joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431470
Capabilities:
Get hostname

Disassembly:
sub esp, 0x414
mov eax, dword [0x438004]
xor eax, esp
mov dword [esp + 0x410], eax
push ebp
mov ebp, dword [esp + 0x41c]
push edi
cmp ebx, 0x182
jne 0x4314af
push 0
push 0
push 0
push str.sukeje
push str.nakefajijihi
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
jmp 0x4314d9
cmp ebx, 0x19f
jne 0x4314d9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor edi, edi
test ebx, ebx
jle 0x431553
push esi
lea esi, [esp + 0x14]
mov dword [esp + 0x10], 5
mov dword [esp + 0x14], 0
call fcn.00431460
mov eax, dword [esp + 0x14]
add eax, 0x46
mov dword [esp + 0x10], eax
sub dword [esp + 0x10], 0x46
movsx eax, byte [edi + ebp]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
xor dword [esp + 0xc], eax
mov cl, byte [esp + 0xc]
mov byte [edi + ebp], cl
cmp ebx, 0xf
jne 0x43154d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
inc edi
cmp edi, ebx
jl 0x4314e0
pop esi
pop edi
pop ebp
cmp ebx, 0x2d
jne 0x43156e
mov dword [0x2b3a9c0], 0xa62e7790
mov dword [0x2b3a9c4], 0xffffffff
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00401006
add esp, 0x414
ret
Function at 0x444870
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2c000]
push edi
or ebp, 0xffffffff
jmp 0x444892
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x444899
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x444888
mov eax, 1
add ebx, ebx
jne 0x4448ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4448a0
jne 0x4448bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4448a0
xor ecx, ecx
sub eax, 3
jb 0x4448d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x444942
mov ebp, eax
add ebx, ebx
jne 0x4448db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4448e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x44490c
inc ecx
add ebx, ebx
jne 0x4448f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4448ed
jne 0x444909
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4448ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44492c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44491d
jmp 0x44488e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44492c
add edi, ecx
jmp 0x44488e
pop esi
mov edi, esi
mov ecx, 0xc92
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44494a
cmp byte [edi], 5
jne 0x44494a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44494f
lea edi, [esi + 0x40000]
mov eax, dword [edi]
or eax, eax
je 0x4449c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x49254]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x49330]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44497c
mov ecx, edi
jns 0x4449ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x49334]
or eax, eax
je 0x4449c1
mov dword [ebx], eax
add ebx, 4
jmp 0x444999
call dword [esi + 0x49344]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4449f8
cmp al, 0xef
ja 0x4449eb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4449cd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4449da
mov ebp, dword [esi + 0x49338]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x444a2c
sub esp, 0xffffff80
jmp 0x416911
Function at 0x10002175
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x1000e3a8
push ecx
mov dword [ebp - 0x14], edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov edi, eax
push 2
push 0
push edi
call esi
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push 0
push 0
push edi
mov ebx, eax
call esi
mov esi, dword [ebp - 4]
push edi
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [ebx + 0x3c]
lea edi, [ebx + 0xf8]
add edi, eax
mov dword [ebp - 0xc], edi
movzx ecx, word [eax + ebx + 6]
push dword [eax + ebx + 0x78]
mov dword [ebp - 8], ecx
mov edx, ecx
push esi
mov ecx, edi
call fcn.10002138
add eax, ebx
add esp, 0x44
xor edi, edi
mov dword [ebp - 0x10], eax
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x100022b9
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
push eax
push dword [ebp - 4]
call fcn.10002138
mov edx, dword [ebp - 8]
add eax, ebx
mov ecx, dword [ebp - 0xc]
push dword [eax + edi*4]
push dword [ebp - 4]
call fcn.10002138
add esp, 0x10
add eax, ebx
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x10002257
test cl, cl
je 0x10002253
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x10002257
add eax, 2
add esi, 2
test cl, cl
jne 0x10002237
xor eax, eax
jmp 0x1000225c
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000226b
mov eax, dword [ebp - 0x1c]
inc edi
cmp edi, dword [ebp - 0x18]
jb 0x1000220d
jmp 0x100022b9
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
push dword [eax + 0x24]
push dword [ebp - 4]
call fcn.10002138
mov edx, dword [ebp - 8]
add eax, ebx
mov ecx, dword [ebp - 0xc]
movzx esi, word [eax + edi*2]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 4]
push dword [eax + 0x1c]
push edi
call fcn.10002138
mov edx, dword [ebp - 8]
add eax, ebx
mov ecx, dword [ebp - 0xc]
push dword [eax + esi*4]
push edi
call fcn.10002138
push ebx
mov esi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x1c
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100022be
Capabilities:
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.1000209c
mov ebx, eax
test edi, edi
je 0x1000237e
test esi, esi
je 0x1000237e
push 0x104
lea eax, [ebp - 0x110]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, esi
lea ecx, [ebp - 0x110]
call fcn.10002175
mov edi, eax
cmp edi, 0xffffffff
je 0x1000237e
lea eax, [ebp - 0x110]
push 0x1000e3a8
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
push 0
mov esi, eax
push edi
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push esi
push 5
lea eax, [ebp - 0xc]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x114]
add esp, 0x28
push eax
push 0x40
push 5
push ebx
call esi
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov al, byte [ebp - 8]
mov byte [ebx + 4], al
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x114]
push 5
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000bfc7
leave
ret

Function at 0x1000238d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test edi, edi
je 0x100023cc
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov dword [edi], 0x8b55ff8b
push eax
push dword [ebp - 8]
mov byte [edi + 4], 0xec
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1000bfc7
leave
ret

Function at 0x100023d9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
jne 0x100023f1
push edi
mov edi, dword fs:[0x30]
mov eax, dword [edi + 8]
ret
push ebx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x1c]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop ebx
jmp 0x1000241d
push esi
push dword [eax + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov eax, dword [ebp - 4]
je 0x10002423
mov eax, dword [eax]
mov dword [ebp - 4], eax
cmp dword [eax + 8], 0
jne 0x10002407
mov eax, dword [eax + 8]
pop esi
leave
ret
Function at 0x10002f43
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x4550
jne 0x10002fbe
mov eax, dword [ebp - 0x10]
mov ax, word [eax + 0x14]
mov word [ebp - 0xc], ax
movzx eax, word [ebp - 0xc]
test eax, eax
je 0x10002fbe
lea eax, [ebp - 8]
push eax
push 0x40
movzx eax, word [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx eax, word [ebp - 0xc]
push eax
push 0
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
movzx eax, word [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000bfc7
leave
ret
Function at 0x1000364d
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov edi, ecx
call fcn.10003749
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push dword [edi + 0x1a8]
call esi
mov dword [edi + 0x1b8], eax
call fcn.10003797
push eax
push dword [edi + 0x1a8]
call esi
mov dword [edi + 0x1ac], eax
call fcn.100037dd
push eax
push dword [edi + 0x1a8]
call esi
mov dword [edi + 0x1c0], eax
call fcn.10003824
push eax
push dword [edi + 0x1a8]
call esi
mov dword [edi + 0x1b0], eax
call fcn.10003872
push eax
push dword [edi + 0x1a8]
call esi
mov dword [edi + 0x1c4], eax
call fcn.100038c3
push eax
push dword [edi + 0x1a8]
call esi
mov dword [edi + 0x1c8], eax
call fcn.10003907
push eax
push dword [edi + 0x1a8]
call esi
mov dword [edi + 0x1cc], eax
call fcn.1000394b
push eax
push dword [edi + 0x1a8]
call esi
mov dword [edi + 0x1b4], eax
call fcn.10003994
push eax
push dword [edi + 0x1a8]
call esi
push edi
push 0x202
mov dword [edi + 0x1bc], eax
call dword [edi + 0x1b8]
push 2
pop eax
mov word [edi + 0x194], ax
or ecx, 0xffffffff
mov eax, 0x6d1c
mov dword [edi + 0x1a4], 0x5dc
mov word [edi + 0x196], ax
call fcn.100035b5
push eax
call fcn.10003142
pop ecx
pop edi
pop esi
ret
Function at 0x10004197
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100041e7
test al, 0x10
jne 0x100041e7
push ebx
push 0x1000e3a8
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
push 2
mov ebx, eax
push 0
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push 0
push 0
push ebx
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x28
mov eax, esi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x10004d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], 0x26
mov byte [ebp - 0x2c], 0x5e
mov byte [ebp - 0x2b], 0x2e
mov byte [ebp - 0x2a], 0x2e
mov byte [ebp - 0x29], 0x3e
mov byte [ebp - 0x28], 0x17
mov byte [ebp - 0x27], 0x43
mov byte [ebp - 0x26], 0x43
mov byte [ebp - 0x25], 0x23
mov byte [ebp - 0x24], 0x23
mov byte [ebp - 0x23], 0x47
mov byte [ebp - 0x22], 0x1b
mov byte [ebp - 0x21], 0x3b
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1f], 0x23
mov byte [ebp - 0x1e], 0x1f
mov byte [ebp - 0x1d], 0x47
mov byte [ebp - 0x1c], 0x2f
mov byte [ebp - 0x1b], 0x3f
mov byte [ebp - 0x1a], 0x43
mov byte [ebp - 0x19], 0x5a
mov byte [ebp - 0x18], 0x46
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x42
mov byte [ebp - 0x15], 0x47
mov byte [ebp - 0x14], 0x3e
mov byte [ebp - 0x13], 0x5e
mov byte [ebp - 0x12], 0x3e
mov byte [ebp - 0x11], 3
mov byte [ebp - 0x10], 0x5a
mov byte [ebp - 0xf], 0xb
mov byte [ebp - 0xe], 0x6b
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x67
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0xb
mov byte [ebp - 9], 0x6b
mov byte [ebp - 8], 0x6e
mov byte [ebp - 7], 0xff
lea ecx, [ebp - 0x2c]
call fcn.100050a0
push 9
pop ecx
lea esi, [ebp - 0x2c]
mov edi, 0x10011c14
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 0x10011c14
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000bfc7
leave
ret
Function at 0x10004e5e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], 0x26
mov byte [ebp - 0x2c], 0x5e
mov byte [ebp - 0x2b], 0x2e
mov byte [ebp - 0x2a], 0x2e
mov byte [ebp - 0x29], 0x3e
mov byte [ebp - 0x28], 0x17
mov byte [ebp - 0x27], 0x43
mov byte [ebp - 0x26], 0x43
mov byte [ebp - 0x25], 0x23
mov byte [ebp - 0x24], 0x23
mov byte [ebp - 0x23], 0x47
mov byte [ebp - 0x22], 0x1b
mov byte [ebp - 0x21], 0x3b
mov byte [ebp - 0x20], 0x47
mov byte [ebp - 0x1f], 0x23
mov byte [ebp - 0x1e], 0x1f
mov byte [ebp - 0x1d], 0x47
mov byte [ebp - 0x1c], 0x2f
mov byte [ebp - 0x1b], 0x3f
mov byte [ebp - 0x1a], 0x43
mov byte [ebp - 0x19], 0x5e
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x17], 0x32
mov byte [ebp - 0x16], 0x5e
mov byte [ebp - 0x15], 0x47
mov byte [ebp - 0x14], 0x3e
mov byte [ebp - 0x13], 0x5e
mov byte [ebp - 0x12], 0x3e
mov byte [ebp - 0x11], 3
mov byte [ebp - 0x10], 0x5a
mov byte [ebp - 0xf], 0xb
mov byte [ebp - 0xe], 0x6b
mov byte [ebp - 0xd], 0x6e
mov byte [ebp - 0xc], 0x67
mov byte [ebp - 0xb], 0x66
mov byte [ebp - 0xa], 0xb
mov byte [ebp - 9], 0x6b
mov byte [ebp - 8], 0x6e
mov byte [ebp - 7], 0xff
lea ecx, [ebp - 0x2c]
call fcn.100050a0
push 9
pop ecx
lea esi, [ebp - 0x2c]
mov edi, 0x10011c3c
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 0x10011c3c
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000bfc7
leave
ret

Function at 0x100050e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test edx, edx
je 0x1000510d
push edi
not esi
xor edi, edi
movzx eax, byte [edi + ecx]
xor eax, esi
shr esi, 8
movzx eax, al
xor esi, dword [eax*4 + 0x1000e7b8]
inc edi
cmp edi, edx
jne 0x100050f2
not esi
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x1000513f
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100118ce], 0
push esi
push edi
jne 0x10005207
push ebx
sub esp, 0xc
push 0x69
pop ecx
call fcn.10008d79
add esp, 0xc
mov ebx, eax
mov esi, str.Initialize_class_first
mov edi, ebx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10005181
push 0x11
pop ecx
mov esi, 0x1000ec10
lea eax, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
push 0xa
push eax
push 0x16
movsw word es:[edi], word [esi]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
add esp, 0xc
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100051a9
mov ax, word [0x1000ec58]
lea edx, [ebp - 0x10]
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x100051bf
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100051cb
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100051e4
mov ax, word [0x1000ec5c]
push ebx
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
pop ebx
jmp 0x10005237
mov ecx, dword [0x10011904]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x10011904]
lea edi, [eax + 0x58]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x10011904]
lea esi, [eax + 0x30]
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [edi]
add edx, dword [esi]
mov ecx, dword [eax + 0x44]
call edx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000bfc7
leave
ret
Function at 0x10005245
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100118ce], 0
push ebx
push esi
push edi
mov ebx, ecx
jne 0x1000530e
sub esp, 0xc
push 0x69
pop ecx
call fcn.10008d79
add esp, 0xc
mov ebx, eax
mov esi, str.Initialize_class_first
mov edi, ebx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10005289
push 0x11
pop ecx
mov esi, 0x1000ec10
lea eax, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
push 0xa
push eax
push 0x1b
movsw word es:[edi], word [esi]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
add esp, 0xc
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100052b1
mov ax, word [0x1000ec58]
lea edx, [ebp - 0x10]
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x100052c7
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100052d3
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100052ec
mov ax, word [0x1000ec5c]
push ebx
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x1000533e
mov ecx, dword [0x10011904]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x10011904]
mov edi, dword [eax + 0x4c]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x10011904]
lea esi, [eax + 0x58]
mov eax, dword [ecx]
call dword [eax + 8]
push ebx
mov ecx, edi
mov eax, dword [eax]
add eax, dword [esi]
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000bfc7
leave
ret
Function at 0x1000534d
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100118ce], 0
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov ebx, ecx
jne 0x10005419
sub esp, 0xc
push 0x69
pop ecx
call fcn.10008d79
add esp, 0xc
mov ebx, eax
mov esi, str.Initialize_class_first
mov edi, ebx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10005394
push 0x11
pop ecx
mov esi, 0x1000ec10
lea eax, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
push 0xa
push eax
push 0x21
movsw word es:[edi], word [esi]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
add esp, 0xc
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100053bc
mov ax, word [0x1000ec58]
lea edx, [ebp - 0x10]
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x100053d2
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100053de
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100053f7
mov ax, word [0x1000ec5c]
push ebx
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x10005455
mov ecx, dword [0x10011904]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x10011904]
lea edi, [eax + 0x58]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x10011904]
push 0
push 0
push 0xa
push 1
push dword [ebp - 0x14]
lea esi, [eax + 0x24]
mov eax, dword [ecx]
push ebx
call dword [eax + 8]
mov edx, dword [edi]
add edx, dword [esi]
mov ecx, dword [eax + 0x50]
call edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000bfc7
leave
ret
Function at 0x100054b9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10011008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100118ce], 0
push ebx
push esi
push edi
mov bl, cl
jne 0x10005585
sub esp, 0xc
push 0x69
pop ecx
call fcn.10008d79
add esp, 0xc
mov ebx, eax
mov esi, str.Initialize_class_first
mov edi, ebx
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100054fd
push 0x11
pop ecx
mov esi, 0x1000ec10
lea eax, [ebp - 0x10]
rep movsd dword es:[edi], dword [esi]
push 0xa
push eax
push 0x3e
movsw word es:[edi], word [esi]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
add esp, 0xc
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10005525
mov ax, word [0x1000ec58]
lea edx, [ebp - 0x10]
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x1000553b
sub edx, esi
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10005547
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10005560
mov ax, word [0x1000ec5c]
push ebx
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x10005611
mov ecx, dword [0x10011904]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x10011904]
lea esi, [eax + 0x58]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [eax + 0x18]
lea eax, [ebp - 0x14]
push eax
mov eax, dword [esi]
add eax, dword [ecx]
push 0x40
push 4
push eax
call edi
mov ecx, dword [0x10011904]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x10011904]
lea esi, [eax + 0x58]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [esi]
mov eax, dword [eax + 0x18]
test bl, bl
je 0x100055e1
mov dword [ecx + eax], 1
jmp 0x100055e5
and dword [ecx + eax], 0
mov ecx, dword [0x10011904]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [0x10011904]
lea esi, [eax + 0x58]
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [eax + 0x18]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
mov eax, dword [esi]
add eax, dword [ecx]
push 4
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000bfc7
leave
ret