joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100187da
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1010a823
call fcn.100f4ca8
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push esi
mov dword [ebp - 0x10], ebx
call fcn.10002078
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.10002078
mov eax, dword [esi + 0x18]
lea edi, [ebx + 0x40]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov al, byte [esi + 0x2c]
mov byte [ebx + 0x2c], al
mov al, byte [esi + 0x2d]
mov byte [ebx + 0x2d], al
mov al, byte [esi + 0x2e]
mov byte [ebx + 0x2e], al
mov al, byte [esi + 0x2f]
mov byte [ebx + 0x2f], al
mov al, byte [esi + 0x30]
mov byte [ebx + 0x30], al
mov al, byte [esi + 0x31]
mov byte [ebx + 0x31], al
mov ax, word [esi + 0x32]
mov word [ebx + 0x32], ax
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
add esi, 0x40
mov dword [ebx + 0x38], eax
mov eax, ebx
mov dword [ebx + 0x3c], ecx
mov ecx, dword [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1001d2ce
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x1010b0c1
call fcn.100f4ca8
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x18], eax
lea eax, [esi + 0x20]
mov dword [edi + 0x1c], ecx
lea ecx, [edi + 0x20]
push eax
call fcn.10002078
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
and dword [ebp - 4], 0
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov dword [edi + 0x50], eax
lea eax, [esi + 0x58]
mov dword [edi + 0x54], ecx
lea ecx, [edi + 0x58]
push eax
call fcn.10010e3f
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10020161
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1010b278
call fcn.100f4ca8
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea ecx, [esi + 0x48]
mov dword [ebp - 4], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov word [esi + 0x44], bx
call fcn.100020e7
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10024f90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1010b5a1
call fcn.100f4ca8
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], eax
mov dword [esi], 0x10114ad8
mov dword [esi + 4], 0x10114b0c
mov dword [esi + 8], 0x10114b28
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], eax
push 0x10002335
push 0x1000cbbb
push 6
push 8
lea eax, [esi + 0x160]
mov byte [ebp - 4], 6
push eax
call fcn.100f4dff
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10027a41
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [esp + 0x10]
push 0x3c
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x44], ebx
mov ax, word [edi]
mov word [esi + 0x10], ax
movzx eax, word [edi + 2]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 4]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x28], eax
movzx eax, word [edi + 0x18]
mov dword [esi + 0x18], eax
movzx eax, word [edi + 0x1a]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], ebx
mov eax, dword [edi + 0x20]
mov dword [esi + 0x54], eax
lea eax, [edi + 0x28]
push eax
lea eax, [esi + 0x5c]
push eax
call fcn.100f7620
mov ax, word [esi + 0x10]
mov ecx, 0xf000
and ax, cx
add esp, 0xc
mov ecx, 0x8000
cmp ax, cx
jne 0x10027ad2
mov eax, dword [edi + 0x6c]
or dword [esi + 0x20], ebx
or dword [esi + 0x24], eax
movzx eax, word [edi + 0x74]
or dword [esi + 0x48], ebx
mov ebx, 0x80
cdq
or dword [esi + 0x4c], eax
movzx eax, word [edi + 0x78]
shl eax, 0x10
or dword [esi + 0x14], eax
movzx eax, word [edi + 0x7a]
shl eax, 0x10
or dword [esi + 0x18], eax
mov eax, dword [esp + 0x14]
movzx eax, word [eax + 0x48]
cmp ax, bx
jbe 0x10027b47
movzx edx, word [edi + 0x80]
lea ecx, [ebx + edx]
cmp ecx, eax
jbe 0x10027b15
xor al, al
jmp 0x10027b49
cmp edx, 0x1c
jb 0x10027b47
mov eax, dword [edi + 0x84]
mov dword [esi + 0x44], eax
mov eax, dword [edi + 0x88]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x8c]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x90]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x94]
mov dword [esi + 0x3c], eax
mov al, 1
pop edi
pop esi
pop ebx
ret 8
Function at 0x10037d36
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1010c266
call fcn.100f4ca8
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi], 0x10116690
mov dword [esi + 4], 0x101166c4
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.10002311
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x10039015
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x1010c3cd
call fcn.100f4ca8
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebx]
mov dword [edi], eax
mov ax, word [ebx + 4]
mov word [edi + 4], ax
mov ax, word [ebx + 6]
mov word [edi + 6], ax
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
lea ecx, [edi + 0x18]
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [edi + 0x14], eax
lea eax, [ebx + 0x18]
push eax
call fcn.10038d61
and dword [ebp - 4], 0
lea eax, [ebx + 0x24]
push eax
lea ecx, [edi + 0x24]
call fcn.10038db8
lea eax, [ebx + 0x30]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x30]
call fcn.10038e0f
push 0xa
pop ecx
add edi, 0x40
mov byte [ebp - 4], 2
lea esi, [ebx + 0x40]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x10]
lea eax, [ebx + 0x68]
push eax
lea ecx, [esi + 0x68]
call fcn.10010e3f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100485b4
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, ecx
push 0x14
pop ecx
cmp edi, ecx
jb case.0x1004869e.8
mov ebx, dword [esp + 0x14]
xor ebp, ebp
movzx edx, word [ebx]
mov word [esi], dx
mov ax, word [ebx + 2]
mov word [esi + 2], ax
mov ax, word [ebx + 4]
mov word [esi + 4], ax
mov ax, word [ebx + 6]
mov word [esi + 6], ax
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x1c], ebp
cmp edx, 2
je 0x1004871a
cmp edx, 9
je 0x100486e9
cmp edx, 1
jne 0x1004863d
push 0x20
pop ecx
cmp edi, ecx
jb case.0x1004869e.8
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebp
movzx eax, word [ebx + 0x18]
cdq
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
movzx eax, word [ebx + 0x1a]
mov dword [esi + 0xc], eax
mov eax, ecx
jmp 0x100486c3
push 8
pop eax
cmp dx, ax
jne 0x1004868f
push 0x28
pop ecx
cmp edi, ecx
jb case.0x1004869e.8
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebp
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebp
movzx edx, word [ebx + 0x20]
movzx eax, word [ebx + 0x22]
mov dword [esi + 0xc], eax
test edx, edx
je 0x10048636
lea eax, [ecx + 0xc]
cmp eax, edi
ja case.0x1004869e.8
mov eax, dword [ecx + ebx + 8]
add ecx, 0xd
add ecx, eax
cmp ecx, edi
ja case.0x1004869e.8
cmp eax, 0x400
ja case.0x1004869e.8
inc ebp
cmp ebp, edx
jb 0x1004866d
jmp 0x10048636
lea eax, [edx - 3]
cmp eax, 0xb
ja case.0x1004869e.8
movzx eax, byte [eax + 0x10048788]
jmp dword [eax*4 + 0x10048778]
cmp edi, 0x18
jb case.0x1004869e.8
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebp
lea ecx, [eax + 0x18]
cmp edi, ecx
jb case.0x1004869e.8
cmp eax, 0x40000000
jbe case.0x1004869e.6
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
push 0x18
pop ecx
cmp edi, ecx
jb case.0x1004869e.8
push 8
pop eax
cmp dx, ax
jb 0x10048636
add ecx, 4
cmp edi, ecx
jb case.0x1004869e.8
jmp 0x10048636
push 0x38
pop eax
mov dword [esp + 0x18], eax
cmp edi, eax
jb case.0x1004869e.8
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, dword [ebx + 0x2c]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0xc], eax
jmp 0x10048743
push 0x20
pop eax
mov dword [esp + 0x18], eax
cmp edi, eax
jb case.0x1004869e.8
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebp
mov eax, dword [ebx + 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebp
push dword [esp + 0x1c]
mov ecx, esi
mov ebx, ebp
call fcn.100466ca
shld edx, eax, 2
shl eax, 2
add eax, dword [esp + 0x18]
adc edx, ebx
cmp edx, ebp
ja 0x1004876f
jb 0x100486c3
cmp eax, edi
jbe 0x100486c3
mov eax, ebp
jmp 0x100486c3
Function at 0x1004a09b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1010ce06
call fcn.100f4ca8
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi], 0x10118da0
mov dword [esi + 4], 0x10118dd4
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.10002311
mov al, byte [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x40], al
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1004a17d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1010a823
call fcn.100f4ca8
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.10002078
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.10002078
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov al, byte [esi + 0x28]
mov ecx, dword [ebp - 0xc]
mov byte [edi + 0x28], al
mov al, byte [esi + 0x29]
mov byte [edi + 0x29], al
mov al, byte [esi + 0x2a]
mov byte [edi + 0x2a], al
mov al, byte [esi + 0x2b]
mov byte [edi + 0x2b], al
mov al, byte [esi + 0x2c]
mov byte [edi + 0x2c], al
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x1005105d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1010d3ea
call fcn.100f4ca8
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 2
call fcn.10051014
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x100535e8
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x1010d5aa
call fcn.100f4ca8
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov al, byte [esi]
mov byte [edi], al
mov al, byte [esi + 1]
mov byte [edi + 1], al
mov al, byte [esi + 2]
mov byte [edi + 2], al
mov al, byte [esi + 3]
mov byte [edi + 3], al
mov al, byte [esi + 4]
mov byte [edi + 4], al
mov al, byte [esi + 5]
mov byte [edi + 5], al
mov al, byte [esi + 6]
mov byte [edi + 6], al
mov al, byte [esi + 7]
mov byte [edi + 7], al
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ecx
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], ecx
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov dword [edi + 0x50], eax
lea eax, [esi + 0x58]
mov dword [edi + 0x54], ecx
lea ecx, [edi + 0x58]
push eax
call fcn.10002078
and dword [ebp - 4], 0
lea eax, [esi + 0x64]
push eax
lea ecx, [edi + 0x64]
call fcn.10002078
lea eax, [esi + 0x70]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x70]
call fcn.10002078
lea eax, [esi + 0x7c]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x7c]
call fcn.10002078
lea eax, [esi + 0x88]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x88]
call fcn.10002078
lea eax, [esi + 0x94]
mov byte [ebp - 4], 4
push eax
lea ecx, [edi + 0x94]
call fcn.10002078
mov eax, dword [esi + 0xa0]
mov ecx, dword [esi + 0xa4]
mov dword [edi + 0xa0], eax
lea eax, [esi + 0xa8]
mov dword [edi + 0xa4], ecx
lea ecx, [edi + 0xa8]
push eax
mov byte [ebp - 4], 5
call fcn.10053562
lea eax, [esi + 0xc4]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0xc4]
call fcn.10053562
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10053761
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
mov eax, 0x1010d5aa
call fcn.100f4ca8
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x58]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
call fcn.100020e7
lea ecx, [esi + 0x64]
mov dword [ebp - 4], ebx
call fcn.100020e7
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 1
call fcn.100020e7
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 2
call fcn.100020e7
lea ecx, [esi + 0x88]
mov byte [ebp - 4], 3
call fcn.100020e7
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 4
call fcn.100020e7
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 5
call fcn.100535af
lea ecx, [esi + 0xc4]
mov byte [ebp - 4], 6
call fcn.100535af
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1005a038
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1010a760
call fcn.100f4ca8
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
push 8
mov dword [edi], 0x1011a1c0
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
call fcn.100f4b9e
mov esi, eax
push 1
mov dword [ebp - 4], ebx
call fcn.100f42ef
pop ecx
pop ecx
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.1005af3a
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1005beba
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x1f4
cmp dword [ebp + 0x78], 1
jne 0x1005bf8e
push esi
push str.7z.dll_DLL_PROCESS_ATTACH
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 1
lea ecx, [ebp - 0x74]
call fcn.1005a187
push str.localappdata
lea ecx, [ebp + 0x54]
call fcn.1005a103
lea edx, [ebp + 0x54]
lea ecx, [ebp + 0x3c]
call fcn.1005ad03
mov edx, 0x1011a2b4
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.10059850
mov edx, esi
mov ecx, eax
call fcn.1005983b
mov edx, str.CiscoCisco_AnyConnect_Secure_Mobility_Client7z.exe__i
mov ecx, eax
call fcn.10059850
lea ecx, [ebp + 0x3c]
call fcn.1005b1fa
lea ecx, [ebp + 0x54]
call fcn.1005b1fa
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp - 0x5c]
call fcn.1005bb19
cmp dword [ebp + 0x68], 0xf
lea eax, [ebp + 0x54]
push 0
cmova eax, dword [ebp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [ebp + 0x54]
call fcn.1005b1fa
mov eax, dword [ebp + 0x74]
mov dword [0x1013ea50], eax
lea eax, [ebp - 0x188]
push eax
mov dword [ebp - 0x188], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
pop esi
test eax, eax
je 0x1005bf98
cmp dword [ebp - 0x178], 2
jne 0x1005bf98
lea ecx, [ebp - 0x74]
call fcn.1005aa42
xor eax, eax
inc eax
add ebp, 0x6c
leave
ret 0xc
lea ecx, [ebp - 0x74]
call fcn.1005aa42
xor eax, eax
jmp 0x1005bf91

Function at 0x1005d21e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x1010dd5c
call fcn.100f4ca8
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x18], ebx
mov word [esi + 0x1c], 0x100
mov dword [esi + 0x20], 1
call fcn.10002311
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], 0x40000000
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x100672ce
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1010dd5c
call fcn.100f4ca8
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.10067121
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.10067178
mov al, byte [esi + 0x18]
lea ecx, [edi + 0x24]
mov byte [edi + 0x18], al
mov al, byte [esi + 0x19]
mov byte [edi + 0x19], al
mov al, byte [esi + 0x1a]
mov byte [edi + 0x1a], al
mov al, byte [esi + 0x1b]
mov byte [edi + 0x1b], al
mov al, byte [esi + 0x1c]
mov byte [edi + 0x1c], al
mov al, byte [esi + 0x1d]
mov byte [edi + 0x1d], al
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
lea eax, [esi + 0x24]
push eax
mov byte [ebp - 4], 1
call fcn.10002270
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
mov dword [edi + 0x30], eax
mov eax, edi
mov dword [edi + 0x34], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4