joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011630
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x1006a800]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
sub esp, 0x28
mov esi, ecx
mov eax, esp
push 0
push 0xc1c
push 0
mov dword [eax], vtable.std::_Func_impl_no_alloc_enum_Rise::Network::EResult____cdecl___class_Rise::Network::Message_class_std::allocator_enum_std::byte___const____enum_Rise::Network::EResult__class_Rise::Network::Message_class_std::allocator_enum_std::byte___const__.0
mov dword [eax + 4], 0x100118e0
mov dword [eax + 0x24], eax
call fcn.100139e0
add esp, 0xc
mov eax, esp
push 0
push 0x13ec
push 0
mov dword [eax], vtable.std::_Func_impl_no_alloc_enum_Rise::Network::EResult____cdecl___class_Rise::Network::Message_class_std::allocator_enum_std::byte___const____enum_Rise::Network::EResult__class_Rise::Network::Message_class_std::allocator_enum_std::byte___const__.0
mov dword [eax + 4], 0x100118e0
mov dword [eax + 0x24], eax
call fcn.100139e0
add esp, 0x34
lea eax, [ebp - 0x9c]
push 0
push eax
push str.launcher.auth
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
cmp edi, 0xffffffff
je 0x10011718
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x10011718
cmp eax, 0x1000
jne 0x10011718
push 0
lea eax, [ebp - 0xa0]
push eax
push 0x1000
push 0x1006e0e0
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10011718
cmp dword [ebp - 0xa0], 0x1000
jne 0x10011718
lea eax, [ebp - 0xa8]
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x10011718
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1002efd1
mov esp, ebp
pop ebp
ret
Function at 0x10011e20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005215b
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x1006a800]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x12c], 0xf
mov byte [ebp - 0x140], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
lea eax, [ebp - 0x140]
mov byte [ebp - 4], 3
push eax
push 9
push 0x100693a8
mov dword [ebp - 0x144], 0
call fcn.100121f0
add esp, 0xc
lea ecx, [ebp - 0x144]
cmp dword [ebp - 0x12c], 0x10
lea eax, [ebp - 0x140]
cmovae eax, dword [ebp - 0x140]
push ecx
push 0x20119
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [edi], eax
test eax, eax
je 0x10011f03
or esi, 0xffffffff
jmp 0x10011fb9
push 0xff
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.10030b90
lea eax, [ebp - 0x128]
mov dword [ebp - 0x148], 0xff
push eax
push 4
push 0x100693f0
call fcn.100121f0
add esp, 0x18
lea ecx, [ebp - 0x148]
cmp dword [ebp - 0x114], 0x10
lea eax, [ebp - 0x128]
cmovae eax, dword [ebp - 0x128]
push ecx
lea ecx, [ebp - 0x110]
push ecx
push 0
push 0xffff
push eax
push 0x100552d0
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [edi], eax
push dword [ebp - 0x144]
test eax, eax
je 0x10011f8a
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0xfffffffe
jmp 0x10011fb9
cmp dword [ebp - 0x148], 0x25
jae 0x10011fa0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0xfffffffd
jmp 0x10011fb9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.100123a0
mov esi, 1
mov ecx, dword [ebp - 0x114]
cmp ecx, 0x10
jb 0x10011fef
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10011fe5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001205f
push ecx
push edx
call fcn.1002ea92
add esp, 8
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
cmp ecx, 0x10
jb 0x10012040
mov edx, dword [ebp - 0x140]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10012036
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001205f
push ecx
push edx
call fcn.1002ea92
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002efd1
mov esp, ebp
pop ebp
ret 4
call fcn.1003421f
int3
Function at 0x10012070
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
mov ebx, ecx
mov dword [ebp - 4], esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x100120a5
push dword [ebp - 4]
call fcn.10034683
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1001210a
mov edx, esi
test esi, esi
je 0x100120bf
nop
cmp dword [edx + 0x1a0], 6
je 0x100120e1
mov edx, dword [edx]
test edx, edx
jne 0x100120b0
mov eax, dword [ebx]
xor ecx, ecx
mov dword [eax], ecx
mov word [eax + 4], cx
test esi, esi
je 0x100120d6
push esi
call fcn.10034428
add esp, 4
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx]
mov eax, dword [edx + 0x194]
push esi
mov dword [ecx], eax
mov ax, word [edx + 0x198]
mov word [ecx + 4], ax
call fcn.10034428
add esp, 4
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x10012117
push esi
call fcn.10034428
add esp, 4
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10012120
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005219d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1006a800]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov esi, dword [ecx]
lea eax, [ebp - 0x28]
push eax
push 2
push 0x10069398
mov dword [ebp - 4], 1
call fcn.100121f0
add esp, 0xc
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [ebp - 0x14]
neg eax
sbb esi, esi
neg esi
cmp ecx, 0x10
jb 0x100121c8
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100121be
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100121e4
push ecx
push edx
call fcn.1002ea92
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002efd1
mov esp, ebp
pop ebp
ret
call fcn.1003421f
int3
Function at 0x100121f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov edx, 8
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002eaa0
lea ebx, [edi*8]
mov dword [ebp - 4], eax
add esp, 4
xor edx, edx
test ebx, ebx
jle 0x10012243
mov edi, dword [ebp + 8]
mov esi, eax
sub edi, esi
lea ecx, [edx + esi]
mov al, byte [edi + ecx]
xor al, dl
inc edx
mov byte [ecx], al
cmp edx, ebx
jl 0x10012231
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
mov ecx, edx
mov edi, edx
mov dword [ebp - 0x10], edi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10012250
sub ecx, ebx
sar ecx, 1
lea eax, [edx + ecx*2]
mov dword [ebp - 0x18], eax
cmp edx, eax
je 0x10012374
nop dword [eax]
mov dl, byte [edi]
mov ecx, dword [esi + 0x14]
mov edi, dword [esi + 0x10]
mov byte [ebp + 0xf], dl
mov dword [ebp - 8], ecx
cmp edi, ecx
jae 0x1001229e
lea eax, [edi + 1]
mov dword [esi + 0x10], eax
mov eax, esi
cmp ecx, 0x10
jb 0x10012291
mov eax, dword [esi]
mov byte [eax + edi], dl
mov byte [eax + edi + 1], 0
jmp 0x1001235f
mov eax, 0x7fffffff
sub eax, edi
cmp eax, 1
jb 0x1001238e
lea ebx, [edi + 1]
or ebx, 0xf
cmp ebx, 0x7fffffff
jbe 0x100122c3
mov ebx, 0x7fffffff
jmp 0x100122e1
mov edx, ecx
mov eax, 0x7fffffff
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x100122d9
mov ebx, 0x7fffffff
jmp 0x100122e1
lea eax, [edx + ecx]
cmp ebx, eax
cmovb ebx, eax
lea eax, [ebx + 1]
mov ecx, esi
push eax
call fcn.10009b00
cmp dword [ebp - 8], 0x10
lea ecx, [edi + 1]
mov dword [esi + 0x14], ebx
mov dword [ebp - 0xc], eax
lea ebx, [edi + eax]
mov dword [esi + 0x10], ecx
mov dword [ebp - 0x14], ebx
push edi
jb 0x10012347
mov ebx, dword [esi]
push ebx
push eax
call fcn.10030610
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov cl, byte [ebp + 0xf]
mov byte [eax], cl
mov ecx, dword [ebp - 8]
inc ecx
mov byte [eax + 1], 0
cmp ecx, 0x1000
jb 0x1001233b
mov edx, dword [ebx - 4]
add ecx, 0x23
sub ebx, edx
lea eax, [ebx - 4]
cmp eax, 0x1f
ja 0x10012393
mov ebx, edx
push ecx
push ebx
call fcn.1002ea92
add esp, 8
jmp 0x1001235a
push esi
push eax
call fcn.10030610
mov cl, byte [ebp + 0xf]
add esp, 0xc
mov byte [ebx], cl
mov byte [ebx + 1], 0
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
mov edi, dword [ebp - 0x10]
add edi, 2
mov dword [ebp - 0x10], edi
cmp edi, dword [ebp - 0x18]
jne 0x10012270
mov edx, dword [ebp - 4]
push edx
call fcn.1002eaa9
add esp, 4
cmp dword [esi + 0x14], 0x10
jb 0x10012385
mov esi, dword [esi]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10009ae0
call fcn.1003421f
int3
Function at 0x10013960
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
shl esi, 5
add esi, 0x1006f0f0
mov eax, dword [edi]
movzx edx, word [eax + 4]
mov eax, edx
mov dword [ebp + 8], eax
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10012c50
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x100139d4
cmp ecx, dword [esi + 4]
je 0x100139d4
movzx eax, byte [ebp + 0xc]
lea eax, [eax + eax*4]
mov ecx, dword [ecx + eax*8 + 0x34]
test ecx, ecx
je 0x100139d4
mov eax, dword [ecx]
push edi
call dword [eax + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100139e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052355
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x1006a800]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov bl, byte [ebp + 0x10]
mov cx, word [ebp + 0xc]
movzx eax, cl
xor eax, 0x811c9dc5
shl edi, 5
imul edx, eax, 0x1000193
add edi, 0x1006f0f0
movzx eax, cx
mov ecx, edi
shr eax, 8
mov dword [ebp - 4], 0
xor edx, eax
imul eax, edx, 0x1000193
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.10012c50
mov ecx, dword [eax + 4]
movzx eax, bl
lea esi, [eax + eax*4]
shl esi, 3
test ecx, ecx
je 0x10013a76
cmp ecx, dword [edi + 4]
je 0x10013a76
lea eax, [ebp + 0x14]
add ecx, 0x10
push eax
add ecx, esi
call fcn.100137b0
jmp 0x10013add
push 0x10003a70
push 0x10013190
push 2
push 0x28
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 1
push eax
call fcn.1002f489
lea eax, [ebp + 0x14]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x60]
add ecx, esi
push eax
call fcn.100137b0
lea eax, [ebp - 0x60]
mov ecx, edi
mov dword [ebp - 0x64], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x68]
push eax
push 0x100560c4
lea eax, [ebp - 0x74]
push eax
call fcn.10012d40
push 0x10003a70
push 2
push 0x28
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 3
push eax
call fcn.1002f099
mov ecx, dword [ebp + 0x38]
test ecx, ecx
je 0x10013af5
mov edx, dword [ecx]
lea eax, [ebp + 0x14]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002efd1
mov esp, ebp
pop ebp
ret
Function at 0x10013cd0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 4], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x10013e1a
mov esi, dword [ebx + 4]
lea eax, [edx - 1]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
lea eax, [edi + edi]
push eax
call fcn.10004580
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10013ded
movzx edx, byte [eax + 8]
mov ecx, dword [ecx]
xor edx, 0x811c9dc5
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
imul edx, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, edx
mov edx, dword [ebx + 0xc]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 8], edx
cmp edi, esi
jne 0x10013d6e
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10013de3
mov edx, dword [edx + 4]
movzx ebx, word [eax + 8]
cmp bx, word [edx + 8]
jne 0x10013daa
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
cmp edx, eax
je 0x10013da2
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0xc]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
jmp 0x10013de0
cmp edi, edx
je 0x10013dbd
nop
mov edx, dword [edx + 4]
cmp bx, word [edx + 8]
je 0x10013df6
cmp edi, edx
jne 0x10013db0
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 4], edi
mov dword [edx], eax
mov ebx, dword [ebp - 4]
mov eax, ecx
cmp ecx, esi
jne 0x10013d32
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0xc], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10013de0
push str.invalid_hash_bucket_count
call fcn.10017002
int3
Function at 0x10014670
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005173d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1006a800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [ebp + 8], 0
mov ecx, dword [edi + 0x48]
je 0x1001480c
test ecx, ecx
jne 0x100147c4
push dword [edi + 0x28]
call fcn.100057d0
add esp, 4
mov dword [edi + 0x34], eax
mov ecx, edi
call fcn.10013e50
mov dword [edi + 0x48], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push dword [edi + 0x34]
mov dword [ebp - 4], 0
push dword [edi + 0x28]
call ebx
test eax, eax
je 0x100147ae
push dword [edi + 0x34]
lea eax, [ebp + 8]
push eax
call fcn.10001de0
lea esi, [edi + 0x2c]
add esp, 8
cmp esi, eax
je 0x1001472e
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [esi]
mov dword [esi], ecx
test eax, eax
je 0x1001472e
push eax
call fcn.1002eaa9
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x1001473e
push eax
call fcn.1002eaa9
add esp, 4
push dword [edi + 0x34]
push dword [edi + 0x28]
push dword [esi]
call fcn.10030610
mov esi, dword [edi + 0x28]
mov edx, dword [edi + 0x48]
sub edx, esi
mov dword [ebp + 8], 0xe9
sub edx, 5
mov eax, dword [esi]
cmp al, 0xe8
movzx ecx, al
cmovne ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x13], edx
mov byte [ebp - 0x14], cl
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
movzx eax, byte [ebp - 0x10]
mov byte [esi + 4], al
mov eax, dword [edi + 0x34]
sub eax, 5
push eax
mov eax, dword [edi + 0x28]
add eax, 5
push 0x90
push eax
call fcn.10030b90
add esp, 0x18
lea eax, [ebp + 8]
push eax
push 0x20
push dword [edi + 0x34]
push dword [edi + 0x28]
call ebx
test eax, eax
jne 0x1001482e
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x38]
mov ebx, dword [edi + 0x44]
mov edx, dword [edi + 0x40]
mov ecx, edx
mov esi, dword [eax + 0x1c]
mov eax, ebx
shrd ecx, eax, 8
mov eax, ebx
mov byte [esi + 1], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, ebx
mov byte [esi], dl
shrd edx, eax, 0x18
mov eax, ebx
mov byte [esi + 4], bl
shr eax, 8
mov byte [esi + 5], al
mov eax, ebx
shr eax, 0x10
shr ebx, 0x18
mov byte [esi + 2], cl
mov byte [esi + 3], dl
mov byte [esi + 6], al
mov byte [esi + 7], bl
jmp 0x1001482e
test ecx, ecx
je 0x1001482e
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edi + 0x40], eax
mov eax, dword [edi + 0x38]
mov dword [edi + 0x44], ecx
mov eax, dword [eax + 0x1c]
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov eax, dword [edi + 0x38]
push dword [eax + 0x20]
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10014860
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005173d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1006a800]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [ebp + 8], 0
mov ecx, dword [edi + 0x48]
je 0x100149fc
test ecx, ecx
jne 0x100149b4
push dword [edi + 0x28]
call fcn.100057d0
add esp, 4
mov dword [edi + 0x34], eax
mov ecx, edi
call fcn.10014270
mov dword [edi + 0x48], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push dword [edi + 0x34]
mov dword [ebp - 4], 0
push dword [edi + 0x28]
call ebx
test eax, eax
je 0x1001499e
push dword [edi + 0x34]
lea eax, [ebp + 8]
push eax
call fcn.10001de0
lea esi, [edi + 0x2c]
add esp, 8
cmp esi, eax
je 0x1001491e
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [esi]
mov dword [esi], ecx
test eax, eax
je 0x1001491e
push eax
call fcn.1002eaa9
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x1001492e
push eax
call fcn.1002eaa9
add esp, 4
push dword [edi + 0x34]
push dword [edi + 0x28]
push dword [esi]
call fcn.10030610
mov esi, dword [edi + 0x28]
mov edx, dword [edi + 0x48]
sub edx, esi
mov dword [ebp + 8], 0xe9
sub edx, 5
mov eax, dword [esi]
cmp al, 0xe8
movzx ecx, al
cmovne ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x13], edx
mov byte [ebp - 0x14], cl
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
movzx eax, byte [ebp - 0x10]
mov byte [esi + 4], al
mov eax, dword [edi + 0x34]
sub eax, 5
push eax
mov eax, dword [edi + 0x28]
add eax, 5
push 0x90
push eax
call fcn.10030b90
add esp, 0x18
lea eax, [ebp + 8]
push eax
push 0x20
push dword [edi + 0x34]
push dword [edi + 0x28]
call ebx
test eax, eax
jne 0x10014a1e
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x38]
mov ebx, dword [edi + 0x44]
mov edx, dword [edi + 0x40]
mov ecx, edx
mov esi, dword [eax + 0x1c]
mov eax, ebx
shrd ecx, eax, 8
mov eax, ebx
mov byte [esi + 1], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, ebx
mov byte [esi], dl
shrd edx, eax, 0x18
mov eax, ebx
mov byte [esi + 4], bl
shr eax, 8
mov byte [esi + 5], al
mov eax, ebx
shr eax, 0x10
shr ebx, 0x18
mov byte [esi + 2], cl
mov byte [esi + 3], dl
mov byte [esi + 6], al
mov byte [esi + 7], bl
jmp 0x10014a1e
test ecx, ecx
je 0x10014a1e
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edi + 0x40], eax
mov eax, dword [edi + 0x38]
mov dword [edi + 0x44], ecx
mov eax, dword [eax + 0x1c]
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov eax, dword [edi + 0x38]
push dword [eax + 0x20]
push dword [edi + 0x48]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100159e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005252d
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x1006a800]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x80], 3
mov dword [ebp - 0x88], eax
jl 0x10015bbc
mov edi, dword [eax + 8]
mov esi, edi
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10015a40
sub esi, ecx
lea ecx, [ebp - 0x78]
sar esi, 1
call fcn.10014f50
lea eax, [edi + esi*2]
mov dword [ebp - 4], 0
push eax
push edi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x78]
call fcn.100169e0
lea ecx, [ebp - 0x78]
call fcn.10015350
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov edi, dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
setae byte [ebp - 0x79]
add edi, eax
mov dword [ebp - 0x8c], eax
mov ecx, eax
mov dword [ebp - 0x94], edi
xor esi, esi
xor bh, bh
cmp ecx, edi
je 0x10015aa9
cmp byte [ecx], 0x2d
jne 0x10015aa9
mov bh, 1
inc ecx
movzx eax, bh
xor edx, edx
xor bl, bl
mov dword [ebp - 0x84], eax
cmp ecx, edi
je 0x10015b01
nop word [eax + eax]
movzx eax, byte [ecx]
mov al, byte [eax + 0x10056108]
cmp al, 0xa
jae 0x10015aff
cmp edx, 0xccccccc
jb 0x10015af1
jne 0x10015aed
mov edi, dword [ebp - 0x94]
movzx esi, al
mov eax, dword [ebp - 0x84]
add eax, 7
cmp esi, eax
jbe 0x10015af4
mov bl, 1
jmp 0x10015afa
movzx esi, al
lea eax, [edx + edx*4]
lea edx, [esi + eax*2]
inc ecx
cmp ecx, edi
jne 0x10015ac0
xor esi, esi
mov edi, dword [ebp - 0x8c]
mov eax, ecx
sub eax, edi
cmp eax, dword [ebp - 0x84]
jne 0x10015b1a
mov edx, 0x16
jmp 0x10015b30
test bl, bl
je 0x10015b25
mov edx, 0x22
jmp 0x10015b30
mov esi, edx
neg esi
test bh, bh
cmove esi, edx
xor edx, edx
xor eax, eax
mov ecx, 0x10055334
test edx, edx
cmove eax, esi
nop dword [eax]
cmp dword [ecx + 4], eax
je 0x10015b50
add ecx, 0x14
cmp ecx, str.Russian
jne 0x10015b40
cmp ecx, str.Russian
jne 0x10015b5f
mov eax, 0x10055334
jmp 0x10015b80
sub ecx, 0x10055334
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
lea eax, [eax*4 + 0x10055334]
cmp byte [ebp - 0x79], 0
mov dword [section..data], eax
je 0x10015bb6
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10015bac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10015bdf
push ecx
push edx
call fcn.1002ea92
add esp, 8
mov eax, dword [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002efd1
mov esp, ebp
pop ebp
ret
call fcn.1003421f
int3