joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4367a3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x436840
push ebx
push esi
call fcn.0043676c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00436700
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4367ed
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43683f
push edi
push eax
call fcn.004373c0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43680d
call fcn.00435261
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43683e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00436700
add esp, 0x20
test eax, eax
jne 0x43682c
push edi
call fcn.00435261
jmp 0x436834
push ebx
call fcn.00435261
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x437b3d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x446348
push 0x446340
push str.FlsAlloc
push 0x1f
call fcn.004379fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x437b71
push dword [ebp + 8]
mov ecx, esi
call dword [0x43f1b4]
call esi
jmp 0x437b77
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x437bbb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x446358
push 0x446350
push str.FlsGetValue
push 0x21
call fcn.004379fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x437bf2
push dword [ebp + 8]
mov ecx, esi
call dword [0x43f1b4]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x437bfa
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x446360
push 0x446358
push str.FlsSetValue
push 0x22
call fcn.004379fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x437c34
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43f1b4]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x43d090
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43d0bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43d0bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x43d9d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x43da4a
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x43da85
cmp dword [esp + 4], 0
je 0x43da6c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x43daa8
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x44da80]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x44da80], edi
jne 0x43da30
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x43da7c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x43daef
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x43da70
mov esi, dword [esp]
jmp 0x43da7c
mov esi, dword [edi]
jmp 0x43da7b
mov esi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 0x10], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x441f04
push 0x441f38
push eax
call fcn.0043d5e0
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov dword [esp + 0x10], 0x441f5c
mov dword [esp + 0x14], 1
mov dword [esp + 8], 0
mov dword [esp + 0x18], 0x43fb98
mov dword [esp + 0x1c], 0
lea eax, [esp + 8]
push 0x441f64
push eax
call fcn.0043e0e0
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x441f5c
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0x43fb98
mov dword [esp + 0x1c], 0
call fcn.0043d580
ud2
Function at 0x4011c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x438280], 0x24e1
mov eax, dword [0x438280]
sub eax, 0x24e1
mov dword [0x438280], eax
mov ecx, 1
test ecx, ecx
je 0x40126b
mov edx, dword [0x438280]
cmp edx, dword [ebp + 0xc]
jb 0x4011f7
jmp 0x40126b
cmp dword [0x438280], 0
jne 0x401215
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401215
xor eax, eax
jmp 0x40126b
mov eax, dword [ebp + 8]
add eax, dword [0x438280]
mov ecx, dword [eax]
add ecx, dword [0x438280]
mov edx, dword [ebp + 8]
add edx, dword [0x438280]
mov dword [edx], ecx
mov dword [ebp - 4], 0x21
mov eax, dword [0x438280]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x438280]
push eax
call fcn.00401270
add esp, 8
mov ecx, dword [0x438280]
add ecx, 4
mov dword [0x438280], ecx
jmp 0x4011dd
mov esp, ebp
pop ebp
ret

Function at 0x401450
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7ec
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp dword [ebp - 0x1c], 0
jne 0x4014ac
xor eax, eax
jmp 0x401814
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x7ec], str.SOFTWARE11asses
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 7
jmp loc.0045c000
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4019f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x114], str._system32777.dll
push 0x104
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp - 0x114]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401a5f
cmp dword [ebp - 0x118], 0
je 0x401a5f
jmp 0x401ac3
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x401ac3
mov dword [ebp - 0x11c], 0x15f
mov edx, dword [ebp + 8]
add edx, 8
mov dword [0x438274], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [0x438290], ecx
mov dword [ebp - 0x11c], 0x15f
mov dword [ebp - 0x11c], 0x15f
call fcn.004011b0
mov edx, dword [ebp + 8]
mov dword [0x43828c], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
call fcn.004013b0
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401a5f
mov esp, ebp
pop ebp
ret
Function at 0xb0b53cb
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 0x40
push 4
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov dword [ebx], edi
push eax
push dword [ebp - 4]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop ebx
leave
ret

Function at 0xb0bfd02
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
pushal
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp - 8]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [0xb08e3bc]
add esp, 8
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0xb0c183a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov edi, ecx
push eax
push 0x40
push 1
push edi
mov bl, dl
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov byte [edi], bl
push eax
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop ebx
leave
ret
Function at 0xb0ce575
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
pushal
mov eax, dword [ebp - 8]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [0xb0a6994]
add esp, 8
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0xb0ceca5
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp dword [eax + 0x10], 0
je 0xb0ced5e
cmp dword [eax + 0x14], 0xf
jbe 0xb0cecc0
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], eax
call fcn.0b0de741
test al, al
je 0xb0ced5e
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.0b0ced65
lea eax, [ebp + 0xc]
mov ecx, esi
push eax
push edi
call fcn.0b0cee0e
push ecx
push edi
call fcn.0b0cf05e
lea eax, [ebp + 8]
mov ecx, edi
push eax
push 0x40
push 0x1000
call fcn.0b0de661
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp + 0xc]
call fcn.0b0de677
mov ecx, edi
mov esi, eax
call fcn.0b0de677
mov ecx, dword [esi + 0x68]
mov edx, dword [esi + 0x6c]
mov dword [eax + 0x68], ecx
lea ecx, [ebp + 0xc]
mov dword [eax + 0x6c], edx
call fcn.0b0de661
movzx ecx, word [eax + 6]
imul ecx, ecx, 0x28
add ecx, 0xf8
push ecx
push eax
mov ecx, edi
call fcn.0b0de661
push eax
call fcn.0b0f4200
add esp, 0xc
lea ecx, [ebp + 0xc]
call fcn.0b0de728
add eax, dword [edi]
pop edi
jmp 0xb0ced60
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0xb0ced65
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x24
mov eax, 0xb11b446
call fcn.0b0f33fc
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x24]
push eax
call fcn.0b0de690
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
cmp esi, ebx
je 0xb0cede2
mov edx, dword [ebp + 0xc]
mov edi, dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0xc]
mov eax, dword [eax]
add ecx, eax
mov dword [ebp - 0x10], ecx
add eax, 0xa000000
mov ecx, dword [edi + 0x14]
add ecx, dword [edx]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, eax
jae 0xb0cedf2
cmp dword [edi + 0x10], 0
jbe 0xb0ceddb
lea eax, [ebp - 0x18]
push eax
push 0x40
push dword [edi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [edi + 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0b0f4200
mov edx, dword [ebp + 0xc]
add esp, 0xc
add esi, 4
cmp esi, ebx
jne 0xb0ced8e
lea ecx, [ebp - 0x24]
call fcn.0b0c84c9
call fcn.0b0f33d9
ret 8
push 0xb0a6aac
lea ecx, [ebp - 0x30]
call fcn.0b0bf689
push 0xb0b2a9c
lea eax, [ebp - 0x30]
push eax
call fcn.0b0f418e
int3
Function at 0xb0cf05e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0b0de677
cmp dword [eax + 0xac], 0
je 0xb0cf163
push ebx
push edi
call fcn.0b0cf37c
mov edi, eax
mov ecx, esi
mov dword [ebp - 0xc], edi
call fcn.0b0de677
mov ecx, dword [eax + 0xa8]
add ecx, dword [esi]
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
mov ebx, dword [ecx + 4]
mov esi, dword [ecx + 8]
sub ebx, eax
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [eax]
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 4]
mov dword [esi], eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 4
push esi
call edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov esi, dword [ebp - 0xc]
mov esi, dword [esi + 0xc]
test esi, esi
je 0xb0cf11a
lea eax, [ebp + 8]
push eax
push 0x40
push 4
push esi
call edi
and dword [esi], 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 4
push esi
call edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0x14]
push eax
push 4
push ebx
push dword [ebp - 8]
call edi
mov eax, dword fs:[0x2c]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
push ebx
push esi
push dword [eax + ecx*4]
call fcn.0b0f4200
push ebx
push esi
push dword [ebp - 8]
call fcn.0b0f4200
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x14]
add esp, 0x18
push eax
push 4
push 0x18
push ebx
call edi
mov esi, dword [ebp - 0x18]
mov edi, ebx
push 6
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0xb0cf857
Capabilities:
Set current directory

Disassembly:
push 0x28
mov eax, 0xb11b619
call fcn.0b0f3465
push 0xb0cf5ae
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 1
call dword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
call fcn.0b0cf7be
push ebx
call fcn.0b100c59
pop ecx
mov edi, eax
mov dword [ebp - 0x24], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
imul esi, eax
not esi
xor esi, edi
push esi
call fcn.0b100c47
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 1
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
mov dword [esp], 0xb0a6c3c
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0b100c1e
add esp, 0xc
test eax, eax
jne 0xb0cf8fb
cmp dword [ebp - 0x18], eax
je 0xb0cf8fb
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
push dword [ebp - 0x18]
call fcn.0b0f77c5
pop ecx
call fcn.0b0ce7ff
test al, al
jne 0xb0cf90d
mov dword [ebp - 4], 2
jmp 0xb0cf928
call fcn.0b0cf732
mov esi, eax
test esi, esi
je 0xb0cf97b
call fcn.0b0ce850
test al, al
jne 0xb0cf937
mov dword [ebp - 4], 3
cmp byte [ebp - 0x11], 0
je 0xb0cf933
call fcn.0b0ce8a6
xor eax, eax
jmp 0xb0cf975
mov byte [ebp - 0x11], bl
or dword [ebp - 4], 0xffffffff
call esi
jmp 0xb0cf975
call fcn.0b0f33d9
ret
push 0xb0a6c48
lea ecx, [ebp - 0x34]
call fcn.0b0bf689
push 0xb0b2a9c
lea eax, [ebp - 0x34]
push eax
call fcn.0b0f418e
int3
Function at 0xb0d2262
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0xa401080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x114], esi
mov eax, dword fs:[0x2c]
push edi
mov ecx, dword [eax]
mov eax, dword [0xb06521c]
cmp eax, dword [ecx + 0x98]
jg 0xb0d2362
cmp dword [0xa41487c], ebx
jne 0xb0d2338
lea eax, [ebp - 0x118]
push eax
push 1
push ebx
push 0xb0a6e40
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb0d2338
mov edi, 0x104
lea eax, [ebp - 0x110]
push edi
push ebx
push eax
call fcn.0b0f4780
add esp, 0xc
mov dword [ebp - 0x114], edi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
push ebx
push 0xb0a6e58
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb0d231d
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
mov ecx, 0xa41486c
call fcn.0b0bfb00
mov byte [ebp - 0x114], bl
mov edx, 0xa41486c
push dword [ebp - 0x114]
mov ecx, esi
call fcn.0b0d2c0e
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0b0f26c9
leave
ret
mov edi, 0xb06521c
push edi
call fcn.0b0f2d4a
cmp dword [0xb06521c], 0xffffffff
pop ecx
jne 0xb0d22a1
push 0xb11ca60
call fcn.0b0f2cb9
pop ecx
push edi
call fcn.0b0f2cf9
pop ecx
jmp 0xb0d22a1

Function at 0xb0d300c
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
mov dword [0xa419fa8], 0xea60
push esi
mov eax, 0x1f4
mov dword [0xa419fa4], ebx
push edi
push ebx
mov dword [0xa419fa0], eax
mov dword [0xa419fac], ebx
mov dword [0xa419fb0], eax
mov dword [0xa419fb4], ebx
mov dword [0xa419fb8], ebx
call fcn.0b100c59
mov esi, eax
mov dword [0xa419fcc], edx
mov eax, 0x55555555
mov dword [0xa419fc8], esi
xor edi, edi
mov dword [0xa41b348], eax
pop ecx
mov dword [0xa41b34c], eax
inc edi
push 0x5851f42d
mov ecx, edx
xor eax, eax
push 0x4c957f2d
shr ecx, 0x1e
xor eax, edx
xor ecx, esi
push eax
push ecx
call fcn.0b0f35c0
mov esi, eax
mov eax, 0x138
add esi, edi
mov dword [edi*8 + 0xa419fc8], esi
adc edx, ebx
mov dword [edi*8 + 0xa419fcc], edx
inc edi
cmp edi, eax
jb 0xb0d3069
movaps xmm0, xmmword [0xb0abde0]
pop edi
pop esi
mov dword [0xa419fc0], eax
mov eax, 0xa419fa0
movaps xmmword [0xa41b350], xmm0
pop ebx
ret 0x10

Function at 0xb0d326a
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0xb11ba51
call fcn.0b0f33fc
mov esi, dword [0xb060db0]
xor edi, edi
mov al, 1
xchg byte [esi], al
push 4
call fcn.0b0f26e5
mov dword [ebp - 0x10], eax
mov dword [eax], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
push eax
push 0xb0d4399
push edi
push edi
call fcn.0b10029a
add esp, 0x1c
mov dword [ebp - 0x18], eax
test eax, eax
je 0xb0d32c9
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0x5c]
call fcn.0b0ca6c5
cmp dword [ebp - 0x14], edi
jne 0xb0d32c4
call fcn.0b0f33d9
ret
call fcn.0b100102
push 6
mov dword [ebp - 0x14], edi
call fcn.0b0f1d11
int3
Function at 0xb0d46d1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0xa401080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xb
mov ebx, ecx
lea edi, [ebp - 0x34]
pop ecx
mov esi, 0xb0a7358
rep movsd dword es:[edi], dword [esi]
push 0x30
pop eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
mov word [ebp - 0xa], ax
jmp 0xb0d473d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0xb0d4723
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0xb0d476a
inc ax
mov word [ebp - 0xa], ax
jmp 0xb0d473d
cmp eax, 0xe7
jne 0xb0d476a
push 0x2710
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0xb0d476a
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call esi
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0xb0d4706
mov byte [ebx], 1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0b0f26c9
leave
ret
xor al, al
jmp 0xb0d475b

Function at 0xb0d72fd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 4], edi
mov eax, esi
test edx, edx
je 0xb0d7332
cmp word [edx], di
je 0xb0d7332
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0xb0d735b
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push edi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
mov edi, eax
test ecx, ecx
je 0xb0d7359
cmp ecx, esi
je 0xb0d7359
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0xb0dac25
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push 4
pop edx
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0xb0917c0]
sub edx, 1
jne 0xb0dac28
mov eax, ecx
ret
Function at 0xb0db1b9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 4], ebx
lea esi, [ebx + 0x1c]
mov ecx, esi
call fcn.0b0ca65a
cmp byte [ebx], 0
je 0xb0db23c
cmp byte [ebx + 1], 0
jne 0xb0db23c
mov eax, dword [ebp - 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [ebx + 1], 1
add ebx, 0x18
push ebx
push 0x40
push 5
push dword [eax + 4]
call edi
mov edx, dword [ebp - 4]
push ebx
mov ecx, dword [edx + 4]
cmp byte [edx + 0x15], 0
mov eax, dword [ecx]
mov dword [edx + 0x10], eax
mov al, byte [ecx + 4]
mov byte [edx + 0x14], al
setne al
add al, 0xe8
mov byte [ecx], al
mov eax, dword [edx + 8]
sub eax, dword [edx + 4]
sub eax, 5
mov dword [ecx + 1], eax
push dword [ebx]
mov ebx, edx
push 5
push dword [ebx + 4]
call edi
mov edi, dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
push esi
call fcn.0b0f0d6b
pop ecx
pop esi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0xb0db24b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 4], ebx
lea esi, [ebx + 0x1c]
mov ecx, esi
call fcn.0b0ca65a
cmp byte [ebx], 0
je 0xb0db2b7
cmp byte [ebx + 1], 0
je 0xb0db2b7
mov eax, dword [ebp - 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [ebx + 1], 0
add ebx, 0x18
push ebx
push 0x40
push 5
push dword [eax + 4]
call edi
mov edx, dword [ebp - 4]
push ebx
mov ecx, dword [edx + 4]
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov al, byte [edx + 0x14]
mov byte [ecx + 4], al
push dword [ebx]
mov ebx, edx
push 5
push dword [ebx + 4]
call edi
mov edi, dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
push esi
call fcn.0b0f0d6b
pop ecx
pop esi
mov eax, ebx
pop ebx
leave
ret 4

Function at 0xb0db2c6
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov edi, edx
push eax
push 0x40
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x90
push ebx
call fcn.0b0f4780
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop ebx
leave
ret