joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000dbc9
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, eax
mov dword [ebp - 4], eax
inc eax
push eax
xor edi, edi
push edi
push dword [0x1002b100]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp + 0xc], eax
cmp eax, edi
je 0x1000dc0d
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
test eax, eax
je 0x1000dc0d
mov ebx, dword [ebp + 0xc]
push 0x10000000
push edi
push edi
push edi
push dword [ebp + 0x14]
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 0xc], eax
cmp eax, edi
je 0x1000dcc7
push 0x1000dadf
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallback]
cmp eax, 0xffffffff
je 0x1000dcc7
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
push edi
push 3
push edi
push edi
push 0x50
push dword [ebp + 8]
push dword [esi + 0xc]
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [esi + 0x10], eax
cmp eax, edi
jne 0x1000dc80
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x1000dcc7
mov eax, dword [esi + 0x18]
push 0xea60
call fcn.1000d969
test eax, eax
jne 0x1000dcc7
push esi
push 0x84404000
push edi
push edi
push edi
push ebx
push dword [ebp + 0x10]
push dword [esi + 0x10]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov dword [esi + 0x14], eax
cmp eax, edi
je 0x1000dcc7
mov ebx, dword [sym.imp.WININET.dll_InternetSetOptionA]
push 4
lea ecx, [ebp + 0x18]
push ecx
push 6
push eax
call ebx
test eax, eax
je 0x1000dcc7
push 4
lea eax, [ebp + 0x18]
push eax
push 5
push dword [esi + 0x14]
call ebx
test eax, eax
je 0x1000dcc7
xor esi, esi
jmp 0x1000dccf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [ebp + 0xc], edi
je 0x1000dce4
push dword [ebp + 0xc]
push edi
push dword [0x1002b100]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
Function at 0x1000de42
Capabilities:
Check http status code
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [esi + 0x18]
push ebx
push edi
xor ebx, ebx
push 0xea60
mov dword [ebp - 8], ebx
call fcn.1000d969
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x1000dff8
mov eax, dword [esi + 0x20]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x1000dfef
cmp dword [esi], ebx
jne 0x1000dfef
cmp dword [ebp + 8], ebx
je 0x1000de8d
push dword [esi + 0x14]
call fcn.1000db66
mov dword [esi + 4], eax
lea eax, [ebp - 0xc]
push eax
push 1
push ebx
mov dword [ebp - 4], 8
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x1000dfef
mov edi, 0x1000
push edi
push ebx
push dword [0x1002b100]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x1000dfe6
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 8]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 0x14]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1000df10
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, 0x3e5
jne 0x1000df2a
mov eax, dword [esi + 0x18]
push 0xffffffffffffffff
call fcn.1000d969
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x1000df2a
mov eax, dword [esi + 0x20]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x1000df2a
cmp dword [ebp - 8], ebx
je 0x1000df27
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ebx
push dword [ebp - 8]
push dword [ebp + 8]
push eax
call dword [ecx + 0x10]
jmp 0x1000dec7
mov dword [ebp - 4], ebx
push dword [ebp + 8]
push ebx
push dword [0x1002b100]
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 4], ebx
jne 0x1000dfe6
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
push 0x20000013
push dword [esi + 0x14]
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1000dfdf
cmp dword [ebp + 8], 0xc8
jne 0x1000dfdf
mov eax, dword [ebp - 0xc]
call fcn.100014a4
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x1000dfd6
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
push ebx
push ebx
xor edx, edx
push edx
xor ecx, ecx
push ecx
push eax
call dword [edi + 0x14]
mov eax, dword [ebp - 8]
inc eax
push eax
push ebx
push dword [0x1002b100]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
je 0x1000dfcd
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ebx
push dword [ebp - 8]
push edi
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 8]
mov byte [edi + eax], bl
mov eax, dword [ebp - 8]
mov dword [esi], edi
mov dword [esi + 0x24], eax
jmp 0x1000dfe6
mov dword [ebp - 4], 8
jmp 0x1000dfe6
mov dword [ebp - 4], 0x10d2
jmp 0x1000dfe6
mov dword [ebp - 4], 0xe8
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 4
Function at 0x1000e2c0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x1002a5bc]
mov eax, dword [0x1002b1e8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
shr edi, 0x14
imul edi, ecx
push 8
pop ebx
mov dword [ebp - 4], 0x1002c3c9
test edi, edi
jne 0x1000e2f1
mov edi, dword [0x1002a5bc]
test eax, eax
je 0x1000e2f8
mov dword [ebp - 4], eax
push 0x30
push 0
push dword [0x1002b100]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000e3d7
call fcn.1000d998
test eax, eax
je 0x1000e3be
cmp dword [ebp + 0x18], 0
jne 0x1000e329
or dword [esi + 0x28], 1
push edi
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000e1b9
mov ebx, eax
test ebx, ebx
jne 0x1000e3b7
cmp dword [ebp + 0x18], eax
je 0x1000e3d7
mov eax, dword [esi + 0x18]
push edi
call fcn.1000d969
mov ebx, eax
test ebx, ebx
jne 0x1000e3a5
mov ebx, dword [esi + 0x20]
test ebx, ebx
jne 0x1000e3b7
and dword [ebp - 8], ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x20000013
push dword [esi + 0x14]
mov dword [ebp - 0xc], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1000e39b
cmp dword [ebp - 0x10], 0xc8
je 0x1000e3b7
mov ebx, 0xe8
jmp 0x1000e3b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1000e3b7
cmp ebx, 0x102
jne 0x1000e3b7
add dword [0x1002a5bc], 0xea60
mov eax, esi
call fcn.1000da2e
cmp dword [ebp + 0x18], 0
jne 0x1000e3c8
test ebx, ebx
je 0x1000e3d7
push esi
push 0
push dword [0x1002b100]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x14

Function at 0x1000e47a
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x1000e4f9
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
jne 0x1000e4bb
mov esi, 0xe8
jmp 0x1000e501
lea eax, [esi + 1]
push eax
call fcn.100012ea
mov edi, eax
cmp edi, ebx
je 0x1000e4f9
push ebx
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000e4f9
cmp esi, dword [ebp - 4]
je 0x1000e4e8
push 0x1e
pop esi
jmp 0x1000e501
mov eax, dword [ebp + 0xc]
mov byte [esi + edi], bl
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
xor esi, esi
jmp 0x1000e501
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [ebp + 8], 0xffffffff
je 0x1000e510
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x1000e51e
cmp esi, ebx
je 0x1000e51e
push edi
call fcn.100012ff
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1000e558
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x14]
push ebx
push esi
and al, 3
movzx esi, al
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
neg esi
push 0
sbb esi, esi
push 0x80
and esi, 3
inc esi
push esi
push 0
shr eax, 8
push eax
mov ebx, 0xc0000000
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], 0x1388
call edi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x1000e603
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
cmp eax, 0x20
jne 0x1000e5fd
test byte [ebp + 0x14], 4
je 0x1000e5fd
cmp dword [ebp - 0xc], 0
jle 0x1000e5fd
push 0xc8
push dword [0x1002b220]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1000e5f6
sub dword [ebp - 0xc], 0xc8
xor eax, eax
push eax
push 0x80
push esi
push eax
push eax
push ebx
push dword [ebp + 8]
call edi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1000e5a2
jmp 0x1000e5fd
mov dword [ebp - 8], 0x5b4
cmp dword [ebp - 4], 0xffffffff
je 0x1000e652
test byte [ebp + 0x14], 2
je 0x1000e618
push 2
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000e640
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
and dword [ebp - 8], 0
jmp 0x1000e649
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1000eb9c
Capabilities:
Create directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
xor edi, edi
call fcn.1000e428
mov esi, eax
cmp esi, edi
je 0x1000ebcb
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000ebc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call fcn.100012ff
jmp 0x1000ebce
push 8
pop edi
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x1000ebd5
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
push edi
xor esi, esi
push esi
push esi
call ebx
mov edi, eax
test edi, edi
je 0x1000ec37
lea eax, [edi + 0x1d]
push eax
call fcn.100012ea
mov esi, eax
test esi, esi
je 0x1000ec37
push esi
push edi
call ebx
test eax, eax
je 0x1000ec2f
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, dword [esp + 0x14]
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1000ec2f
push 0x1002c3ba
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000ec37
push esi
call fcn.100012ff
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x1000ec3f
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
push esi
mov ebp, 0x2365
push ebp
call fcn.1000ebd5
mov esi, eax
test esi, esi
je 0x1000ecc3
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
je 0x1000ec7b
lea ecx, [esi + 4]
cmp eax, ecx
jbe 0x1000ec7b
cmp dword [eax - 5], 0x776f4c5c
jne 0x1000ec7b
push eax
add eax, 0xfffffffc
push eax
call ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
push esi
call edi
push 0
push esi
mov byte [eax], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x1000ecb9
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, ebp
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1000ecb9
push 0x1002c3ba
push esi
call edi
push eax
call ebx
jmp 0x1000ecc1
push esi
call fcn.100012ff
xor esi, esi
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret
Function at 0x1000ed8e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
cmp byte [0x1002b210], 6
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp + 8], 4
ja 0x1000ee10
test esi, esi
je 0x1000ee10
mov eax, dword [ebx + 0x18]
test dword [eax + 4], 0x80000000
jne 0x1000edc9
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp + 8], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push dword [ebp + 8]
push esi
call edi
mov dword [ebp - 8], eax
test eax, eax
je 0x1000ee0f
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x20], esi
test dword [eax + 4], 0x80000000
jne 0x1000edfc
mov eax, dword [ebp + 8]
mov byte [eax + esi - 2], 0x7e
jmp 0x1000ee02
or dword [esi], 0x40000000
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
push esi
call edi
pop edi
mov eax, dword [ebp - 8]
pop ebx
leave
ret 4
Function at 0x1000ef20
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x14
push 0x100277c0
call fcn.10024114
mov ebx, dword [ebp + 8]
and dword [ebp + 8], 0
push dword [ebp + 0xc]
call fcn.1000ecc8
test eax, eax
je 0x1000ef46
xor eax, eax
jmp 0x1000f088
lea eax, [ebp - 0x20]
push eax
call fcn.1000ecf4
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x1000f085
mov eax, dword [ebx + 0xc]
mov edi, dword [ebp - 0x20]
test eax, eax
jne 0x1000ef67
mov eax, dword [ebx + 8]
mov dword [edi + 0x14], eax
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push dword [ebx + 4]
push dword [ebx]
push dword [ebp + 0xc]
call fcn.10011211
mov esi, eax
test esi, esi
jne 0x1000efa0
lea eax, [ebp + 8]
push eax
push dword [ebx + 4]
push dword [ebx]
mov eax, dword [ebp + 0xc]
call fcn.100112b7
mov esi, eax
test esi, esi
je 0x1000f04e
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000f043
mov dword [edi + 0x18], ebx
cmp dword [ebx + 0x10], 0
jne 0x1000efcb
mov eax, ebx
mov ecx, dword [esi]
mov dword [eax + 0x10], ecx
mov eax, dword [esi]
mov dword [edi + 8], eax
mov dword [edi + 0xc], esi
mov eax, dword [esi]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, dword [ebp + 0x10]
test ebx, 0x200
je 0x1000f001
push edi
mov esi, dword [ebp + 8]
call fcn.1000ed8e
or ebx, 0x101
or dword [edi + 0x1c], ebx
mov esi, 0x1002b460
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1002b458]
mov dword [edi], eax
mov dword [edi + 4], 0x1002b458
mov dword [eax + 4], edi
mov dword [0x1002b458], edi
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and dword [ebp - 0x1c], 0
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1000f055
mov dword [eax], edi
jmp 0x1000f055
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x1000f055
mov dword [ebp - 0x1c], 2
or dword [ebp - 4], 0xffffffff
jmp 0x1000f079
cmp dword [ebp - 0x1c], 0
je 0x1000f085
push edi
call fcn.100012ff
mov eax, dword [ebp - 0x1c]
call fcn.1002414f
ret 0x10
Function at 0x1000f1aa
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x18
push 0x100277b0
call fcn.10024114
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x24]
push ecx
push eax
mov esi, dword [ebp + 8]
push dword [esi + 4]
mov edi, dword [ebp + 0xc]
call fcn.1001134e
mov ebx, eax
test ebx, ebx
je 0x1000f303
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000f2fb
mov edi, dword [ebp + 0x14]
mov dword [edi + 0x18], esi
mov eax, dword [ebx]
add eax, dword [ebp + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
mov eax, dword [ebx]
mov dword [edi + 0x10], eax
push dword [ebp + 0x10]
push esi
mov esi, edi
mov eax, dword [ebp + 0xc]
call fcn.1000f0e7
mov dword [ebp - 0x1c], eax
cmp eax, 1
jne 0x1000f323
push dword [edi + 8]
push dword [ebp + 0xc]
call fcn.1000f090
mov esi, eax
test esi, esi
je 0x1000f27e
lea eax, [ebp + 0x14]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000f27e
mov eax, dword [edi + 0x14]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
mov byte [esi], 0xe9
mov dword [edi + 0x14], esi
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], esi
cmp dword [ebp + 0x14], 0x40
je 0x1000f26e
mov dword [ebp + 0x14], 0x20
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x14]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [edi + 0x14]
sub eax, dword [ebp + 0xc]
mov dword [ebx], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
or dword [edi + 0x1c], 0x102
test dword [edi + 0x1c], 0x200
je 0x1000f2af
push edi
mov esi, dword [ebp - 0x24]
call fcn.1000ed8e
mov esi, 0x1002b460
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1002b458]
mov dword [edi], eax
mov dword [edi + 4], 0x1002b458
mov dword [eax + 4], edi
mov dword [0x1002b458], edi
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [edi + 0x10]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
and dword [ebp - 0x1c], 0
push dword [ebp + 0xc]
call fcn.1000fcad
test eax, eax
je 0x1000f323
and dword [eax + 0x44], 0
jmp 0x1000f323
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1000f320
mov dword [ebp - 0x1c], 2
jmp 0x1000f323
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
call fcn.1002414f
ret 0x10
Function at 0x1000f381
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
call fcn.1000ecf4
mov ebx, eax
test ebx, ebx
jne 0x1000f438
and dword [ebp - 4], eax
mov eax, dword [edi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov esi, dword [ebp - 8]
mov dword [esi + 0x14], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push dword [edi + 4]
call ebx
test eax, eax
je 0x1000f425
mov eax, dword [edi + 4]
mov eax, dword [eax]
mov dword [esi + 8], eax
mov eax, dword [edi + 4]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 4]
mov eax, dword [eax]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 4]
mov ecx, dword [esi + 0x14]
mov dword [eax], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push dword [edi + 4]
call ebx
or dword [esi + 0x1c], 0x101
mov ebx, 0x1002b460
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1002b458]
mov dword [esi], eax
mov dword [esi + 4], 0x1002b458
mov dword [eax + 4], esi
push ebx
mov dword [0x1002b458], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
xor ebx, ebx
jmp 0x1000f437
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x1000f437
push esi
call fcn.100012ff
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1000f43d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push 0x18
push 0x10027790
call fcn.10024114
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
movzx eax, byte [esi + 0x1c]
mov dword [ebp - 0x24], eax
dec eax
je 0x1000f501
dec eax
je 0x1000f4cb
sub eax, 6
jne 0x1000f558
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test dword [esi + 0x1c], 0x200
je 0x1000f4bf
cmp dword [esi + 0x20], 0
je 0x1000f4bf
mov eax, dword [esi + 0x18]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
push 0x40
push ebx
push dword [esi + 0x20]
call edi
test eax, eax
je 0x1000f4bf
mov eax, dword [esi + 0x18]
push dword [eax + 4]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push ebx
push dword [esi + 0x20]
call edi
and dword [esi + 0x1c], 0xfffffeff
jmp 0x1000f558
mov ebx, dword [esi + 0x14]
cmp byte [ebx], 0xe9
jne 0x1000f501
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 5
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
test eax, eax
je 0x1000f507
mov eax, dword [esi + 8]
sub eax, ebx
sub eax, 5
mov dword [ebx + 1], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 5
push ebx
call edi
jmp 0x1000f507
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push dword [esi + 0xc]
call edi
test eax, eax
je 0x1000f533
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [eax], ecx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push 4
push dword [esi + 0xc]
call edi
jmp 0x1000f476
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
jmp 0x1000f476
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
call fcn.1002414f
ret

Function at 0x1000f565
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, 0x1002b460
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
push edi
mov dword [eax + 4], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push dword [esi + 0xc]
call edi
test eax, eax
je 0x1000f5bf
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov dword [eax], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push dword [esi + 0xc]
call edi
and dword [esi + 0x1c], 0xfffffeff
xor edi, edi
jmp 0x1000f5c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call fcn.100012ff
mov eax, edi
pop edi
leave
ret