joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414c40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f7e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 4]
push esi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 0x28]
push 0
push 0
push edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], 0
mov eax, dword [edi]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov ebx, eax
test ebx, ebx
je 0x414cb8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x14
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov edi, dword [edi]
mov ecx, dword [edi]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [ecx + 0xc]
push edx
push edi
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x14

Function at 0x415410
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.00422096
mov ecx, dword [esp + 0x20]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x415435
xor eax, eax
pop ecx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x415444
mov eax, 1
pop ecx
ret 4
Function at 0x418160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f743
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov dword [esp + 0x10], 0
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x41819c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
add esi, 0xc
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], 1
mov eax, dword [esi + 0x38]
push eax
mov dword [esi + 0x30], vtable.CBuffer_unsigned_char_.0
call fcn.00421dee
add esp, 4
add esi, 4
push esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00417e10
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4

Function at 0x418e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x430049
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
push eax
push ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
call fcn.00418c90
lea edx, [esp + 0xc]
mov dword [esp + 0x20], 0
push edx
mov dword [esp + 0xc], 1
call fcn.00405080
push ebx
mov ecx, eax
call fcn.00404fe0
mov eax, dword [esp + 0xc]
push eax
call fcn.00421dee
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x419c20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42f628
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor eax, eax
xor ecx, ecx
mov word [esp + 0xc], ax
mov word [esp + 0xe], cx
mov dword [esp + 0x28], eax
mov byte [ebx], al
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esi], eax
mov dword [esi + 4], eax
mov eax, dword [ebp]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 0xc
push ecx
push eax
call edx
mov edi, eax
test edi, edi
je 0x419c9e
lea ecx, [esp + 0xc]
call fcn.00408890
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
mov ax, word [esp + 0xc]
cmp ax, 0x40
jne 0x419cb8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ecx
jmp 0x419cf0
test ax, ax
je 0x419cdf
lea ecx, [esp + 0xc]
call fcn.00408890
mov eax, 0x80004005
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
cmp byte [ebp + 0x2c], 0
je 0x419cf3
mov edx, dword [ebp + 0x24]
mov dword [esi], edx
mov eax, dword [ebp + 0x28]
mov dword [esi + 4], eax
mov byte [ebx], 1
lea ecx, [esp + 0xc]
call fcn.00408890
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
Function at 0x41afe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42e97e
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [ebx]
mov dword [esi], eax
test eax, eax
je 0x41b016
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea edi, [ebx + 4]
lea eax, [esi + 4]
mov dword [esp + 0x14], 0
call fcn.00404b90
lea edi, [ebx + 0x10]
lea eax, [esi + 0x10]
mov byte [esp + 0x14], 1
call fcn.00404b90
mov byte [esp + 0x14], 2
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [ebx + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [ebx + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov cl, byte [ebx + 0x2c]
lea edi, [ebx + 0x30]
lea eax, [esi + 0x30]
mov byte [esi + 0x2c], cl
call fcn.00404b90
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x41b860
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 8
je 0x41b877
cmp eax, 0x46
je 0x41b877
mov dword [esp + 4], eax
jmp fcn.004064e0
mov al, 1
ret 0xc

Function at 0x41d740
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x43ee44]
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
lea esi, [ebp + 0x118]
push esi
push 0x4063f0
push 0
push 0x1f6
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
test eax, eax
je 0x41d771
mov dword [esi + 4], eax
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x434850
lea edi, [ebp + 0x14]
push ecx
call fcn.00408600
call fcn.0041c040
mov bl, al
test bl, bl
je 0x41d7ab
cmp byte [ebp + 0x169], 0
jne 0x41d7ab
mov edx, dword [ebp + 0x11c]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, byte [ebp + 0x169]
mov byte [ebp + 0x88], al
test bl, bl
je 0x41d7c3
mov ebx, dword [ebp + 0x11c]
jmp 0x41d7c5
xor ebx, ebx
mov edi, dword [esp + 0x28]
lea esi, [ebp + 0x70]
lea eax, [esi + 0x24]
call fcn.00404bf0
mov ecx, dword [0x43ee44]
push esi
push 0x4063f0
push 0
push 0x1f4
push ecx
mov dword [esi + 0x30], ebx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [esp + 0x2c]
mov edx, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push edx
call esi
mov eax, 0x45
lea ecx, [esp + 0x14]
call fcn.0041b1d0
mov eax, dword [eax]
mov ecx, dword [ebp + 0x74]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esp + 0x14]
push edx
call fcn.00421dee
mov eax, dword [ebp + 0x74]
add esp, 4
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi]
push 0xffffffffffffffff
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
Function at 0x41e510
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x42f55e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x43c024]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
lea esi, [edi + 4]
xor ebx, ebx
push 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00404e70
lea esi, [edi + 0x10]
mov dword [esp + 0x18], ebx
push 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00404e70
mov dword [edi + 0x20], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], 4
mov dword [edi + 0x28], vtable.CObjectVector_struct_CArc_.0
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], 4
mov dword [edi + 0x3c], vtable.CObjectVector_class_CStringBase_wchar_t__.0
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov byte [edi + 0x58], bl
lea esi, [edi + 0x64]
mov byte [esp + 0x18], 3
push 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00404e70
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x41f630
Capabilities:
Set registry value

Disassembly:
mov eax, 0x200c
call fcn.0042bdf0
mov eax, dword [0x43c024]
xor eax, esp
mov dword [esp + 0x2008], eax
push 0x2000
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004287c0
add esp, 0xc
push 0x2000
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
lea edx, [esp + 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocStringLen
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [esp]
push 4
lea eax, [esp + 8]
push eax
push 4
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x1c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2008]
xor ecx, esp
call fcn.00421ddf
add esp, 0x200c
ret

Function at 0x41f6e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x43c024]
xor eax, esp
mov dword [esp + 0x418], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x21a]
push ecx
mov word [esp + 0x21c], ax
call fcn.004287c0
add esp, 0xc
push 0x208
lea edx, [esp + 0x214]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.004287c0
push str.Applications_
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.00422938
lea eax, [esp + 0x228]
push 0x5c
push eax
call fcn.004229a7
add eax, 2
push eax
lea ecx, [esp + 0x2c]
push 0x104
push ecx
call fcn.00422a34
add esp, 0x2c
push 0
lea edx, [esp + 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
push SysReAllocStringLen
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [esp]
push 2
lea edx, [esp + 8]
push edx
push 1
xor ecx, ecx
push ecx
push str.IsHostApp
push eax
mov word [esp + 0x1c], cx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00421ddf
add esp, 0x41c
ret
Function at 0x421ddf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c024]
jne 0x421de9
repz ret
jmp fcn.00422c62

Function at 0x427845
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00424251
and dword [ebp - 4], 0
cmp dword [0x43ecd8], 0
mov ebx, eax
jne 0x4278f6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4279a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4279a7
push eax
call fcn.004241df
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43ecd8], eax
call esi
push eax
call fcn.004241df
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43ecdc], eax
call esi
push eax
call fcn.004241df
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43ece0], eax
call esi
push eax
call fcn.004241df
pop ecx
mov dword [0x43ece8], eax
test eax, eax
je 0x4278f6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004241df
pop ecx
mov dword [0x43ece4], eax
mov eax, dword [0x43ece4]
cmp eax, ebx
je 0x42794e
cmp dword [0x43ece8], ebx
je 0x42794e
push eax
call fcn.0042425a
push dword [0x43ece8]
mov esi, eax
call fcn.0042425a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42794e
test edi, edi
je 0x42794e
call esi
test eax, eax
je 0x427945
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x427945
test byte [ebp - 0xc], 1
jne 0x42794e
or dword [ebp + 0x10], 0x200000
jmp 0x427987
mov eax, dword [0x43ecdc]
cmp eax, ebx
je 0x427987
push eax
call fcn.0042425a
pop ecx
test eax, eax
je 0x427987
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x427987
mov eax, dword [0x43ece0]
cmp eax, ebx
je 0x427987
push eax
call fcn.0042425a
pop ecx
test eax, eax
je 0x427987
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43ecd8]
call fcn.0042425a
pop ecx
test eax, eax
je 0x4279a7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4279a9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001ea0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10052434]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0x200030
push dword [0x10098ff8]
push str.Error_201__Contate_um_administrador_e_avise_da_falha___
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10002ff0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x10003022
jl 0x10003015
test ecx, ecx
jne 0x10003022
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100030e2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.100050f0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1000308e
jg 0x1000304d
test esi, esi
je 0x1000308e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10003065
mov eax, dword [esp + 0x10]
jl 0x1000305f
cmp eax, esi
jae 0x10003065
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.1001b060
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x100030af
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x100030cb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10003034
jl 0x100030cb
test ecx, ecx
jne 0x10003034
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x10003121
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x10003121
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.1001b060
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x10003190
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x10003147
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x10003179
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.10023e85
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x100031a4
cmp edi, eax
ja 0x10003155
test ecx, ecx
je 0x10003190
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.10023e85
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004fc0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b9e0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10052434]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push 8
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10019424
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10017f7b
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
mov dword [ebp - 0x18], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea esi, [eax + 0x24]
mov byte [ebx + 0x48], 0
add eax, 0x28
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x18]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x18]
mov dword [edx], 0
mov edx, dword [0x10098f7c]
mov dword [ecx], 0
mov ecx, dword [0x10098f78]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10052434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov edx, dword [0x10098480]
push esi
mov esi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x10098f80]
cmp eax, dword [edx + 4]
jle 0x10007076
push 0x10098f80
call fcn.100195b8
add esp, 4
cmp dword [0x10098f80], 0xffffffff
jne 0x10007076
push 0x1003c230
mov dword [0x10098f84], 0x1004a704
call fcn.10019993
push 0x10098f80
call fcn.1001956e
add esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
add esi, 0x1fc
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100070ac
lea eax, [ebp - 8]
mov dword [esi], 0
push eax
push dword [ebp - 8]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10019411
mov esp, ebp
pop ebp
ret
Function at 0x10008870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10052434]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
jmp 0x10008895
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 4
push 0x1cc000
push 0x401000
call esi
lea eax, [ebp - 0xc]
push eax
push 4
push 0x18000
push 0x5cd000
call esi
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10098480]
mov esi, dword [eax + ecx*4]
mov eax, dword [0x1009bba4]
cmp eax, dword [esi + 4]
jle 0x10008912
push 0x1009bba4
call fcn.100195b8
add esp, 4
cmp dword [0x1009bba4], 0xffffffff
jne 0x10008912
push 0x1003c250
mov dword [0x1009bba8], 0x1004a72c
call fcn.10019993
push 0x1009bba4
call fcn.1001956e
add esp, 8
call fcn.100089b0
test al, al
je 0x10008995
mov eax, dword [0x1009bbb0]
cmp eax, dword [esi + 4]
jle 0x1000895f
push 0x1009bbb0
call fcn.100195b8
add esp, 4
cmp dword [0x1009bbb0], 0xffffffff
jne 0x1000895f
push 0x1003c240
mov dword [0x1009bbac], 0x1004a73c
call fcn.10019993
push 0x1009bbb0
call fcn.1001956e
add esp, 8
call fcn.1000d120
test al, al
je 0x10008995
call fcn.1000a7d0
test al, al
jne 0x1000898d
call fcn.1000a8b0
test al, al
jne 0x1000898d
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019411
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019411
mov esp, ebp
pop ebp
ret
Function at 0x10009620
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10052434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10098480]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10098f80]
cmp eax, dword [ecx + 4]
jle 0x10009683
push 0x10098f80
call fcn.100195b8
add esp, 4
cmp dword [0x10098f80], 0xffffffff
jne 0x10009683
push 0x1003c230
mov dword [0x10098f84], 0x1004a704
call fcn.10019993
push 0x10098f80
call fcn.1001956e
add esp, 8
push ebx
push esi
push edi
push 0x1003eff2
push 5
mov dword [ebp - 8], 0
call fcn.100199a8
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
add esp, 8
test esi, esi
je 0x1000970a
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x10009820
push 5
sub ecx, 0x4e0546
push 0x4e0541
mov dword [esi + 1], ecx
call edi
test eax, eax
je 0x1000970a
mov eax, dword [esi]
mov ecx, 0x4e0541
mov dword [ecx], eax
mov al, byte [esi + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push ecx
call edi
test eax, eax
je 0x1000970a
push 5
push 0x4e0541
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.1001941f
add esp, 4
push 0x1003eff2
push 6
mov dword [ebp - 8], 0
call fcn.100199a8
mov esi, eax
add esp, 8
test esi, esi
je 0x10009788
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x10009850
sub ecx, 0x50d979
push 6
mov dword [esi + 1], ecx
push 0x50d974
mov byte [esi + 5], 0x90
call edi
test eax, eax
je 0x10009788
mov eax, dword [esi]
mov ecx, 0x50d974
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
test eax, eax
je 0x10009788
push 6
push 0x50d974
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.1001941f
add esp, 4
push 0x1003eff2
push 6
mov dword [ebp - 8], 0
call fcn.100199a8
mov esi, eax
add esp, 8
test esi, esi
je 0x10009806
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x10009880
sub ecx, 0x4df308
push 6
mov dword [esi + 1], ecx
push 0x4df303
mov byte [esi + 5], 0x90
call edi
test eax, eax
je 0x10009806
mov eax, dword [esi]
mov ecx, 0x4df303
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
test eax, eax
je 0x10009806
push 6
push 0x4df303
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.1001941f
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10019411
mov esp, ebp
pop ebp
ret
Function at 0x10009a00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bdc0
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x10052434]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
lea ecx, [ebp - 0x140]
call fcn.10009a70
sub esp, 0x18
lea ecx, [ebp - 0x140]
call fcn.10010bf0
lea ecx, [ebp - 0x140]
mov dword [ebp - 4], 0
call fcn.10010d50
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call dword [sym.imp.KERNEL32.dll_ExitProcess]