8

Function at 0x100e78ad
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test ebx, ebx
je 0x100e78c7
xor dword [ebx], eax
lea ebx, [ebx + 4]
dec ecx
jne 0x100e78bf
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100eea98
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
and eax, 1
leave
ret