joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416e52
and dword [ebp - 0x14], 0
cmp dword [0x46d558], 0
mov dword [ebp - 0x18], eax
jne 0x41fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46d560], eax
call edi
push eax
call esi
mov dword [0x46d568], eax
test eax, eax
je 0x41fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46d564], eax
mov eax, dword [0x46d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41fc78
cmp dword [0x46d568], ecx
je 0x41fc78
push eax
call esi
push dword [0x46d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41fc78
test ebx, ebx
je 0x41fc78
call edi
test eax, eax
je 0x41fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41fc6f
test byte [ebp - 8], 1
jne 0x41fc78
or dword [ebp + 0x10], 0x200000
jmp 0x41fcab
mov eax, dword [0x46d55c]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41fcab
mov eax, dword [0x46d560]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46d558]
call esi
test eax, eax
je 0x41fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004113cb
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x317c2deb
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x118f2417
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x100010a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov esi, edx
mov edx, dword [ecx]
push edi
mov dword [eax], edx
cmp dl, 0x6a
jne 0x100010fd
mov dx, word [ecx + 4]
mov word [eax + 4], dx
mov cl, byte [ecx + 6]
lea edx, [ebp - 4]
push edx
push 0x40
lea edi, [eax + 7]
push 7
push edi
mov byte [eax + 6], cl
add esi, 7
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 7
push esi
call ebx
sub esi, edi
sub esi, 5
mov dword [edi + 1], esi
mov byte [edi], 0xe9
mov ecx, 0x90909090
mov word [edi + 5], cx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov cl, byte [ecx + 4]
lea edx, [ebp - 4]
push edx
push 0x40
lea edi, [eax + 5]
push 5
push edi
mov byte [eax + 4], cl
add esi, 5
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call ebx
sub esi, edi
sub esi, 5
mov dword [edi + 1], esi
mov byte [edi], 0xe9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001140
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10015018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001186
push str.Error:_Unable_to_create_toolhelp_snapshot_
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d66d
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x130]
push eax
push esi
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10001174
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x100011b0
mov ecx, str.obs64.exe
lea eax, [ebp - 0x10c]
jmp 0x100011c0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100011e0
test dl, dl
je 0x100011dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100011e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100011c0
xor eax, eax
jmp 0x100011e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10001207
lea ecx, [ebp - 0x130]
push ecx
push esi
call edi
test eax, eax
jne 0x100011b0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000d66d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x128]
pop edi
xor ecx, ebp
pop esi
call fcn.1000d66d
mov esp, ebp
pop ebp
ret
Function at 0x100015a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10015018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x210], eax
xor eax, eax
mov dword [esi], 0
mov dword [esi + 4], eax
push str.psapi.dll
mov dword [esi + 8], eax
call edi
test eax, eax
jne 0x1000161a
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x20c]
push str._s_system32psapi.dll
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x10001621
push str.psapi.dll
call edi
mov ebx, eax
test ebx, ebx
je 0x1000164d
mov edx, dword [ebp - 0x210]
push edx
call edi
push str.GetModuleInformation
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xc
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, esi
pop ebx
call fcn.1000d66d
mov esp, ebp
pop ebp
ret 4
Function at 0x100019d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
lea eax, [ebp - 0x58]
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x4c]
cdq
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ecx
cmp eax, ecx
jbe 0x10001aee
nop
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
push 0x1c
lea ecx, [ebp - 0x34]
push ecx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x10001ad1
xor esi, esi
cmp dword [ebp - 0x24], 0x1000
jne 0x10001aa5
cmp dword [ebp - 0x20], 1
je 0x10001aa5
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_]
mov edx, dword [ebp - 0x28]
add esp, 4
lea ecx, [ebp - 8]
push ecx
push 0x40
mov esi, eax
mov eax, dword [ebp - 0x34]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10001aa5
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x10]
push ecx
push edx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x34]
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebx]
mov edx, dword [edx + 0xc]
push eax
mov eax, dword [ebp + 8]
push esi
push ecx
push eax
mov ecx, ebx
call edx
test eax, eax
jne 0x10001adc
mov edi, dword [ebp - 4]
add edi, dword [ebp - 0x28]
mov dword [ebp - 4], edi
test esi, esi
je 0x10001abc
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
cmp edi, dword [ebp - 0x18]
jb 0x10001a00
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
sub eax, esi
add eax, dword [ebp - 4]
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10001b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x10015018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63
lea eax, [ebp - 0x67]
push 0
push eax
call sub.MSVCR100.dll_memset
lea eax, [ebp - 0x68]
mov edx, esi
mov ecx, eax
add esp, 0xc
mov dword [ebp - 0x68], 0x632e6263
mov word [ebp - 0x64], 0x6d62
mov byte [ebp - 0x62], 0
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10001bc0
push 0x63
lea edx, [ebp - 0x67]
push 0
push edx
mov byte [ebp - 0x68], cl
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.CEBXn_MBG]
not cl
xor cl, 0xd3
mov byte [ebp + eax - 0x68], cl
inc eax
cmp eax, 0xf
jl 0x10001be0
lea eax, [ebp - 0x68]
lea edx, [esi + 0x64]
mov ecx, eax
sub edx, ecx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10001c00
mov edx, dword [str.d3d9.dll]
mov dword [esi + 0x32], edx
mov eax, dword [0x10010f48]
mov dword [esi + 0x36], eax
mov cl, byte [0x10010f4c]
mov byte [esi + 0x3a], cl
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, esi
call fcn.1000d66d
mov esp, ebp
pop ebp
ret
Function at 0x10004360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x10015018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
push 0x294
call esi
push 0x294
push 0
push eax
mov dword [0x1001a180], eax
call sub.MSVCR100.dll_memset
push 4
call esi
add esp, 0x14
pop esi
test eax, eax
je 0x100043a9
mov dword [eax], vtable.mSearch.0
mov dword [0x1001a188], eax
jmp 0x100043b3
mov dword [0x1001a188], 0
mov eax, dword [0x1001a180]
mov ecx, dword [eax + 0x90]
push ecx
call fcn.10001510
add esp, 4
test al, al
je 0x1000441d
push 0x63
lea edx, [ebp - 0x67]
push 0
push edx
mov byte [ebp - 0x68], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
mov cl, byte [eax + 0x10011cf0]
not cl
xor cl, 0xd3
mov byte [ebp + eax - 0x68], cl
inc eax
cmp eax, 0x2a
jl 0x100043e1
mov ecx, dword [0x1001a188]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
lea eax, [ebp - 0x68]
push eax
mov eax, dword [0x1001a180]
push str.d3d9.dll
push 0
push 0
push 0
add eax, 0x90
push eax
call edx
mov eax, dword [0x1001a180]
mov ecx, dword [eax + 0x90]
mov eax, dword [ecx + 2]
mov dword [0x100184bc], eax
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0xa8]
mov dword [0x100184a8], ecx
mov ecx, dword [eax + 0xe4]
mov dword [0x10018498], edx
mov edx, dword [eax + 0x1c]
mov dword [0x1001849c], ecx
mov ecx, dword [eax + 0xc0]
mov dword [0x100184ac], edx
mov edx, dword [eax + 0x164]
mov dword [0x100184a4], ecx
mov ecx, dword [ebp - 4]
mov dword [0x100184a0], edx
mov edx, dword [eax + 0x68]
xor ecx, ebp
mov dword [0x100184b4], edx
call fcn.1000d66d
mov esp, ebp
pop ebp
ret

Function at 0x10008b60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x1001a1e4], 0
je 0x10008c4f
mov eax, dword [0x1001a180]
mov ecx, dword [eax + 8]
mov edx, dword [ecx]
mov ecx, dword [eax + 0x34]
mov edx, dword [edx + ecx]
imul edx, dword [eax + 0x54]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov ecx, dword [edx + ecx + 0x14]
call fcn.100044c0
test eax, eax
jle 0x10008c4f
mov edx, dword [0x1001a180]
push esi
mov esi, dword [edx + 0x14c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call edi
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
mov ecx, 0x10008b10
sub ecx, esi
push 5
sub ecx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], ecx
call edi
mov ecx, dword [0x1001a1f0]
mov dword [0x1001a1d4], 0
call fcn.10008820
test eax, eax
js 0x10008c42
cmp dword [0x1001a204], 0
je 0x10008c0d
call fcn.10008790
test al, al
jne 0x10008c0d
cmp dword [0x1001a204], 0
jne 0x10008c3c
mov eax, dword [0x1001a1f4]
call fcn.10008870
mov ecx, dword [0x1001a1f0]
mov esi, eax
call fcn.10008820
push 0x1001a5e4
mov ecx, esi
mov edx, eax
call fcn.10004780
add esp, 4
mov byte [0x1001a3e2], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov byte [0x1001a3e2], 0
pop esi
mov esp, ebp
pop ebp
ret
mov byte [0x1001a3e2], 0
mov esp, ebp
pop ebp
ret
Function at 0x100090a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1001a2a4]
sub esp, 8
cmp eax, 1
jne 0x100090d3
fld dword [0x1001599c]
fstp dword [0x10018360]
fld dword [0x10015a20]
fstp dword [0x100194dc]
fld dword [0x10015a24]
jmp 0x10009221
cmp eax, 2
jne 0x100090f5
fld dword [0x10015a28]
fst dword [0x10018360]
fld dword [0x10015a2c]
fstp dword [0x100194dc]
jmp 0x10009221
cmp eax, 3
jne 0x1000911d
fld dword [0x1001599c]
fstp dword [0x10018360]
fld dword [0x10015a24]
fstp dword [0x100194dc]
fld dword [0x10015a28]
jmp 0x10009221
cmp eax, 4
jne 0x10009145
fld dword [0x10015a28]
fstp dword [0x10018360]
fld dword [0x10015a44]
fstp dword [0x100194dc]
fld dword [0x10015a48]
jmp 0x10009221
cmp eax, 5
jne 0x1000916d
fld dword [0x10015a4c]
fstp dword [0x10018360]
fld dword [0x10015a50]
fstp dword [0x100194dc]
fld dword [0x10015a54]
jmp 0x10009221
cmp eax, 6
jne 0x1000918f
fld dword [0x10015a24]
fst dword [0x10018360]
fld dword [0x10015a5c]
fstp dword [0x100194dc]
jmp 0x10009221
cmp eax, 7
jne 0x100091b4
fld dword [0x10015a64]
fstp dword [0x10018360]
fld dword [0x10015a68]
fstp dword [0x100194dc]
fld dword [0x10015a20]
jmp 0x10009221
cmp eax, 8
jne 0x100091d9
fld dword [0x10015a70]
fstp dword [0x10018360]
fld dword [0x10015a2c]
fstp dword [0x100194dc]
fld dword [0x10015a78]
jmp 0x10009221
cmp eax, 9
jne 0x100091fe
fld dword [0x10015a7c]
fstp dword [0x10018360]
fld dword [0x10015a80]
fstp dword [0x100194dc]
fld dword [0x10015a84]
jmp 0x10009221
cmp eax, 0xa
jne 0x10009227
fld dword [0x10015a88]
fstp dword [0x10018360]
fld dword [0x10015a54]
fstp dword [0x100194dc]
fld dword [0x10015a90]
fstp dword [0x1001835c]
cmp dword [0x1001a2a8], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
je 0x10009268
mov eax, dword [0x1001a180]
mov esi, dword [eax + 0x1b8]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push esi
call edi
mov ecx, dword [ebp - 4]
mov edx, 0x10009070
sub edx, esi
lea eax, [ebp - 8]
sub edx, 5
push eax
mov byte [esi], 0xe9
mov dword [esi + 1], edx
push ecx
jmp 0x10009298
mov edx, dword [0x1001a180]
mov esi, dword [edx + 0x1b8]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call edi
push 5
push 0x10012430
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push edx
push 5
push esi
call edi
pop edi
mov dword [0x1001a3e4], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b1f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x1000b25b
push esi
cmp ecx, edx
jne 0x1000b251
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x1000b213
mov esi, dword [eax]
mov dword [ecx], esi
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x1000b21f
mov esi, dword [eax]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x1000b22b
mov esi, dword [eax + 0x10]
mov dword [ecx], esi
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x1000b238
mov esi, dword [eax + 0x14]
mov dword [ecx + 4], esi
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x1000b244
mov esi, dword [eax + 0xc]
mov dword [esi], ecx
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x1000b251
mov esi, dword [eax + 0xc]
mov dword [ecx + 4], esi
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x1000b204
pop esi
ret

Function at 0x1000b260
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1001849c]
mov ecx, dword [eax + 1]
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
mov edi, dword [0x1001a5b0]
lea edx, [ebp - 4]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 0xa
push esi
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0xa
push edi
call ebx
sub edi, esi
mov byte [esi], 0xe9
sub edi, 5
mov dword [esi + 1], edi
mov edi, dword [0x1001a618]
mov eax, 0x90909090
mov dword [esi + 5], eax
mov byte [esi + 9], al
mov eax, dword [0x100184a4]
mov ecx, dword [eax + 1]
lea edx, [ebp - 8]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 0xa
push esi
call ebx
lea eax, [ebp - 8]
push eax
push 0x40
push 0xa
push edi
call ebx
sub edi, esi
mov byte [esi], 0xe9
sub edi, 5
mov dword [esi + 1], edi
mov edi, dword [0x1001a498]
mov eax, 0x90909090
mov dword [esi + 5], eax
mov byte [esi + 9], al
mov eax, dword [0x100184a0]
mov ecx, dword [eax + 1]
lea edx, [ebp - 4]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 0xa
push esi
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0xa
push edi
call ebx
sub edi, esi
sub edi, 5
mov dword [esi + 1], edi
mov byte [esi], 0xe9
mov eax, 0x90909090
mov dword [esi + 5], eax
pop edi
mov byte [esi + 9], al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bbb0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24c
mov eax, dword [0x10015018]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCR100.dll_sprintf]
push 0x10019910
lea eax, [esp + 0x154]
push str._s.
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, eax
lea eax, [esp + 0x3c]
push eax
push 0x10019910
lea ecx, [esp + 0x158]
push str._s_s
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x150]
push edx
call ebx
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000bc05
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000d66d
mov esp, ebp
pop ebp
ret
Function at 0x1000bc60
Capabilities:
Create thread
Delete file
Encode data using xor
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x10015018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
dec eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xd0], ecx
jne 0x1000be5b
push ebx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor ebx, ebx
push 0x63
lea eax, [ebp - 0x67]
push ebx
push eax
mov dword [0x1001a628], 0x10012750
mov dword [0x1001a5fc], 0x10012760
mov dword [0x1001a630], 0x10012770
mov dword [0x1001a41c], 0x10012780
mov dword [0x1001a5c4], 0x10012790
mov dword [0x1001a40c], 0x1001279c
mov dword [0x1001a624], 0x100127b0
mov dword [0x1001a5b4], 0x100127c0
mov byte [ebp - 0x68], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
mov cl, byte [eax + str.mKIJaCB]
not cl
xor cl, 0xd3
mov byte [ebp + eax - 0x68], cl
inc eax
cmp eax, 0xe
jl 0x1000bcf5
push ebx
push ebx
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push 0x63
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x100127e0]
not cl
xor cl, 0xd3
mov byte [ebp + eax - 0x68], cl
inc eax
cmp eax, 0x1f
jl 0x1000bd30
lea edx, [ebp - 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x63
lea eax, [ebp - 0x67]
push ebx
push eax
mov byte [ebp - 0x68], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x100127e0]
not cl
xor cl, 0xd3
mov byte [ebp + eax - 0x68], cl
inc eax
cmp eax, 0x1f
jl 0x1000bd70
push 0x63
lea edx, [ebp - 0xcb]
push ebx
push edx
mov byte [ebp - 0xcc], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + 0x10012800]
not cl
xor cl, 0xd3
mov byte [ebp + eax - 0xcc], cl
inc eax
cmp eax, 0x23
jl 0x1000bda0
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.MSVCR100.dll_rename]
add esp, 8
push 0x10019910
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.1000bbb0
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x1000ba50
push ebx
push ebx
call esi
push ebx
push ebx
push ebx
push 0x10009970
push ebx
push ebx
call esi
mov ecx, dword [0x1001a628]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x1000be59
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._new_object_fun_i3CollideeLine__SAPAV1_XZ
push esi
call edi
push str._SetStart_i3CollideeLine__QAEXPATVEC3D___Z
push esi
mov dword [0x1001723c], eax
call edi
push str._SetEnd_i3CollideeLine__QAEXPATVEC3D___Z
push esi
mov dword [0x10018cd4], eax
call edi
push str._RaycastClosest_i3PhysixContext__QAEPAUI3_PHYSIX_HIT_RESULT__PAVi3CollideeLine__HI_Z
push esi
mov dword [0x10019b48], eax
call edi
mov edx, dword [ebp - 0xd0]
mov dword [0x100198d0], eax
call fcn.1000b1f0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.1000d66d
mov esp, ebp
pop ebp
ret 0xc