joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e930
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1006c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.Injecting_CustomOpcodeSystem...
push 3
call fcn.1000d720
mov eax, dword [0x10094b8c]
mov esi, 0x1008ed10
add esp, 8
mov edx, 0x1b
mov eax, dword [eax*4 + 0x1006ce84]
sub esi, eax
nop dword [eax]
mov ecx, dword [eax]
lea eax, [eax + 4]
mov dword [esi + eax - 4], ecx
mov dword [eax - 4], 0x1000e510
sub edx, 1
jne 0x1000e970
mov eax, 0x1000e510
mov ecx, 0x148
mov edi, 0x1008e7f0
rep stosd dword es:[edi], eax
mov eax, dword [0x10094b8c]
mov eax, dword [eax*4 + 0x1006ce98]
mov dword [eax], 0x1008e7f0
mov dword [0x469ef0], 0x1008e7f0
mov ecx, dword [0x10094b8c]
mov eax, dword [ecx*4 + 0x1006cee8]
mov dword [0x1008e7e4], eax
mov eax, dword [ecx*4 + 0x1006cf24]
mov dword [0x1008e7d8], eax
mov eax, dword [ecx*4 + 0x1006cf60]
mov dword [0x1008e7e0], eax
mov eax, dword [ecx*4 + 0x1006cf74]
mov dword [0x1008ed7c], eax
test ecx, ecx
jne 0x1000ea73
mov eax, dword [0x1006e7b8]
test al, 1
jne 0x1000ea1c
or eax, 1
mov dword [0x1006e7bc], 0x100636b8
mov dword [0x1006e7b8], eax
mov dword [0x1006e7c4], ecx
mov dword [0x1006e7c0], ecx
call fcn.1000ce20
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
mov esi, 0x583a07
mov dword [ebp - 0x14], 4
push 4
push esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1000ea5b
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
mov dword [0x1008e7e8], esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100330c8
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ecx*4 + 0x1006cf38]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [0x1008e7e8], eax
pop esi
call fcn.100330c8
mov esp, ebp
pop ebp
ret 4
Function at 0x10018220
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x10018308
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x100182f7
jg 0x10018260
test edx, edx
je 0x100182f7
nop dword [eax]
call fcn.10019420
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x100182b4
jg 0x10018277
test esi, esi
je 0x100182b4
cmp ebx, eax
jg 0x10018287
jl 0x10018281
cmp edi, esi
jae 0x10018287
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.100346e0
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x100182db
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x100182f1
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x10018260
jl 0x100182f1
test edi, edi
jne 0x10018260
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1001832a
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x1001832c
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x100183aa
jg 0x1001833f
test esi, esi
je 0x100183aa
test eax, eax
jl 0x1001838e
jg 0x10018349
test ebx, ebx
je 0x1001838e
cmp edi, eax
jg 0x10018359
jl 0x10018353
cmp esi, ebx
jae 0x10018359
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.100346e0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x100183aa
jg 0x10018391
test esi, esi
je 0x100183aa
jmp 0x10018391
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x100183aa
push eax
push esi
push 1
push edx
call fcn.10039d48
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100183c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x100183f2
jl 0x100183e5
test ecx, ecx
jne 0x100183f2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x100184b2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10019440
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1001845e
jg 0x1001841d
test esi, esi
je 0x1001845e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x10018435
mov eax, dword [esp + 0x10]
jl 0x1001842f
cmp eax, esi
jae 0x10018435
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.100346e0
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1001847f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1001849b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x10018404
jl 0x1001849b
test ecx, ecx
jne 0x10018404
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x100184f1
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x100184f1
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.100346e0
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x10018560
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x10018517
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x10018549
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.1003a33e
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x10018574
cmp edi, eax
ja 0x10018525
test ecx, ecx
je 0x10018560
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.1003a33e
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100188b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1006c050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100188e0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100330c8
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x1001891c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x1001891c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100330c8
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10018a04
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10018944
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10018977
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.10039306
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100330c8
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x28], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x100189d7
sub eax, 1
je 0x100189d7
sub eax, 2
jne 0x10018a04
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10017ae0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100330c8
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100189f4
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10039d48
add esp, 0x10
cmp edi, eax
jne 0x10018a04
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x10018907
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100330c8
mov esp, ebp
pop ebp
ret 4
Function at 0x10019150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1001920c
cmp byte [esi + 0x3d], 0
je 0x1001920c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100191fa
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x100191c2
sub eax, 1
je 0x100191c6
sub eax, 2
jne 0x100191fa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100330c8
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100191e3
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10039d48
add esp, 0x10
cmp edi, eax
jne 0x100191fa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100330c8
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100330c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100330c8
mov esp, ebp
pop ebp
ret

Function at 0x10019790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052c30
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1006c050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100330d6
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10031c86
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a2e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x10096390
call fcn.1000ac80
push 0x10096390
push 0x100649f8
push 1
push 0x100948e0
call fcn.10017da0
add esp, 0x1c
push 0xfffffffffffffff0
push dword [0x1c9055c]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0xc00000
je 0x1001a378
push 0
push 0xf020
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x10096390
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
push 0x41010
push str.CLEO_error
push 0x10096390
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
ret

Function at 0x1001abf0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006c050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.Injecting_MenuStatusNotifier...
push 3
call fcn.1001a570
mov esi, dword [0x10094b8c]
add esp, 8
mov eax, dword [esi*4 + 0x1006ca10]
mov esi, dword [esi*4 + 0x1006cad8]
mov dword [0x1008ed80], eax
inc esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi]
add esi, 4
add eax, esi
mov esi, dword [0x10094b8c]
mov dword [0x1008ed84], eax
mov esi, dword [esi*4 + 0x1006cad8]
push esi
push str.Replacing_call:_0x_08X
push 3
call fcn.1001a570
lea ecx, [esi + 1]
mov byte [esi], 0xe8
mov eax, 0x1001a5b0
add esp, 0xc
sub eax, ecx
sub eax, 4
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100330c8
mov esp, ebp
pop ebp
ret 4
Function at 0x1001f740
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x10096fb8
call fcn.1000ac80
push 0x10096fb8
push 0x100649f8
push 1
push 0x100948e0
call fcn.10017da0
add esp, 0x1c
push 0xfffffffffffffff0
push dword [0x1c9055c]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0xc00000
je 0x1001f7d8
push 0
push 0xf020
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x10096fb8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
push 0x41010
push str.CLEO_error
push 0x10096fb8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
ret

Function at 0x10021c30
Capabilities:
Access peb ldr_data
Create thread
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005374e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1006c050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebx], eax
mov dword [ebp - 4], 0
push 0xa0
mov dword [ebx + 4], 0
call fcn.100330d6
add esp, 4
mov dword [ebx + 4], eax
lea esi, [eax + 0x10]
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x14]
mov ecx, esi
mov dword [ebp - 0x18], esi
push dword [eax]
call fcn.1000bdd0
lea edi, [esi + 0x18]
mov dword [ebp - 0x20], edi
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov byte [ebp - 4], 4
lea esi, [edi + 0x24]
mov dword [ebp - 0x14], esi
push 0x44
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100330d6
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x2c], 0
lea eax, [edi + 0x3c]
push 2
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push eax
mov word [edi + 0x38], 1
call fcn.10032405
push 8
mov byte [ebp - 4], 6
call fcn.100330d6
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], 0x1001fdc0
lea esi, [edi + 0x70]
mov byte [ebp - 4], 7
push esi
push 0
push eax
push 0x10021f30
push 0
push 0
call fcn.1003ad0b
add esp, 0x28
mov dword [edi + 0x6c], eax
test eax, eax
je 0x10021da1
mov ecx, dword [ebx + 4]
mov eax, ebx
mov edx, dword [ebp + 0xc]
mov dword [ecx], edx
mov ecx, dword [ebx + 4]
mov dword [ecx + 4], edx
mov ecx, dword [ebx + 4]
mov dword [ecx + 8], edx
mov ecx, dword [ebx + 4]
mov byte [ecx + 0xc], 0
mov ecx, dword [ebx + 4]
mov byte [ecx + 0xd], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100330c8
mov esp, ebp
pop ebp
ret 0x14
push 6
mov dword [esi], 0
call fcn.1003205a
int3
Function at 0x1002c5c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x10097fb8
call fcn.1000ac80
push 0x10097fb8
push 0x100649f8
push 1
push 0x100948e0
call fcn.10017da0
add esp, 0x1c
push 0xfffffffffffffff0
push dword [0x1c9055c]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0xc00000
je 0x1002c658
push 0
push 0xf020
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x10097fb8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
push 0x41010
push str.CLEO_error
push 0x10097fb8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
ret

Function at 0x10030f00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x100987b8
call fcn.1000ac80
push 0x100987b8
push 0x100649f8
push 1
push 0x100948e0
call fcn.10017da0
add esp, 0x1c
push 0xfffffffffffffff0
push dword [0x1c9055c]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0xc00000
je 0x10030f98
push 0
push 0xf020
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x100987b8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
push 0x41010
push str.CLEO_error
push 0x100987b8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
ret
Function at 0x10044ede
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10044d54
Function at 0x401ae0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40703c]
sub esp, 4
test ebx, ebx
je 0x401b2b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x401b24
test esi, esi
je 0x401b24
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b00
mov dword [esp], 0x407044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d10
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401d60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x401e38
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401d9e
cmp eax, 4
jne 0x401dc0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401dae
cmp edx, 4
je 0x401dae
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d10
Function at 0x403ba0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.004019d0
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x403bd6
jmp 0x403c0e
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x403bd3
cmp al, 9
je 0x403bd3
cmp al, 0x22
jne 0x403bf7
jmp 0x403c56
cmp al, 9
je 0x403c03
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x403bf0
jmp 0x403c03
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x403c00
cmp al, 9
je 0x403c00
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x403c1d
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401460
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test al, al
je 0x403c62
mov edx, ebx
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x22
jne 0x403c52
cmp al, 0x22
jne 0x403c03
lea ebx, [edx + 2]
jmp 0x403c03

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx