joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100268c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x10059248]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x144], 0
xor eax, eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
lea ecx, [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [ebp - 0x144]
cmp edx, 9
je 0x10026934
movzx eax, word [ebp - 0x144]
cmp eax, 6
jne 0x10026940
mov dword [0x1008ab8c], 1
jmp 0x1002694a
mov dword [0x1008ab8c], 0
call fcn.10027e20
movzx ecx, al
test ecx, ecx
je 0x1002697d
call fcn.10027e40
movzx edx, al
test edx, edx
je 0x1002696e
mov dword [0x10059144], 5
jmp 0x10026978
mov dword [0x10059144], 5
jmp 0x10026a7c
call fcn.10027d00
movzx eax, al
test eax, eax
je 0x100269b0
call fcn.10027e40
movzx ecx, al
test ecx, ecx
je 0x100269a1
mov dword [0x10059144], 5
jmp 0x100269ab
mov dword [0x10059144], 5
jmp 0x10026a7c
mov dword [ebp - 0x120], 0x114
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 2
jne 0x10026a7c
cmp dword [ebp - 0x11c], 5
jne 0x100269f0
cmp dword [ebp - 0x118], 1
jne 0x100269f0
mov dword [0x10059144], 0
cmp dword [ebp - 0x11c], 5
jne 0x10026a0c
cmp dword [ebp - 0x118], 2
jne 0x10026a0c
mov dword [0x10059144], 1
cmp dword [ebp - 0x11c], 6
jne 0x10026a28
cmp dword [ebp - 0x118], 0
jne 0x10026a28
mov dword [0x10059144], 2
cmp dword [ebp - 0x11c], 6
jne 0x10026a44
cmp dword [ebp - 0x118], 1
jne 0x10026a44
mov dword [0x10059144], 3
cmp dword [ebp - 0x11c], 6
jne 0x10026a60
cmp dword [ebp - 0x118], 2
jne 0x10026a60
mov dword [0x10059144], 4
cmp dword [ebp - 0x11c], 6
jne 0x10026a7c
cmp dword [ebp - 0x118], 3
jne 0x10026a7c
mov dword [0x10059144], 5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002c620
mov esp, ebp
pop ebp
ret
Function at 0x10026af0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
je 0x10026b08
cmp dword [ebp + 0x10], 0
je 0x10026b08
cmp dword [ebp + 0x14], 0
jne 0x10026b0f
mov eax, 0x57
jmp 0x10026b86
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov dword [eax], ecx
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10026b83
mov dword [ebp - 0x10], 4
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x10026b7f
cmp dword [ebp - 0xc], 4
jne 0x10026b7f
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
jmp 0x10026b83
xor eax, eax
jmp 0x10026b86
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10027540
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 2
jne 0x10027555
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1002756f
mov ecx, dword [ebp + 8]
push ecx
push 0x1004e5f0
call fcn.1002c771
add eax, 0x40
push eax
call fcn.1002c65b
add esp, 0xc
pop ebp
ret
Function at 0x10027580
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.10027fe0
cmp dword [ebp + 0xc], 0
je 0x100275ac
cmp dword [ebp + 0x10], 0
jne 0x100275b6
mov eax, 0x57
jmp 0x100276a3
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100275e0
mov eax, dword [ebp - 0x10]
jmp 0x100276a3
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
push 0
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xea
je 0x10027617
cmp dword [ebp - 0x10], 0
je 0x10027617
jmp 0x10027684
cmp dword [ebp - 4], 1
je 0x10027624
mov dword [ebp - 0x10], 0xd
mov edx, dword [ebp - 0xc]
push edx
call fcn.1002cfe9
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10027644
mov dword [ebp - 0x10], 0x7a
jmp 0x10027684
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10027684
cmp dword [ebp - 4], 1
jne 0x1002767d
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.10027fe0
jmp 0x10027684
mov dword [ebp - 0x10], 0xd
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
je 0x100276a0
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1002ceea
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10027b00
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push str.IsProcessService1_n
push 0x1ac
push 0x1004f70c
push 0x1004f78c
push 4
push 0x1004f858
call fcn.10026da0
add esp, 0x18
push str.GlobalCVUSBSrvReadyEvent
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10027b86
push str.Open_CVUSBSrvReadyEvent_fail_n
push 0x1b0
push 0x1004f8e4
push 0x1004f8f8
push 4
push 0x1004f90c
call fcn.10026da0
add esp, 0x18
mov eax, 1
jmp 0x10027cd2
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.IsProcessService2_n
push 0x1b4
push 0x1004f950
push 0x1004f964
push 4
push 0x1004f978
call fcn.10026da0
add esp, 0x18
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
push 5
push 0xffffffffffffffff
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
jne 0x10027bfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1004f9a8
push 0x1b8
push 0x1004f994
push 0x1004fa0c
push 4
push 0x1004fa20
call fcn.10026da0
add esp, 0x1c
xor eax, eax
jmp 0x10027cd2
mov eax, dword [ebp - 0x10]
push eax
push str.UserName__s
push 0x1bc
push 0x1004fa54
push 0x1004fa68
push 4
push 0x1004fa7c
call fcn.10026da0
add esp, 0x1c
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1002ce0f
add esp, 4
test eax, eax
je 0x10027c71
push str.SYSTEM
mov edx, dword [ebp - 0x10]
push edx
call fcn.1002ea1e
add esp, 8
test eax, eax
je 0x10027c71
push str.LOCAL_SERVICE
mov eax, dword [ebp - 0x10]
push eax
call fcn.1002ea1e
add esp, 8
test eax, eax
je 0x10027c71
push str.NETWORK_SERVICE
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1002ea1e
add esp, 8
test eax, eax
jne 0x10027ca4
push str.UserName_Check_FAIL
push 0x1c2
push 0x1004fb0c
push 0x1004fb20
push 4
push 0x1004fb34
call fcn.10026da0
add esp, 0x18
mov edx, dword [ebp - 0x10]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, 1
jmp 0x10027cd2
push str.UserName_Check_ok
push 0x1c7
push str.MultiuserUtil.cpp
push str.IsProcessService
push 4
push 0x1004fb9c
call fcn.10026da0
add esp, 0x18
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10029e10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 2
jne 0x10029e25
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10029e3f
mov ecx, dword [ebp + 8]
push ecx
push 0x1004fc28
call fcn.1002c771
add eax, 0x40
push eax
call fcn.1002c65b
add esp, 0xc
pop ebp
ret
Function at 0x10029e50
Capabilities:
Persist via appinit_dlls registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0x10050258
push 0x100502a0
push 0x80000002
call fcn.10029ed0
add esp, 0x14
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
je 0x10029ec1
push 1
push str.LoadAppInit_DLLs
push 0x10050338
push 0x80000002
call fcn.10029f70
add esp, 0x10
test eax, eax
je 0x10029ec1
push str.CTRegWriteDword_fail_n
push 0x1d
push 0x100503a4
push str.SetLoadAppInitDlls
push 2
push 0x100503c8
call fcn.10029670
add esp, 0x18
xor eax, eax
jmp 0x10029ec6
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10029ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
je 0x10029ee8
cmp dword [ebp + 0x10], 0
je 0x10029ee8
cmp dword [ebp + 0x14], 0
jne 0x10029eef
mov eax, 0x57
jmp 0x10029f66
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov dword [eax], ecx
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10029f63
mov dword [ebp - 0x10], 4
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x10029f5f
cmp dword [ebp - 0xc], 4
jne 0x10029f5f
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x14]
mov dword [edx], eax
jmp 0x10029f63
xor eax, eax
jmp 0x10029f66
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10029f70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x10029f82
cmp dword [ebp + 0x10], 0
jne 0x10029f89
mov eax, 0x57
jmp 0x10029fda
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 6
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10029fd7
push 4
lea ecx, [ebp + 0x14]
push ecx
push 4
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1002a2b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.10027fe0
cmp dword [ebp + 0xc], 0
je 0x1002a2dc
cmp dword [ebp + 0x10], 0
jne 0x1002a2e6
mov eax, 0x57
jmp 0x1002a3d3
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1002a310
mov eax, dword [ebp - 0x10]
jmp 0x1002a3d3
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
push ecx
push 0
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xea
je 0x1002a347
cmp dword [ebp - 0x10], 0
je 0x1002a347
jmp 0x1002a3b4
cmp dword [ebp - 4], 1
je 0x1002a354
mov dword [ebp - 0x10], 0xd
mov edx, dword [ebp - 0xc]
push edx
call fcn.1002cfe9
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1002a374
mov dword [ebp - 0x10], 0x7a
jmp 0x1002a3b4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1002a3b4
cmp dword [ebp - 4], 1
jne 0x1002a3ad
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.10027fe0
jmp 0x1002a3b4
mov dword [ebp - 0x10], 0xd
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
je 0x1002a3d0
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1002ceea
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x1002a3e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x1002a3f8
cmp dword [ebp + 0x10], 0
je 0x1002a3f8
cmp dword [ebp + 0x14], 0
jne 0x1002a3ff
mov eax, 0x57
jmp 0x1002a45f
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 6
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1002a45c
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.1002ce0f
add esp, 4
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 1
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1002b310
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 2
jne 0x1002b325
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1002b33f
mov ecx, dword [ebp + 8]
push ecx
push 0x100509a8
call fcn.1002c771
add eax, 0x40
push eax
call fcn.1002c65b
add esp, 0xc
pop ebp
ret

Function at 0x1002c620
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10059248]
jne 0x1002c62a
repz ret
jmp fcn.10030358

Function at 0x100346e9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10059248]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10033106
and dword [ebp - 0x14], 0
cmp dword [0x1008b7fc], 0
mov dword [ebp - 0x18], eax
jne 0x1003479c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10034844
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10034844
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1008b7fc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1008b800], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1008b804], eax
call edi
push eax
call esi
mov dword [0x1008b80c], eax
test eax, eax
je 0x1003479c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1008b808], eax
mov eax, dword [0x1008b808]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100347f5
cmp dword [0x1008b80c], ecx
je 0x100347f5
push eax
call esi
push dword [0x1008b80c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100347f5
test ebx, ebx
je 0x100347f5
call edi
test eax, eax
je 0x100347ec
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100347ec
test byte [ebp - 8], 1
jne 0x100347f5
or dword [ebp + 0x10], 0x200000
jmp 0x10034828
mov eax, dword [0x1008b800]
cmp eax, dword [ebp - 0x18]
je 0x10034828
push eax
call esi
test eax, eax
je 0x10034828
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10034828
mov eax, dword [0x1008b804]
cmp eax, dword [ebp - 0x18]
je 0x10034828
push eax
call esi
test eax, eax
je 0x10034828
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1008b7fc]
call esi
test eax, eax
je 0x10034844
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10034846
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002c620
leave
ret
Function at 0x10001045
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x16], 1
jne 0x10001154
cmp byte [esi + 0xc], 0
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
jne 0x100010ff
mov eax, dword [esi + 0x12]
lea ecx, [ebp + 8]
push ecx
movzx ecx, byte [esi + 0x11]
push 0x40
push ecx
push eax
mov dword [esi + 0xd], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
push eax
call ebx
movzx eax, byte [esi + 0x11]
push eax
push dword [esi + 0x12]
lea eax, [esi + 0x17]
push eax
call fcn.10011dd0
movzx eax, byte [esi + 0x11]
mov ecx, dword [esi + 0x23]
add ecx, eax
push 5
push ecx
lea eax, [eax + esi + 0x17]
push eax
call fcn.10011dd0
movzx eax, byte [esi + 0x11]
push eax
push dword [esi + 0x23]
push dword [esi + 0x12]
call fcn.10011dd0
add esp, 0x24
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
movzx eax, byte [esi + 0x11]
push eax
push dword [esi + 0x12]
call edi
push eax
call ebx
lea eax, [ebp + 8]
push eax
push 0x40
push 0xb
push dword [esi + 0x23]
call edi
push eax
call ebx
push 0xb
push esi
push dword [esi + 0x23]
call fcn.10011dd0
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0xb
push dword [esi + 0x23]
jmp 0x10001149
lea eax, [ebp + 8]
push eax
movzx eax, byte [esi + 0x11]
push 0x40
push eax
push dword [esi + 0x12]
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
push eax
call ebx
movzx eax, byte [esi + 0x11]
push eax
push dword [esi + 0x12]
lea eax, [esi + 0x17]
push eax
call fcn.10011dd0
movzx eax, byte [esi + 0x11]
push eax
push esi
push dword [esi + 0x12]
call fcn.10011dd0
add esp, 0x18
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
movzx eax, byte [esi + 0x11]
push eax
push dword [esi + 0x12]
call edi
push eax
call ebx
pop edi
mov byte [esi + 0x16], 0
pop ebx
pop esi
pop ebp
ret
Function at 0x10001157
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x16], 0
jne 0x10001223
cmp byte [esi + 0xc], 0
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
jne 0x100011dc
mov eax, dword [esi + 0x23]
lea ecx, [ebp + 8]
push ecx
push 0x40
push 0xb
push eax
mov dword [esi + 0xd], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
push eax
call ebx
movzx eax, byte [esi + 0x11]
push eax
push dword [esi + 0x12]
push dword [esi + 0x23]
call fcn.10011dd0
movzx eax, byte [esi + 0x11]
lea ecx, [eax + esi + 0x17]
push 5
push ecx
mov ecx, dword [esi + 0x23]
add ecx, eax
push ecx
call fcn.10011dd0
add esp, 0x18
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 0xb
push dword [esi + 0x23]
call edi
push eax
call ebx
lea eax, [ebp + 8]
push eax
movzx eax, byte [esi + 0x11]
push 0x40
push eax
push dword [esi + 0x12]
call edi
jmp 0x100011f2
lea eax, [ebp + 8]
push eax
movzx eax, byte [esi + 0x11]
push 0x40
push eax
push dword [esi + 0x12]
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
push eax
call ebx
movzx eax, byte [esi + 0x11]
push eax
lea eax, [esi + 0x17]
push eax
push dword [esi + 0x12]
call fcn.10011dd0
add esp, 0xc
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
movzx eax, byte [esi + 0x11]
push eax
push dword [esi + 0x12]
call edi
push eax
call ebx
pop edi
mov byte [esi + 0x16], 1
pop ebx
pop esi
pop ebp
ret

Function at 0x10001226
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
jne 0x1000123c
xor al, al
jmp 0x100012fb
push esi
mov esi, dword [ebp + 0x10]
cmp byte [esi + 0x16], 1
jne 0x1000124d
push esi
call fcn.10001045
pop ecx
push esi
call fcn.10001000
pop ecx
mov dword [ebp + 8], 0x10022212
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax - 1]
push ecx
push eax
push edi
call fcn.10012131
add esp, 0xc
test eax, eax
je 0x10001285
add dword [ebp - 4], 0xe
add dword [ebp + 8], 0xe
inc ebx
cmp dword [ebp - 4], 0x54
jb 0x1000125e
jmp 0x100012f8
imul ebx, ebx, 0xe
mov dword [esi + 0x12], edi
mov bl, byte [ebx + 0x10022210]
lea eax, [ebp + 8]
push eax
movzx eax, bl
push 0x40
push eax
mov byte [esi + 0x11], bl
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
movzx eax, byte [esi + 0x11]
push eax
push edi
push esi
call fcn.10011dd0
push esi
call fcn.10001028
movzx eax, byte [esi + 0x11]
sub eax, esi
lea eax, [eax + edi - 0x11]
mov dword [esi + 0xd], eax
mov eax, dword [ebp + 0xc]
add esp, 0x10
mov byte [edi], 0xe9
inc edi
sub eax, edi
sub eax, 4
mov dword [edi], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
movzx eax, byte [esi + 0x11]
push eax
push edi
mov byte [esi + 0x16], 1
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
mov al, 1
pop esi
pop edi
pop ebx
leave
ret
Function at 0x100012ff
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10001313
xor al, al
jmp 0x100013f5
push ebx
push esi
mov esi, dword [ebp + 0x14]
cmp byte [esi + 0x16], 1
jne 0x10001325
push esi
call fcn.10001045
pop ecx
push esi
call fcn.10001000
mov eax, dword [ebp + 0xc]
pop ecx
mov cl, byte [ebp + 0x18]
mov byte [esi + 0x11], cl
lea ecx, [ebp - 4]
push ecx
push 0x40
push 0xb
mov dword [esi + 0x12], edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
mov dword [esi + 0x23], eax
mov byte [esi + 0xc], 0
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
push eax
call ebx
push 0xb
push dword [ebp + 0xc]
push esi
call fcn.10011dd0
push 0xb
push 0x90
push dword [ebp + 0xc]
call fcn.10011d50
movzx eax, byte [ebp + 0x18]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
call fcn.10011dd0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
sub edx, ecx
add esp, 0x24
sub edx, 5
mov byte [eax + ecx], 0xe9
mov dword [eax + ecx + 1], edx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0xb
push ecx
call edi
push eax
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [ebp - 8]
push dword [ebp + 8]
call edi
push eax
call ebx
push esi
call fcn.10001028
mov eax, dword [esi + 0x23]
mov dword [esi + 0xd], eax
mov eax, dword [ebp + 8]
pop ecx
mov ecx, dword [ebp + 0x10]
mov byte [eax], 0xe9
inc eax
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
mov byte [esi + 0x16], 1
push dword [ebp - 8]
push eax
call edi
push eax
call ebx
pop esi
mov al, 1
pop ebx
pop edi
leave
ret