joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100160d0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001fcc8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x1002e018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov eax, dword fs:[0x30]
movzx ecx, byte ds:[eax + 2]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], ebx
je 0x1001612e
push ebx
push ebx
push 0xa
call fcn.10006030
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], vtable.CProcessQuery.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push 2
push 0x23
lea esi, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.10011f60
test al, al
mov eax, dword [ebp - 0x1c]
je 0x10016187
cmp eax, ebx
je 0x1001619a
cmp byte [eax], bl
je 0x10016187
cmp byte [eax + 1], bl
jne 0x10016187
push ebx
push ebx
push 0xa
call fcn.10006030
add esp, 0xc
mov ecx, esi
call fcn.10011f20
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, ebx
je 0x1001619a
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10016760
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push str.LdrLoadDll
push str.Ntdll.dll
mov dword [ebp - 0xc], 0x304e25ff
mov word [ebp - 8], 0x501a
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x10016798
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push 0x101581a0
call edi
mov ecx, dword [esi]
mov dword [0x101581a0], ecx
mov ecx, dword [ebp - 4]
mov dx, word [esi + 4]
lea eax, [ebp - 4]
push eax
push ecx
push 6
push 0x101581a0
mov word [0x101581a4], dx
call edi
lea edx, [ebp - 4]
push edx
push 0x40
push 6
push esi
call edi
mov eax, dword [ebp - 0xc]
mov cx, word [ebp - 8]
mov dword [esi], eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 4]
push edx
push eax
push 6
push esi
mov word [esi + 4], cx
call edi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10016800
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.LdrLoadDll
push str.Ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x10016829
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push esi
call edi
mov ecx, dword [0x101581a0]
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
mov dx, word [0x101581a4]
lea eax, [ebp - 4]
push eax
push ecx
push 6
push esi
mov word [esi + 4], dx
call edi
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001a960
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x1015d58c], 0
push esi
je 0x1001a9d0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1015d590]
cmp eax, 0x1388
jbe 0x1001a9d0
push 0x1015d5bc
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x1001a9d0
call fcn.10001290
call esi
mov dword [0x1015d590], eax
test eax, eax
je 0x1001a9c5
call fcn.1001a8b0
test al, al
jne 0x1001a9c5
push 0x1388
xor ecx, ecx
call fcn.1000b950
push eax
push 2
mov eax, 0x10156df0
call fcn.1001ade0
add esp, 0xc
pop esi
ret
push 0x1015d5bc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
ret

Function at 0x1001aa40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, ebx
jae 0x1001aa72
jmp 0x1001aa60
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
cmp eax, ebx
jb 0x1001aa60
pop edi
xor al, al
pop esi
pop ebp
ret
Function at 0x1001aa80
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100213a6
mov eax, dword fs:[0]
push eax
sub esp, 0x660
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [0x10028644]
mov dword [ebp - 0x668], ecx
lea ecx, [ebp - 0x624]
mov dword [ebp - 0x66c], eax
mov ax, word [0x10028648]
push ecx
push 0x3ff
mov dword [ebp - 0x1c], edx
mov word [ebp - 0x18], ax
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x1001abe8
lea ebx, [ebp - 0x624]
mov dx, word [ebx]
push 0x104
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov word [ebp - 0x1c], dx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1001abd2
mov edi, dword [ebp - 0x66c]
lea edx, [ebp - 0x644]
push edx
call fcn.1001bd80
xor edi, edi
lea eax, [ebp - 0x224]
mov dword [ebp - 4], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1001ab35
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x644]
call fcn.1001b460
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001ac06
cmp dword [ebp - 0x62c], 8
jb 0x1001ab7b
mov ecx, dword [ebp - 0x640]
push ecx
call dword [sym.imp.MSVCR100D.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor edx, edx
mov dword [ebp - 0x62c], 7
mov dword [ebp - 0x630], edi
mov word [ebp - 0x640], dx
lea ecx, [ebp - 0x644]
mov dword [ebp - 4], 2
call dword [sym.imp.MSVCP100D.dll_public:_void___thiscall_std::_Container_base12::_Orphan_all_void_]
mov eax, dword [ebp - 0x644]
push eax
call dword [sym.imp.MSVCR100D.dll_void___cdecl_operator_delete_void__]
add esp, 4
lea ecx, [ebp - 0x644]
mov dword [ebp - 0x644], edi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.MSVCP100D.dll_public:_void___thiscall_std::_Container_base12::_Orphan_all_void_]
jmp 0x1001abd4
xor edi, edi
mov cx, word [ebx]
add ebx, 2
test cx, cx
jne 0x1001abd4
cmp word [ebx], di
jne 0x1001aaf0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x664]
push edx
lea edi, [ebp - 0x224]
call fcn.1001bd80
mov byte [ebp - 4], 1
mov edx, dword [eax + 0x14]
mov eax, ebx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001ac24
sub eax, edi
sar eax, 1
push eax
push ebx
lea eax, [edx + 1]
push esi
lea edi, [ebp - 0x644]
call fcn.1001b2b0
lea eax, [ebp - 0x664]
push eax
mov byte [ebp - 4], 0
call fcn.1001b890
cmp dword [ebp - 0x62c], 8
mov eax, dword [ebp - 0x640]
jae 0x1001ac69
lea eax, [ebp - 0x640]
mov ecx, dword [ebp - 0x668]
push eax
push 0x104
push ecx
call dword [sym.imp.MSVCR100D.dll_wcscpy_s]
add esp, 0xc
lea edx, [ebp - 0x644]
push edx
mov dword [ebp - 4], 0xffffffff
call fcn.1001b890
mov al, 1
jmp 0x1001abea
Function at 0x1001ade0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
push 1
push ecx
push 0x1002e028
call fcn.1001af60
add esp, 4
push eax
push 0
mov ecx, 0x1014cba8
call fcn.1000b200
mov eax, dword [0x10156ba4]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [sym.imp.USER32.dll_UnregisterClassA]
add esp, 0x14
test eax, eax
je 0x1001ae46
push 0
push 0
push 0x10
push eax
call edi
mov edx, dword [0x10158094]
mov eax, dword [str.SPLASH]
push edx
push eax
mov dword [0x10156ba4], 0
call ebx
mov eax, dword [0x10156ccc]
test eax, eax
je 0x1001ae72
push 0
push 0
push 0x10
push eax
call edi
mov ecx, dword [0x10158094]
mov edx, dword [str.SPLASH]
push ecx
push edx
mov dword [0x10156ccc], 0
call ebx
mov eax, dword [0x10156df4]
test eax, eax
je 0x1001ae9d
push 0
push 0
push 0x10
push eax
call edi
mov eax, dword [0x10158094]
mov ecx, dword [str.SPLASH]
push eax
push ecx
mov dword [0x10156df4], 0
call ebx
mov eax, dword [ebp + 8]
sub eax, 0
je 0x1001aec3
dec eax
je 0x1001aeb7
dec eax
jne 0x1001aecf
mov eax, 0x6a
mov ecx, 0x2b39c0
jmp 0x1001aed5
mov eax, 0x69
mov ecx, 0x227ee6
jmp 0x1001aed5
mov eax, 0x67
mov ecx, 0xff00
jmp 0x1001aed5
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
push ecx
push eax
mov eax, dword [ebp + 0xc]
call fcn.1001a580
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push esi
push 0x1001ad40
push 0
push 0
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [esi + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x1001af57
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 8], 0
je 0x1001af57
mov eax, dword [esi + 4]
test eax, eax
je 0x1001af52
push 0
push 0
push 0x10
push eax
call edi
mov ecx, dword [0x10158094]
mov edx, dword [esi + 0x1c]
push ecx
push edx
mov dword [esi + 4], 0
call ebx
call fcn.1001a9e0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1001af60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x100
push 0
push 0x1015d8f0
call sub.MSVCR100D.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0xc
xor eax, eax
sub ecx, 0x1015d8f0
mov dl, byte [ecx + eax + 0x1015d8f0]
sub dl, 0x1b
xor dl, 0xc
mov byte [eax + 0x1015d8f0], dl
inc eax
cmp eax, 0x100
jl 0x1001af82
mov eax, 0x1015d8f0
pop ebp
ret
Function at 0x1001b060
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.1001afb0
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push 0xf003f
push 0
push 0x10151d36
mov ecx, 9
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
push closesocket
mov dword [ebp - 0x54], 0x24
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001b0eb
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x4c]
push edx
push eax
push eax
mov eax, dword [ebp - 0x50]
push str.WindowID
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x28]
test eax, eax
je 0x1001b0fe
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
push ecx
push edx
push 1
push 0
push str.WindowID
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x28]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x4c]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1001b121
test al, al
je 0x1001b11d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1001b121
add ecx, 2
add edx, 2
test al, al
jne 0x1001b101
xor eax, eax
jmp 0x1001b126
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1001b0e1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
lea eax, [ebp - 0x4c]
pop esi
call fcn.1001ed20
mov esp, ebp
pop ebp
ret

Function at 0x1001b140
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.1001afb0
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
push 0xf003f
push 0
push 0x10151d36
mov ecx, 9
lea edi, [ebp - 0x28]
push closesocket
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001b1a4
mov edx, dword [ebp - 0x2c]
push 0x24
lea ecx, [ebp - 0x28]
push ecx
push 1
push eax
push str.WindowID
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
Function at 0x1001b1c0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1002e018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001b1f7
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1001b1e7
mov edx, dword [ebp - 0x20]
push 0
push 0
xor eax, eax
push 0x10
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
push ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x18]
push 0
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ed20
mov esp, ebp
pop ebp
ret

Function at 0x1001b260
Capabilities:
Hide thread from debugger

Disassembly:
push esi
push str.NtSetInformationThread
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x1001b282
xor al, al
pop esi
ret
push 0
push 0
push 0x11
test edi, edi
jne 0x1001b29c
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
test eax, eax
sete al
pop esi
ret
push edi
call esi
test eax, eax
sete al
pop esi
ret
Function at 0x1001cbc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1001cd60
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1001cc84
cmp dword [ebp - 4], 0x50000000
jb 0x1001cc01
cmp dword [ebp - 4], 0x80000000
ja 0x1001cc01
mov dword [ebp - 4], 0x4fff0000
jmp 0x1001cbda
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100D.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1001cc27
jmp 0x1001cc84
cmp dword [ebp - 0x14], 0x10000
jne 0x1001cc6a
cmp dword [ebp - 0x18], 0x10000
jb 0x1001cc6a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1001cc5d
mov eax, dword [ebp - 8]
jmp 0x1001cc86
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1001cc7f
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1001cd60
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1001cbda
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1001cc90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1001cd90
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1001cd4c
cmp dword [ebp - 4], 0x50000000
jb 0x1001cccc
cmp dword [ebp - 4], 0x80000000
ja 0x1001cccc
mov dword [ebp - 4], 0x80010000
jmp 0x1001cca5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR100D.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1001ccf2
jmp 0x1001cd4c
cmp dword [ebp - 0x14], 0x10000
jne 0x1001cd35
cmp dword [ebp - 0x18], 0x10000
jb 0x1001cd35
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1001cd28
mov eax, dword [ebp - 8]
jmp 0x1001cd4e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1001cd47
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1001cd90
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1001cca5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1001d4c0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x1001d4d5
xor eax, eax
jmp 0x1001d54a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x1001d502
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x1001d545
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x1001d543
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x1001d53f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x1001d543
xor eax, eax
jmp 0x1001d54a
jmp 0x1001d4f9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x1001d710
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101574a0]
mov dword [ebp - 4], eax
jmp 0x1001d729
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x1001d746
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1001d720
mov esp, ebp
pop ebp
ret
Function at 0x1001db90
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x101574b0], eax
je 0x1001dbae
mov eax, 0x10dd
jmp 0x1001dc8f
mov eax, dword [0x101574c0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001dc2c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1001dc0a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1001dc0a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1001d230
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCR100D.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1001dbb6
mov dword [0x101574c0], 0
call fcn.1001d550
mov ecx, dword [0x101574bc]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1001dc79
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.MSVCR100D.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1001dc44
mov dword [0x101574bc], 0
mov dword [0x101574b0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1001e180
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101574b4], 0
je 0x1001e199
mov eax, dword [0x101574b4]
jmp 0x1001e239
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1001e1ab
xor eax, eax
jmp 0x1001e239
push 8
call sub.MSVCR100D.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1001e201
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1001e1ea
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call sub.MSVCR100D.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x101574b4], eax
mov dword [0x101574b8], 0
mov eax, dword [ebp - 8]
jmp 0x1001e239
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1001e21b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1001e1cb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x101574bc]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x101574bc], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x1001ed20
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002e018]
jne 0x1001ed2a
repz ret
jmp fcn.1001f4a0
Function at 0x1003040
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push 2
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100306d
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100681e
Capabilities:
Encode data using xor

Disassembly:
push dword fs:[0]
mov dword [0x1006814], ebp
xchg ebx, ebx
jmp 0x100682e
mov dword fs:[0], esp
xor edx, edx
push edx
push 0x10
push 0x20
push edx
push edx
push 0x80000000
push 0x80000000
push edx
push 0x40
push edx
push edx
push 0x80000000
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmc
jmp 0x1006863
sub eax, eax
dec al
or al, al
je 0x100686f
jne 0x1006865
jmp 0x10068d6
clc
cld
sub ebx, ebx
sub ecx, ecx
xchg ebx, ebx
clc
mov cl, 0xce
jmp 0x100687c
lea ebx, [ebx + 1]
cmc
xchg ebx, ebx
loop 0x100687c
xchg ebx, ebx
jmp 0x1006888
stc
call fcn.010068d3
clc
mov ebx, ebx
sub ecx, 0xffffffa3
push ecx
sub esi, esi
xor esi, 0x2990
stc
xchg byte [ecx], al
nop
xor ax, bx
nop
mov byte [ecx], al
clc
cmc
xchg ebx, ebx
cmc
add ecx, 1
add bx, 0x71
dec esi
cld
clc
or esi, esi
jne 0x10068a1
pop ecx
mov ebx, dword [ebp - 8]
mov dword fs:[0], ebx
mov ebx, ebx
leave
cld
xchg ebx, ebx
jmp ecx
xchg ebx, ebx
jmp ecx
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x10197dc8
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e060
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5501a07
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x407b07
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
aas
dec eax
xor al, byte [ebx - 0x74a0fb3c]
xchg ebp, eax
or al, 0xfc
invalid