joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4a7bf8]
push edi
test eax, eax
je 0x463ff9
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x463ff9
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x463ff9
push esi
mov esi, dword [ebp + 0xc]
push 5
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x463fe1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x463fe1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x463fe1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
pop esi
pop edi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x58]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0x18
xor eax, eax
pop edi
pop ebp
ret 0x18

Function at 0x464000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4a7bf8]
push edi
test eax, eax
je 0x464079
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x464079
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x464079
push esi
mov esi, dword [ebp + 0xc]
push 5
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x464061
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x464061
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x464061
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
pop esi
pop edi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x4c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0x18
xor eax, eax
pop edi
pop ebp
ret 0x18

Function at 0x464080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4a7bf8]
push edi
test eax, eax
je 0x4640f9
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x4640f9
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x4640f9
push esi
mov esi, dword [ebp + 0xc]
push 5
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4640e1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4640e1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4640e1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
pop esi
pop edi
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [edi + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0x18
xor eax, eax
pop edi
pop ebp
ret 0x18
Function at 0x464380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4a7bf8]
push edi
test eax, eax
je 0x4643e4
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x4643e4
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x4643e4
push esi
mov esi, dword [ebp + 0xc]
push 4
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4643d5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4643d5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4643d5
push eax
call dword [sym.imp.USER32.dll_LoadMenuIndirectW]
test eax, eax
jne 0x4643de
push dword [ebp + 0x10]
mov eax, dword [edi + 0x3c]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0xc
xor eax, eax
pop edi
pop ebp
ret 0xc

Function at 0x4643f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4a7bf8]
push edi
test eax, eax
je 0x464454
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0xc]
jge 0x464454
mov eax, dword [eax + 0x10]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x464454
push esi
mov esi, dword [ebp + 0xc]
push 4
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x464445
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x464445
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x464445
push eax
call dword [sym.imp.USER32.dll_LoadMenuIndirectW]
test eax, eax
jne 0x46444e
push dword [ebp + 0x10]
mov eax, dword [edi + 0x40]
push esi
call eax
pop esi
pop edi
pop ebp
ret 0xc
xor eax, eax
pop edi
pop ebp
ret 0xc
Function at 0x474504
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a2ff8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0046cd6f
mov dword [ebp - 0x14], eax
cmp dword [0x4a8998], edi
jne 0x4745f5
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x474582
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4746d5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4746d5
push 0x483d20
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4746d5
push eax
call ebx
push 0x483d2c
push esi
mov dword [0x4a8998], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4a899c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4a89a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4a89a8], eax
test eax, eax
je 0x4745f2
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4a89a4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x47461a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47460d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x47462f
push 4
pop eax
jmp 0x4746d7
cmp dword [ebp - 0x14], edi
je 0x47462f
push dword [0x4a8998]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x474614
mov eax, dword [0x4a89a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x47468d
cmp dword [0x4a89a8], esi
je 0x47468d
push eax
call ebx
push dword [0x4a89a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x47468d
test eax, eax
je 0x47468d
call ecx
test eax, eax
je 0x474682
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x474682
test byte [ebp - 8], 1
jne 0x47468d
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4746bd
mov eax, dword [0x4a899c]
cmp eax, esi
je 0x4746ba
push eax
call ebx
test eax, eax
je 0x4746ba
call eax
mov edi, eax
test edi, edi
je 0x4746ba
mov eax, dword [0x4a89a0]
cmp eax, esi
je 0x4746ba
push eax
call ebx
test eax, eax
je 0x4746ba
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4a8998]
call ebx
test eax, eax
je 0x4746d5
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4746d7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00467e26
leave
ret
Function at 0x42f160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x42f16f
pop dword [ebp - 0x2c]
mov eax, 0xd6f8d9a3
add eax, 0x294a17cc
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x4c6cf
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xa876a3cb
sub ecx, 0xa8766034
mov ebx, eax
mov esi, 0x46b200
add esi, dword [ebp - 0x2c]
mov edx, 0xf6668f0f
xor dword [ebp - 0x28], ecx
mov edi, dword [esi]
mov dword [ebp - 0x1c], 0x8ed68328
sub edi, edx
mov dword [ebp - 0x24], 0xbe90c23e
mov dword [ebx], edi
mov dword [ebp - 0x1c], 0x1b82432e
add ebx, 0xd93affd1
add ebx, 0x26c50033
add esi, 4
loop 0x42f1bd
add eax, 0x1012f
xor ebx, ebx
add ebx, eax
add eax, 0x5d8812d6
sub eax, 0x5d8812d1
mov ecx, 0x28de080
add ecx, 0xfdb21f80
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x432550
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a919
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x44ec90]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
push 0x11c
push 0
lea eax, [ebp - 0x13c]
push eax
call fcn.004148c0
add esp, 0xc
mov dword [ebp - 0x13c], 0x11c
lea ecx, [ebp - 0x13c]
push ecx
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4325d2
mov dword [ebp - 0x13c], 0x114
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4325e8
cmp dword [ebp - 0x138], 6
jb 0x4325e8
mov dword [ebp - 0x14], 1
movzx eax, byte [0x452c91]
test eax, eax
jne 0x43267e
cmp dword [ebp - 0x14], 0
je 0x43263b
push str.Vista_or_later
lea ecx, [ebp - 0x140]
call main
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x140]
push ecx
push 2
call main
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call main
jmp 0x432677
push str.not_Vista_or_later
lea ecx, [ebp - 0x144]
call main
mov dword [ebp - 4], 1
push 0
lea edx, [ebp - 0x144]
push edx
push 2
call main
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call main
mov byte [0x452c91], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00414838
mov esp, ebp
pop ebp
ret
Function at 0x4aa090
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8b000]
push edi
or ebp, 0xffffffff
jmp 0x4aa0b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4aa0b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aa0a8
mov eax, 1
add ebx, ebx
jne 0x4aa0cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4aa0dc
jne 0x4aa0fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aa0fb
dec eax
add ebx, ebx
jne 0x4aa0e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4aa0c0
add ebx, ebx
jne 0x4aa0f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4aa14d
xor ecx, ecx
sub eax, 3
jb 0x4aa113
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4aa182
sar eax, 1
mov ebp, eax
jmp 0x4aa11e
add ebx, ebx
jne 0x4aa11e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aa0ec
inc ecx
add ebx, ebx
jne 0x4aa12c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4aa0ec
add ebx, ebx
jne 0x4aa139
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4aa12e
jne 0x4aa14a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4aa12e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4aa16c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4aa15e
jmp 0x4aa0ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4aa16c
add edi, ecx
jmp 0x4aa0ae
pop esi
mov edi, esi
mov ecx, 0x5fe
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4aa18a
cmp byte [edi], 9
jne 0x4aa18a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4aa18f
lea edi, [esi + 0xa8000]
mov eax, dword [edi]
or eax, eax
je 0x4aa1fe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10e6f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10e7dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4aa1bc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10e7e4]
or eax, eax
je 0x4aa1f8
mov dword [ebx], eax
add ebx, 4
jmp 0x4aa1d9
call dword [esi + 0x10e7e0]
mov ebp, dword [esi + 0x10e7e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4aa232
sub esp, 0xffffff80
jmp 0x402078
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406037
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x406046
pop dword [ebp - 4]
mov eax, 0x50f16882
add eax, 0xaf4ef7c4
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xc2ad110b
sub dword [ebp - 0x14], 0x745acbc0
mov dword [ebp - 0x10], 0x7d4465fb
sub dword [ebp - 0x10], 0x4b1119b6
mov dword [ebp - 0xc], 0xcaf2850e
add dword [ebp - 0xc], 0x8159bf20
mov dword [ebp - 8], 0xf4447b26
sub dword [ebp - 8], 0xf4447b26
lea eax, [ebp - 0x14]
push eax
mov eax, 0x1f3bd0a0
sub eax, 0x1efb004c
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xc42dc920
sub dword [ebp - 0x14], 0x4fbb5fca
mov dword [ebp - 0x10], 0x46b2baa6
add dword [ebp - 0x10], 0xfab9a6cf
mov dword [ebp - 0xc], 0x100e7ee0
add dword [ebp - 0xc], 0x5360ed8c
mov dword [ebp - 8], 0xae2554c1
add dword [ebp - 8], 0x51daab3f
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x188ae0de
sub eax, 0x184a1092
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3ac83
push 0
call eax
mov ecx, 0xd18e81bc
sub ecx, 0xd18e34eb
mov edx, eax
mov edi, 0xd9600133
sub edi, 0xd91e5133
add edi, dword [ebp - 4]
mov esi, 0x20ad0fed
sub esi, 0x7f08596b
mov ebx, dword [edi]
xor ebx, esi
mov dword [edx], ebx
add edx, 0xc5615ec7
add edx, 0x3a9ea13d
add edi, 0xf9b8f970
sub edi, 0xf9b8f96c
loop 0x406168
add eax, 0xc6484b92
sub eax, 0xc647257b
xor ebx, ebx
add ebx, eax
add eax, 0x41a41c8f
add eax, 0xbe5be376
mov ecx, 0x9afdc57f
add ecx, 0x65423a81
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x100028c1
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
xor esi, esi
push esi
push 4
push dword [ebp + 0x1c]
mov dword [ebp - 8], esi
push dword [ebp + 0x18]
push 0x100000
push dword [ebp + 0x10]
call fcn.10006862
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
jne 0x10002927
cmp dword [ebp + 0x14], 2
jne 0x10002989
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
call fcn.10002993
add esp, 0x10
test eax, eax
je 0x10002924
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 4]
jmp 0x1000296d
mov edi, dword [ebp - 4]
cmp dword [ebp + 8], esi
je 0x1000295b
cmp dword [ebp + 0xc], esi
je 0x1000295b
push dword [ebp - 8]
push 0x20196
push dword [ebp + 0xc]
call fcn.1000381f
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.10003d31
add esp, 0x18
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1000296f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test edi, edi
je 0x1000297a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1000297a
Function at 0x10002993
Capabilities:
Allocate or change rwx memory
Check os version
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
push 0x110
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.10010150
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x100029dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10002abf
cmp dword [ebp - 0x114], 5
jne 0x100029f8
cmp dword [ebp - 0x110], 2
jne 0x100029f8
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100029cf
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, 0x3000
push 0x40
push ebx
push 0x52
push 0
call edi
mov dword [ebp - 4], eax
test eax, eax
jne 0x10002a22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10002abd
push 0x40
push ebx
push 0x149
push 0
call edi
mov edi, eax
test edi, edi
jne 0x10002a3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10002a9d
push 0x52
push 0x10027f30
push dword [ebp - 4]
call fcn.1000f860
push 0x129
push 0x10027f88
push edi
call fcn.1000f860
mov eax, dword [ebp + 8]
lea ebx, [edi + 0x129]
and dword [ebx + 0x18], esi
add esp, 0x18
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x10]
push ebx
push edi
mov dword [ebx + 0x10], eax
call dword [ebp - 4]
test eax, eax
jne 0x10002a8d
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10002a34
mov ecx, dword [ebx + 0x18]
test ecx, ecx
jne 0x10002a98
push 6
jmp 0x10002a85
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x4000
push 0
push dword [ebp - 4]
call ebx
test edi, edi
je 0x10002abd
push 0x4000
push 0
push edi
call ebx
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000436a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x5c
push esi
call fcn.10010fb0
pop ecx
pop ecx
test eax, eax
je 0x10004382
lea esi, [eax + 1]
push 0x40
push 0x1000
push 0x180
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1002aa34], eax
test eax, eax
je 0x10004424
push eax
call fcn.10004672
push 0xff
push esi
push 0x100
push dword [0x1002aa34]
call fcn.10010f04
push dword [0x1002aa34]
call fcn.100109e0
mov ecx, dword [0x1002aa34]
inc eax
mov dword [ecx + 0x100], eax
mov ecx, dword [0x1002aa34]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x108], eax
push dword [0x1002aa34]
call fcn.100048ca
add esp, 0x1c
push dword [0x1002aa34]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push dword [0x1002aa34]
mov esi, eax
call fcn.100047f2
mov dword [esp], 0x8000
push 0
push dword [0x1002aa34]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x100045f4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push edi
mov edi, dword [ebp + 0xc]
push eax
push 5
push edi
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, edi
mov byte [esi + 5], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 6], eax
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call esi
mov eax, dword [ebp + 0x14]
sub eax, edi
mov byte [edi], 0xe9
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x14]
push dword [ebp - 0x20]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004672
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0x10028344
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x1000478d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push 0x10028350
push ebx
call esi
push 0x10028364
push ebx
mov edi, eax
call esi
push 0x1002837c
push dword [ebp - 4]
mov ebx, eax
call esi
push 0x10028388
push dword [ebp - 4]
mov dword [ebp - 8], eax
call esi
push 0x10028398
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call esi
push 0x100283a8
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call esi
mov esi, dword [ebp + 8]
push 0x10004599
add esi, 0x13c
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.100045f4
mov dword [edi + 0x178], esi
lea esi, [edi + 0x11e]
push 0x100044ce
push esi
push ebx
push edi
call fcn.100045f4
mov dword [edi + 0x16c], esi
lea esi, [edi + 0x128]
push 0x1000452e
push esi
push dword [ebp - 8]
push edi
call fcn.100045f4
mov dword [edi + 0x170], esi
lea esi, [edi + 0x132]
push 0x10004574
push esi
push dword [ebp - 0xc]
push edi
call fcn.100045f4
add esp, 0x40
mov dword [edi + 0x174], esi
lea esi, [edi + 0x114]
push 0x1000448f
push esi
push dword [ebp - 0x10]
push edi
call fcn.100045f4
mov dword [edi + 0x168], esi
lea esi, [edi + 0x146]
push 0x100045d1
push esi
push dword [ebp - 4]
push edi
call fcn.100045f4
add esp, 0x20
mov dword [edi + 0x17c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004792
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x1c
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0x10]
push eax
push 0x40
push dword [ebp - 0x18]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0x18]
push dword [ebp - 0x24]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esp, ebp
pop ebp
ret

Function at 0x100047f2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0x100283b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x100048c5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push str.NtMapViewOfSection
push ebx
call esi
push str.NtQueryAttributesFile
push ebx
mov edi, eax
call esi
push str.NtOpenFile
push dword [ebp - 4]
mov ebx, eax
call esi
push str.NtCreateSection
push dword [ebp - 4]
mov dword [ebp - 8], eax
call esi
push str.NtOpenSection
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call esi
push str.NtClose
push dword [ebp - 4]
mov dword [ebp - 0x10], eax
call esi
mov ecx, dword [ebp + 8]
mov esi, eax
add ecx, 0x13c
push ecx
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.10004792
lea ecx, [edi + 0x11e]
push ecx
push ebx
push edi
call fcn.10004792
lea eax, [edi + 0x128]
push eax
push dword [ebp - 8]
push edi
call fcn.10004792
lea eax, [edi + 0x132]
push eax
push dword [ebp - 0xc]
push edi
call fcn.10004792
lea eax, [edi + 0x114]
push eax
push dword [ebp - 0x10]
push edi
call fcn.10004792
lea eax, [edi + 0x146]
push eax
push esi
push edi
call fcn.10004792
add esp, 0x48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret