joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10077dc0
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x10077dcf
ret
mov ecx, dword [eax + 0xc]
push esi
push edi
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x10077e10
Capabilities:
Create thread

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 4]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], eax
mov eax, edx
ret

Function at 0x10077e40
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x10077e59
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x1008b792
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1008b7ca
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1008981f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.100897f7
jmp 0x1008b7d6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x1008ce87
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1008cec9
call fcn.10092956
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x1008cec9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1008cec0
xor eax, eax
jmp 0x1008ced1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1008ced7
pop edi
pop esi
pop ebx
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100183b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x100183c4
pop dword [ebp - 0x20]
mov eax, 0x7433411b
add eax, 0x9bce42a9
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x43d64e78
add dword [ebp - 0x30], 0xa7bf6d3
mov dword [ebp - 0x2c], 0x3e929dfa
sub dword [ebp - 0x2c], 0xc5f51b5
mov dword [ebp - 0x28], 0x44fd675b
sub dword [ebp - 0x28], 0xf8b1232d
mov dword [ebp - 0x24], 0xe0e4ddbc
sub dword [ebp - 0x24], 0xe0e4ddbc
lea eax, [ebp - 0x30]
push eax
mov eax, 0x273d1acd
add eax, 0xe8c50577
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xc11babb4
sub dword [ebp - 0x30], 0x4ca9425e
mov dword [ebp - 0x2c], 0xbee848d5
sub dword [ebp - 0x2c], 0x7d7be760
mov dword [ebp - 0x28], 0x45949bb2
add dword [ebp - 0x28], 0x1ddad0ba
mov dword [ebp - 0x24], 0x9c3ecd94
add dword [ebp - 0x24], 0x63c1326c
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xbe02160b
add eax, 0x52000a35
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x35c6f
push 0
call eax
mov ecx, 0xd064b8bd
add ecx, 0x2f9b85fe
xor esi, esi
add esi, eax
mov edx, 0xa5a2a57f
sub edx, 0x959f897f
add edx, dword [ebp - 0x20]
mov ebx, 0xea1e6e1
mov edi, dword [edx]
sub dword [ebp - 8], edi
xor edi, ebx
sub dword [ebp - 0x18], 0x190efd80
mov dword [esi], edi
sub dword [ebp - 0x1c], edx
add esi, 4
add edx, 0x4346b2a1
sub edx, 0x4346b29d
loop 0x100184e2
add eax, 0xe1cfc273
add eax, 0x1e312b4c
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1640200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11db000]
push edi
jmp 0x164021a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1640221
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1640210
mov eax, 1
add ebx, ebx
jne 0x1640233
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1640244
jne 0x1640263
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1640263
dec eax
add ebx, ebx
jne 0x1640250
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1640228
add ebx, ebx
jne 0x164025f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x16402b5
xor ecx, ecx
sub eax, 3
jb 0x164027b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16402ea
sar eax, 1
mov ebp, eax
jmp 0x1640286
add ebx, ebx
jne 0x1640286
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1640254
inc ecx
add ebx, ebx
jne 0x1640294
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1640254
add ebx, ebx
jne 0x16402a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1640296
jne 0x16402b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1640296
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x16402d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16402c6
jmp 0x1640216
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16402d4
add edi, ecx
jmp 0x1640216
pop esi
mov edi, esi
mov ecx, 0x40e1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16402f2
cmp byte [edi], 0x11
jne 0x16402f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x16402f7
lea edi, [esi + 0x1239000]
mov eax, dword [edi]
or eax, eax
je 0x164036f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2395b04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2395ca8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1640324
mov ecx, edi
jns 0x1640353
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2395cb0]
or eax, eax
je 0x1640369
mov dword [ebx], eax
add ebx, 4
jmp 0x1640341
call dword [esi + 0x2395cac]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x16403a0
cmp al, 0xef
ja 0x1640393
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1640375
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1640382
mov ebp, dword [esi + 0x2395cb4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x16403d4
sub esp, 0xffffff80
jmp 0x420627
Function at 0x4019e6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0xa
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x401a32
push 6
call fcn.004116cf
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401ad8
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x401a66
push 6
call fcn.004116cf
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x401ad8
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x401a9a
push 6
call fcn.004116cf
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401ad8
push 0x80000301
push 0
push dword [ebp - 8]
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0x910
call fcn.004128f0
add esp, 0x1c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
jmp 0x401ae2
mov eax, 0x422293
jmp 0x401ae2
mov esp, ebp
pop ebp
ret 4
Function at 0x413e20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x413e33
xor eax, eax
pop esi
add esp, 0x10
ret
push esi
call fcn.004160f0
add esp, 4
test eax, eax
jne 0x413e45
pop esi
add esp, 0x10
ret
mov eax, dword [esi]
mov ecx, 1
push ebx
push ebp
cmp eax, ecx
push edi
mov dword [esp + 0x10], 0
jne 0x413f06
mov eax, dword [esi + 4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x14], ecx
jle 0x413f83
lea ebx, [esp + 0x34]
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, 0x80000004
jne 0x413e8e
mov esi, dword [ebx]
jmp 0x413ea2
push ebx
call fcn.00415f50
mov esi, eax
add esp, 4
test esi, esi
je 0x413ee6
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x413ecd
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x413ecd
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x413eda
push esi
call fcn.00416a18
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x413f83
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
inc eax
add ebx, 0xc
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x413e7e
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
cmp eax, 2
jne 0x413f83
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 4]
cmp eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
jle 0x413f83
dec eax
lea ebx, [esp + 0x34]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, 0x80000004
jne 0x413f37
mov esi, dword [ebx]
jmp 0x413f4b
push ebx
call fcn.00415f50
mov esi, eax
add esp, 4
test esi, esi
je 0x413f75
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x413f68
mov eax, dword [esp + 0x18]
push ecx
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x24]
test ebp, ebp
je 0x413f75
push esi
call fcn.00416a18
add esp, 4
mov eax, dword [esp + 0x24]
add ebx, 0xc
dec eax
mov dword [esp + 0x24], eax
jne 0x413f27
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
Function at 0x413ff0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1010
call fcn.00416c10
mov eax, dword [esp + 0x1014]
push ebx
push ebp
mov ebp, dword [esp + 0x1020]
push esi
push edi
xor edi, edi
push 1
push edi
push edi
push eax
mov dword [ebp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x4140f2
jmp 0x41402f
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x1024]
xor esi, esi
lea ecx, [esp + 0x18]
push esi
push ecx
lea edx, [esp + 0x28]
push 0x1000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41410f
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], esi
cmp eax, esi
jbe 0x41407b
mov cl, byte [esp + esi + 0x20]
test cl, cl
je 0x414072
inc esi
cmp esi, eax
jb 0x414063
jmp 0x41407b
inc esi
mov dword [esp + 0x14], 1
mov eax, dword [ebp]
mov ebx, edi
add edi, esi
test eax, eax
mov dword [esp + 0x1c], edi
je 0x414097
inc edi
push edi
push eax
call fcn.00412220
add esp, 8
jmp 0x4140a1
inc edi
push edi
call fcn.004121d0
add esp, 4
mov edi, eax
lea ecx, [esp + 0x20]
add edi, ebx
push esi
push ecx
push edi
mov dword [ebp], eax
call fcn.00416b10
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
mov byte [edi + esi], 0
jne 0x414128
cmp dword [esp + 0x18], 0x1000
jb 0x41415b
mov edx, dword [esp + 0x1024]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x41402b
mov eax, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
add esp, 0x1010
ret
mov ecx, dword [esp + 0x102c]
pop edi
mov eax, 1
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1024]
push 0
add esi, edx
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [ecx], 1
xor eax, eax
pop ebx
add esp, 0x1010
ret
mov edx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
mov dword [edx], 1
mov eax, 1
pop ebx
add esp, 0x1010
ret

Function at 0x414180
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push edi
mov dword [esi], 0
call ebx
test eax, eax
je 0x41420c
cmp dword [esp + 0x14], 4
jb 0x41420c
mov edx, dword [esp + 0x10]
add edx, 8
push edx
call fcn.004121d0
mov edx, dword [esp + 0x14]
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esi], eax
push 0
push ecx
add eax, 8
push edx
push eax
push edi
call ebx
test eax, eax
je 0x4141fb
mov esi, dword [esi]
mov dword [esi], 1
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x10]
jne 0x41420c
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov edx, dword [esi]
push edx
call fcn.00412260
add esp, 4
mov dword [esi], 0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40596d
pop dword [ebp - 0x14]
mov eax, 0x96a10c7b
sub eax, 0x9660b30e
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xfaafff50
add dword [ebp - 0x24], 0x53a245fb
mov dword [ebp - 0x20], 0xed5011f0
add dword [ebp - 0x20], 0x44e33a55
mov dword [ebp - 0x1c], 0x5f6abd50
sub dword [ebp - 0x1c], 0x131e7922
mov dword [ebp - 0x18], 0x982e0a4d
sub dword [ebp - 0x18], 0x982e0a4d
lea eax, [ebp - 0x24]
push eax
mov eax, 0x70ceed8b
sub eax, 0x708e7d2b
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x1a728a60
sub dword [ebp - 0x24], 0xa600210a
mov dword [ebp - 0x20], 0x25c99201
sub dword [ebp - 0x20], 0xe45d308c
mov dword [ebp - 0x1c], 0x499512b0
sub dword [ebp - 0x1c], 0xe625a644
mov dword [ebp - 0x18], 0xe01684f4
add dword [ebp - 0x18], 0x1fe97b0c
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x4f8a3801
sub eax, 0x4f49c701
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x32833
push 0
call eax
mov ecx, 0xbe479dca
sub ecx, 0xbe47669b
xor edi, edi
add edi, eax
mov esi, 0x410000
add esi, dword [ebp - 0x14]
mov ebx, 0xf1777e25
add ebx, 0xa6de9de7
xor dword [ebp - 8], 0xaae3d488
mov edx, dword [esi]
add dword [ebp - 4], edi
xor edx, ebx
sub dword [ebp - 8], 0x2ea155c0
mov dword [edi], edx
add dword [ebp - 4], 0x82524b7b
add edi, 0x6328ccbf
sub edi, 0x6328ccbb
add esi, 0xe4b621cd
sub esi, 0xe4b621c9
loop 0x405a8b
add eax, 0xcf8f
xor ebx, ebx
add ebx, eax
add eax, 0x8c6d2a9d
add eax, 0x7392d568
mov ecx, 0x566d74da
sub ecx, 0x562d74da
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x123c9c7
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x11c
cmp dword [esp + 0x128], 0
je 0x123cb8c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x130]
xor ebp, ebp
push edi
mov dword [esp + 0x1c], ebp
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x123cb88
mov edx, esi
mov eax, dword [edx]
mov ebx, dword [esp + 0x130]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x10]
add eax, ebx
lea edi, [ecx + ebx]
mov dword [esp + 0x20], eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x123ca32
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [esp + 0x10], eax
push 0x104
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.01235142
add esp, 0xc
test ebx, ebx
je 0x123cb32
mov eax, dword [esp + 0x18]
and dword [esp + 0x14], 0
mov eax, dword [eax]
test eax, eax
je 0x123cb1b
mov esi, dword [esp + 0x10]
xor edi, edi
mov ebp, dword [esp + 0x130]
test eax, eax
jns 0x123ca77
movzx ebx, ax
jmp 0x123ca7c
lea ebx, [ebp + 2]
add ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [esp + 0x20]
mov dword [edi + ecx], eax
test eax, eax
jne 0x123caf3
cmp dword [0x1241eac], 1
jne 0x123caf3
push 0x104
push eax
lea eax, [esp + 0x30]
push eax
call fcn.01235142
lea eax, [esp + 0x34]
push eax
call fcn.0123cc74
lea eax, [esp + 0x38]
push 0x1234204
push eax
call fcn.01235170
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.01235170
add esp, 0x20
lea eax, [esp + 0x24]
push 0
push eax
lea eax, [esp + 0x30]
push eax
call fcn.01235197
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x1241e58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ecx
mov edi, ecx
mov dword [esp + 0x14], ecx
shl edi, 2
mov eax, dword [edi + eax]
test eax, eax
jne 0x123ca70
mov esi, dword [esp + 0x134]
mov ebp, dword [esp + 0x1c]
inc ebp
imul edx, ebp, 0x14
mov dword [esp + 0x1c], ebp
add edx, esi
mov ecx, dword [edx + 0xc]
test ecx, ecx
jne 0x123c9f9
jmp 0x123cb88
lea eax, [esp + 0x28]
push eax
call fcn.0123cc74
lea eax, [esp + 0x2c]
mov dword [esp], 0x12341e8
push eax
call fcn.01235170
lea eax, [esp + 0x30]
push edi
push eax
call fcn.01235170
add esp, 0x10
cmp dword [0x1241eac], 1
jne 0x123cb88
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.01235197
pop ecx
push eax
lea eax, [esp + 0x34]
push eax
push dword [0x1241e58]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
xor eax, eax
add esp, 0x11c
ret
Function at 0x123cbc2
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push 0x208
lea eax, [ebp - 0x410]
push eax
call fcn.0123cc40
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1241d24], eax
push 0
push 0
push 0
push 2
push 0
push dword [0x1241d24]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [0x1241d28], eax
push 0
push 0
push 0
push 4
push dword [0x1241d28]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
add eax, dword [0x1241eb4]
mov esp, ebp
pop ebp
ret
Function at 0x123cccc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp dword [ebp + 0x14], 0
jne 0x123ccdf
xor eax, eax
jmp 0x123ce63
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
and dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x14c
jne 0x123cd1d
mov eax, dword [ebp - 8]
add eax, 0xf8
mov dword [ebp - 0xc], eax
jmp 0x123cd36
mov eax, dword [ebp - 8]
movzx eax, word [eax + 4]
cmp eax, 0x8664
jne 0x123cd36
mov eax, dword [ebp - 8]
add eax, 0x108
mov dword [ebp - 0xc], eax
and dword [ebp - 0x10], 0
jmp 0x123cd43
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x10], eax
je 0x123cd7c
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x24]
push eax
push 0x40
imul eax, dword [ebp - 0x10], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x123cd3c
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x2c]
jae 0x123ce1c
mov eax, dword [ebp + 0xc]
add eax, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
jmp 0x123cdac
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x30]
je 0x123ce0b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
test eax, eax
jne 0x123cdc4
jmp 0x123cda5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
and eax, 0xfff
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
add ecx, eax
add ecx, dword [ebp + 8]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
sar eax, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
je 0x123cdfc
jmp 0x123ce09
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x123cda5
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
jmp 0x123cd7c
and dword [ebp - 0x14], 0
jmp 0x123ce29
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
je 0x123ce61
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov dword [ebp - 0x38], edx
push 0
push dword [ebp - 0x24]
imul eax, dword [ebp - 0x14], 0x28
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 8]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x123ce22
xor eax, eax
mov esp, ebp
pop ebp
ret