joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498680
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5f000]
push edi
jmp 0x49869a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4986a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x498690
mov eax, 1
add ebx, ebx
jne 0x4986b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4986c4
jne 0x4986e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4986e3
dec eax
add ebx, ebx
jne 0x4986d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4986a8
add ebx, ebx
jne 0x4986df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x498735
xor ecx, ecx
sub eax, 3
jb 0x4986fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49876a
sar eax, 1
mov ebp, eax
jmp 0x498706
add ebx, ebx
jne 0x498706
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4986d4
inc ecx
add ebx, ebx
jne 0x498714
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4986d4
add ebx, ebx
jne 0x498721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x498716
jne 0x498732
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x498716
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x498754
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x498746
jmp 0x498696
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x498754
add edi, ecx
jmp 0x498696
pop esi
mov edi, esi
mov ecx, 0x420b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x498772
cmp byte [edi], 0x16
jne 0x498772
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x498777
lea edi, [esi + 0x95000]
mov eax, dword [edi]
or eax, eax
je 0x4987ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa5004]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa5108]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4987a4
mov ecx, edi
jns 0x4987d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa510c]
or eax, eax
je 0x4987e9
mov dword [ebx], eax
add ebx, 4
jmp 0x4987c1
call dword [esi + 0xa511c]
mov ebp, dword [esi + 0xa5110]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x498823
sub esp, 0xffffff80
jmp 0x4518f9
Function at 0x42a0b6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x42a0c5
pop dword [ebp - 0x14]
mov eax, 0x4b5d1d7
add eax, 0xfb8cceee
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x4f05c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x446b64ab
sub ecx, 0x446b2108
mov esi, eax
mov edi, 0x240de0e0
add edi, 0xdc397d20
add edi, dword [ebp - 0x14]
mov ebx, 0x501b68e2
add ebx, 0x9cb45522
sub dword [ebp - 4], 0xc2adce62
mov edx, dword [edi]
xor dword [ebp - 0x10], 0x1fef3269
sub edx, ebx
mov dword [esi], edx
xor dword [ebp - 0xc], 0xacbbe8be
add esi, 4
add edi, 4
loop 0x42a11f
add eax, 0x1c237853
add eax, 0xe3dd890c
xor ebx, ebx
add ebx, eax
add eax, 0x7413ab57
sub eax, 0x7413ab52
mov ecx, 0x6a5b10f5
sub ecx, 0x6a1b10f5
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x4468bb
Capabilities:
Create http request
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
push dword [ebx]
mov dword [ebp - 8], eax
mov edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
push eax
call main
mov esi, eax
test esi, esi
js 0x446a23
xor eax, eax
push eax
push eax
push eax
push eax
push str.Burn
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
jne 0x44694a
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x44692e
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x446935
mov esi, 0x80004005
push esi
push 0x84
push str.c:_agent_work138_s_srclibsdutildlutil.cpp
call fcn.004038f5
jmp 0x446a23
lea eax, [ebp - 4]
push eax
push 0x78
push str.DownloadTimeout
push str.WiXBurn
call main
mov eax, dword [ebp - 4]
test eax, eax
je 0x446996
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 2
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 5
push edi
call esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call main
mov esi, eax
test esi, esi
js 0x446a23
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
call main
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call main
mov esi, eax
test esi, esi
js 0x446a14
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x446a14
xor ecx, ecx
cmp word [eax], cx
je 0x446a14
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
cmp dword [ebp - 0xc], 0xffffffff
je 0x446a23
push dword [ebp - 0xc]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x446a30
push eax
call main
test edi, edi
je 0x446a3b
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], 0
je 0x446a49
push dword [ebp - 8]
call main
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40633c
pop dword [ebp - 8]
mov eax, 0x40633c
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xb3386318
sub dword [ebp - 0x18], 0x64e61dcd
mov dword [ebp - 0x14], 0xe0cec6d3
add dword [ebp - 0x14], 0x51648572
mov dword [ebp - 0x10], 0x56baca62
add dword [ebp - 0x10], 0xf59179cc
mov dword [ebp - 0xc], 0xbd5df6aa
add dword [ebp - 0xc], 0x42a20956
lea eax, [ebp - 0x18]
push eax
mov eax, 0xa5ae3546
sub eax, 0xa56dc4e6
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x61145b26
add dword [ebp - 0x18], 0x135e0e30
mov dword [ebp - 0x14], 0x12999f9f
add dword [ebp - 0x14], 0x2ed2c1d6
mov dword [ebp - 0x10], 0xad680d6f
add dword [ebp - 0x10], 0xb6075efd
mov dword [ebp - 0xc], 0xe6856b4c
sub dword [ebp - 0xc], 0xe6856b4c
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x35fbd
push 0
call eax
mov ecx, 0xb9e84381
add ecx, 0x461801f5
xor ebx, ebx
add ebx, eax
mov esi, 0x78e61fa
sub esi, 0x74d61fa
add esi, dword [ebp - 8]
mov edi, 0x5638f005
add edi, 0xec899b35
sub dword [ebp - 4], edi
mov edx, dword [esi]
sub dword [ebp - 4], edx
xor edx, edi
xor dword [ebp - 4], 0x6e996301
mov dword [ebx], edx
add dword [ebp - 4], 0xc5d9c32a
add ebx, 4
add esi, 4
loop 0x406456
add eax, 0xf9152536
sub eax, 0xf9141c8b
mov ebx, eax
add eax, 0x8ca3ae7d
sub eax, 0x8ca3ae78
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x100011c0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100011d5
xor eax, eax
jmp 0x1000124a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x10001202
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001245
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001243
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x1000123f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001243
xor eax, eax
jmp 0x1000124a
jmp 0x100011f9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100012b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x102bb59c]
mov dword [ebp - 4], eax
jmp 0x100012c9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100012e6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100012c0
mov esp, ebp
pop ebp
ret
Function at 0x100012f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x102bb5ac], eax
je 0x1000130e
mov eax, 0x10dd
jmp 0x100013ef
mov eax, dword [0x102bb5bc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000138c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000136a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1000136a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.100010a0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.100d9df9
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10001316
mov dword [0x102bb5bc], 0
call fcn.10001250
mov ecx, dword [0x102bb5b8]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x100013d9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100d9df9
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x100013a4
mov dword [0x102bb5b8], 0
mov dword [0x102bb5ac], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100018e0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x102bb5b0], 0
je 0x100018f9
mov eax, dword [0x102bb5b0]
jmp 0x10001999
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000190b
xor eax, eax
jmp 0x10001999
push 8
call fcn.100da41a
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001961
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1000194a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100d9df9
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x102bb5b0], eax
mov dword [0x102bb5b4], 0
mov eax, dword [ebp - 8]
jmp 0x10001999
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1000197b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1000192b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x102bb5b8]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x102bb5b8], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x100038d5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and ecx, 0xfffffffc
mov esp, ecx
mov ebp, dword [esp + 0x30]
mov ecx, 0xfffffff8
mov eax, 2
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
add ebx, 0xb10
mov esi, dword [edx - 4]
mov dword [edx - 4], 0xfffffffe
mov dword [ebx - 0xa44], 0xffffffff
jmp 0x1000380b

Function at 0x10007ae0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x10007afb
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10007b06
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10007b11
bts eax, 5
shr ecx, 1
test cl, 1
je 0x10007b1c
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10007b27
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10007b32
bts eax, 2
shr ecx, 1
test cl, 1
je 0x10007b3d
bts eax, 1
test cl, 2
je 0x10007b46
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10007be2
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10007bd3
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10007af0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007c10
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x10132424
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10007c4a
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10007c78
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x10007cd0
push esi
nop
mov esi, ebx
test eax, eax
je 0x10007cb7
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10007c96
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10007c90
pop esi
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp + 0xc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000b410
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x1000b350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 1
push 0x1000b350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 2
push 0x1000b350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 3
push 0x1000b350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 4
push 0x1000b350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
test eax, eax
je 0x1000b4a3
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000c330
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 4]
mov byte [0x62ebf7], 0x69
push eax
push dword [ebp - 4]
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee41
call esi
lea eax, [ebp - 4]
mov byte [0x62ee41], 0x69
push eax
push dword [ebp - 4]
push 1
push 0x62ee41
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee4
call esi
lea eax, [ebp - 4]
mov byte [0x62eee4], 0x69
push eax
push dword [ebp - 4]
push 1
push 0x62eee4
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 4]
mov byte [0x62ebf8], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 4]
mov byte [0x62ebfe], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee42
call esi
lea eax, [ebp - 4]
mov byte [0x62ee42], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x62ee42
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee48
call esi
lea eax, [ebp - 4]
mov byte [0x62ee48], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x62ee48
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee5
call esi
lea eax, [ebp - 4]
mov byte [0x62eee5], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x62eee5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eeeb
call esi
lea eax, [ebp - 4]
mov byte [0x62eeeb], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x62eeeb
call esi
push 0x1000bd40
push 0x520ecf
push 0xe8
call fcn.100caf90
push 0x1000bd40
push 0x520f1f
push 0xe8
call fcn.100caf90
push 0x1000bd40
push 0x63e743
push 0xe8
call fcn.100caf90
push 0x1000bd40
push 0x640eb2
push 0xe8
call fcn.100caf90
push 0x1000bd40
push 0x7d2dd9
push 0xe8
call fcn.100caf90
push 0x1000bd40
push 0x7e6c0f
push 0xe8
call fcn.100caf90
add esp, 0x48
push 0x1000bd40
push 0x84aef7
push 0xe8
call fcn.100caf90
push 0x1000c180
push 0x4dada4
push 0xe8
call fcn.100caf90
push 0x1000c070
push 0x63e71b
push 0xe8
call fcn.100caf90
push 0x1000c070
push 0x63eeb6
push 0xe8
call fcn.100caf90
push 0x1000c070
push 0x6410ee
push 0xe8
call fcn.100caf90
push 0x1000bdb0
push 0x47e15a
push 0xe8
call fcn.100caf90
add esp, 0x48
push 0x1000c2b0
push 0x54ee78
push 0xe9
call fcn.100caf90
push 0x1000c2d0
push 0x54ffb7
push 0xe9
call fcn.100caf90
push 0x1000c2f0
push 0x5880ad
push 0xe9
call fcn.100caf90
push 0x1000c310
push 0x560ce6
push 0xe9
call fcn.100caf90
add esp, 0x30
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10017c50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, 0x791100
call eax
mov esi, eax
mov ebx, 0x102e9b70
sub ebx, esi
mov edi, 0x100
nop dword [eax]
cmp byte [ebx + esi], 1
jne 0x10017c98
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov byte [esi], 1
push eax
push dword [ebp - 4]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
sub edi, 1
jne 0x10017c70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017cb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov eax, 0x791100
call eax
mov esi, eax
mov ebx, 0x102e9b70
sub ebx, esi
mov edi, 0x100
nop dword [eax]
mov byte [ebx + esi], 0
cmp byte [esi], 1
jne 0x10017cfb
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
mov byte [esi], 0
push eax
push dword [ebp - 4]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
sub edi, 1
jne 0x10017cd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017d60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push 0x4da3c7
call esi
mov eax, 0x4da3c7
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 6
push 0x4da3c7
call esi
push 0x10017d30
push 0x4da3c7
push 0xe8
call fcn.100caf90
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x4da3d8
call esi
mov eax, 0x4da3d8
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x4da3d8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 7
push 0x4da3dd
call esi
mov eax, 0x4da3dd
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 7
push 0x4da3dd
call esi
push 0x10018050
push 0x4d5ec3
push 0xff
call fcn.100caf90
push 0x10017f60
push 0x4d79c3
push 0xff
call fcn.100caf90
push 0x10017c10
push 0x4d9d59
push 0xe8
call fcn.100caf90
add esp, 0x24
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0xd456a4
call esi
lea eax, [ebp - 4]
mov dword [0xd456a4], 0x10017d50
push eax
push dword [ebp - 4]
push 4
push 0xd456a4
call esi
push 0x10017bb0
push 0x74cd7d
push 0xe9
call fcn.100caf90
push 0x10017b60
push 0x51e29d
push 0xe8
call fcn.100caf90
push 0x10017ab0
push 0x588357
push 0xff
call fcn.100caf90
push 0x10017ab0
push 0x5883f4
push 0xff
call fcn.100caf90
push 0x10017ab0
push 0x588505
push 0xff
call fcn.100caf90
push 0x10017ab0
push 0x588617
push 0xff
call fcn.100caf90
add esp, 0x48
push 0x10017ab0
push 0x588661
push 0xff
call fcn.100caf90
push 0x10017ab0
push 0x58876e
push 0xff
call fcn.100caf90
push 0x10017ab0
push 0x5887ad
push 0xff
call fcn.100caf90
push 0x10017d10
push 0x4dac5c
push 0xe9
call fcn.100caf90
push 0x10017be0
push 0x4d9f10
push 0xe9
call fcn.100caf90
add esp, 0x3c
pop esi
mov esp, ebp
pop ebp
ret