joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa4f36c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xafc168
call fcn.00a6fc7c
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0xc
push 0
push esi
mov dword [ebp - 0x10], esi
mov dword [esi], 0xafe3f0
call fcn.00a70120
add esp, 0xc
and dword [ebp - 4], 0
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.006a02b8
lea ebx, [esi + 0x18]
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.006a02b8
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.006a02b8
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00a4fe6e
fld1
push ecx
push ecx
mov ecx, edi
fstp qword [esp]
mov byte [ebp - 4], 4
mov dword [esi], 0xb0dda0
call fcn.006a05ff
fld1
push ecx
push ecx
mov ecx, ebx
fstp qword [esp]
call fcn.006a05ff
fldz
push ecx
push ecx
lea ecx, [esi + 0x24]
fstp qword [esp]
call fcn.006a05ff
push 0
lea ecx, [esi + 0x30]
call fcn.00630025
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0xa4fdf3
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xafc269
call fcn.00a6fc7c
push ecx
push esi
fld1
mov esi, ecx
push ecx
push ecx
fstp qword [esp]
mov dword [ebp - 0x10], esi
call fcn.009bfcf8
fld1
and dword [ebp - 4], 0
push ecx
push ecx
lea ecx, [esi + 0xc]
fstp qword [esp]
call fcn.009bfcf8
fld1
push ecx
push ecx
lea ecx, [esi + 0x18]
fstp qword [esp]
mov byte [ebp - 4], 1
call fcn.009bfcf8
fld1
push ecx
push ecx
lea ecx, [esi + 0x24]
fstp qword [esp]
mov byte [ebp - 4], 2
call fcn.009bfcf8
push 0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004b69f4
lea ecx, [esi + 0x3c]
call fcn.00a4dc9f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0xa4ff24
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0xafc28a
call fcn.00a6fc7c
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0xb0ddb0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x24], 0xb0ddac
push eax
mov byte [ebp - 4], 1
mov dword [esi], 0xb0dda8
call fcn.00a5037e
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0xa5911a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
mov dword [ebp - 4], 0xc65053f2
jne 0xa59130
lea ebx, [ebp - 4]
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0xa5917f
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, esi
mov dword [ebp + 0x14], eax
mov cl, byte [edi + esi]
mov al, cl
mov byte [ebp + 0x10], cl
push dword [ebp + 0x10]
shl cl, 4
shr al, 4
or al, cl
mov cl, al
and cl, 0xd5
shr al, 1
shl cl, 1
and al, 0x55
or cl, al
movzx eax, byte [ebx]
xor cl, byte [eax + 0xbd4130]
push ebx
mov byte [esi], cl
call fcn.00a590bd
pop ecx
inc esi
dec dword [ebp + 0x14]
pop ecx
jne 0xa59144
pop edi
pop esi
pop ebx
leave
ret
Function at 0xa59182
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
mov dword [ebp - 4], 0xc65053f2
jne 0xa59198
lea ebx, [ebp - 4]
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0xa591e7
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, esi
mov dword [ebp + 0x14], eax
movzx eax, byte [ebx]
mov al, byte [eax + 0xbd4130]
xor al, byte [edi + esi]
mov cl, al
shr al, 1
and cl, 0xd5
and al, 0x55
shl cl, 1
or cl, al
mov al, cl
shr al, 4
shl cl, 4
or al, cl
mov byte [ebp + 0x10], al
push dword [ebp + 0x10]
mov byte [esi], al
push ebx
call fcn.00a590bd
pop ecx
inc esi
dec dword [ebp + 0x14]
pop ecx
jne 0xa591ac
pop edi
pop esi
pop ebx
leave
ret

Function at 0xa5a2d6
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0xafcb25
call fcn.00a6fc7c
push ecx
push esi
mov esi, ecx
lea eax, [esi + 4]
mov ecx, eax
neg ecx
lea edx, [eax - 4]
sbb ecx, ecx
and ecx, edx
push edi
mov dword [ebp - 0x10], esi
mov dword [0xbdd8a8], ecx
xor edi, edi
mov dword [ebp - 4], edi
mov dword [eax], edi
push edi
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi + 8], edi
call fcn.00a5acc5
push edi
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 2
call fcn.00a5acc5
push edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 3
call fcn.00a5acc5
push edi
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 4
call fcn.00a5acc5
push edi
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 5
call fcn.00a5acc5
push edi
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 6
mov dword [esi + 0x48], edi
call fcn.004b69f4
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi], 0xb0de14
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0xa5a671
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
mov ebx, ecx
call fcn.00a656fd
test eax, eax
je 0xa5a69d
push eax
lea ecx, [ebp - 8]
call fcn.00a5a5ab
push 0xb9c238
lea eax, [ebp - 8]
push eax
call fcn.00a6fc9b
call fcn.00a66d5b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebx + 0x5c], eax
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x11c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x10c], 2
jne 0xa5a792
mov al, byte [0xbdd7e4]
push esi
push edi
mov byte [ebp - 0x88], al
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x87]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x88]
push eax
push 0xbd4300
call fcn.00a5a21c
pop ecx
pop ecx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
lea eax, [ebp - 0x88]
push eax
push 0xbd42e0
call fcn.00a5a21c
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
pop ecx
pop ecx
push eax
push edi
call esi
mov dword [ebx + 0x60], eax
lea eax, [ebp - 0x88]
push eax
push 0xbd42cc
call fcn.00a5a21c
pop ecx
pop ecx
push eax
push edi
call esi
mov dword [ebx + 0x64], eax
lea eax, [ebp - 0x88]
push eax
push 0xbd42b8
call fcn.00a5a21c
pop ecx
pop ecx
push eax
push edi
call esi
mov dword [ebx + 0x68], eax
lea eax, [ebp - 0x88]
push eax
push 0xbd42a4
call fcn.00a5a21c
pop ecx
pop ecx
push eax
push edi
call esi
mov dword [ebx + 0x6c], eax
lea eax, [ebp - 0x88]
push eax
push 0xbd4290
call fcn.00a5a21c
pop ecx
pop ecx
push eax
push edi
call esi
pop edi
mov dword [ebx + 0x70], eax
pop esi
push 1
lea ecx, [ebx + 0x18]
call fcn.00630025
pop ebx
leave
ret 4

Function at 0xa5a949
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
mov ecx, 0x10501
cmp eax, ecx
push edi
mov edi, dword [sym.imp.kernel32.dll_GetTickCount]
mov ebx, 0x10001
jg 0xa5a9a9
cmp eax, ecx
je 0xa5a9f3
cmp eax, ebx
je 0xa5a9a2
cmp eax, 0x10102
je 0xa5a9f3
cmp eax, 0x10104
je 0xa5a9f3
cmp eax, 0x10300
jle 0xa5a9cc
cmp eax, 0x10303
jle 0xa5a9f3
cmp eax, 0x10305
jle 0xa5a9cc
cmp eax, 0x10308
jle 0xa5a9f3
jmp 0xa5a9cc
call edi
mov dword [esi + 0x5c], eax
jmp 0xa5a9cc
cmp eax, 0x10601
je 0xa5a9f3
cmp eax, 0x10700
jle 0xa5a9cc
cmp eax, 0x10706
jle 0xa5a9f3
cmp eax, 0x10801
je 0xa5a9f3
cmp eax, 0x10a01
je 0xa5a9f3
and dword [esi + 0x48], 0
call edi
sub eax, dword [esi + 0x5c]
cmp eax, 0xea60
jbe 0xa5aa0a
push ebx
lea ecx, [ebp - 8]
call fcn.00a5aa0f
push 0xb9c388
lea eax, [ebp - 8]
push eax
call fcn.00a6fc9b
push eax
lea ecx, [ebp - 8]
call fcn.00a5aa0f
push 0xb9c388
lea eax, [ebp - 8]
push eax
call fcn.00a6fc9b
pop edi
pop esi
pop ebx
leave
ret
Function at 0xa65160
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xafd2d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 4]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x10], esp
je 0xa651a6
mov ecx, dword [ebx + 8]
push 0x4000
push ecx
push eax
call dword [sym.imp.kernel32.dll_VirtualFree]
mov dword [ebx + 4], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 8], edi
mov esi, dword [ebp + 0xc]
cmp esi, edi
jle 0xa6521d
push 0x40
push 0x1000
push esi
push edi
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp eax, edi
mov dword [ebx + 4], eax
je 0xa6521d
mov ecx, esi
mov esi, dword [ebp + 8]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, edx
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebx + 4]
mov dword [ebx + 8], eax
mov dword [ebp - 4], 0
call esi
push 2
mov dword [ebx + 0xc], eax
mov dword [ebp - 4], 2
call esi
mov dword [ebx + 0x10], eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0xa65376
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
cmp dword [ebp + 8], 0
jne 0xa6538a
xor eax, eax
jmp 0xa65453
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
cmp dword [eax], 0x4550
je 0xa653ae
xor eax, eax
jmp 0xa65453
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x78]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0xa65451
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
add edx, dword [ecx + 0x24]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
jmp 0xa65406
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x18]
jae 0xa65451
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor esi, esi
mov si, word [ecx + eax*2]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x10]
add ecx, esi
cmp edx, ecx
jne 0xa6544f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + edx*2]
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c]
jmp 0xa65453
jmp 0xa653fd
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xa66609
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb0e778
push 0xa713d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0xa66676
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0xa66724
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x2c]
push edx
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
jmp 0xa666bc
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
cmp eax, 1
je 0xa666e1
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0xa66724
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0xbd4ec8
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VERSION.dll_VerQueryValueA
cmp eax, 1
je 0xa66707
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0xa66724
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc]
mov dword [edx], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00a66732
jmp 0xa6674c
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa6724f
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb0e7a0
push 0xa713d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff38
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
je 0xa67281
cmp dword [ebp + 0xc], 0
jne 0xa6728b
mov eax, 0x300000a0
jmp 0xa6742c
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x94], 0
mov byte [ebp - 0x90], 0
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x8f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x10
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.00a70120
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0xd8]
push ecx
call fcn.00a70120
add esp, 0xc
mov dword [ebp - 0xd8], 0x44
mov dword [ebp - 4], 0
push 0xbd4ecc
push 0
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateEventA]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jne 0xa67331
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
push 0
push 0x14b
push 1
push 1
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [0xbe6bcc]
push eax
call fcn.00a6a000
jmp 0xa673f9
mov ecx, dword [ebp + 0x10]
push ecx
push 0xbd4ef8
push 0x64
lea edx, [ebp - 0x90]
push edx
call fcn.00a68ee0
add esp, 0x10
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xd8]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [ebp - 0x90]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
jne 0xa6739d
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
push 0
push 0x158
push 1
push 1
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [0xbe6bcc]
push edx
call fcn.00a6a000
jmp 0xa673f9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x94]
push ecx
call fcn.00a671ea
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0xa673f2
push 0x64
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0xa673d5
push 0
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
push 0
push 0x169
push 1
push 1
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [0xbe6bcc]
push edx
call fcn.00a6a000
jmp 0xa673f9
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00a67407
jmp 0xa67429
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0xa6743f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push edi
mov dword [ebp - 4], 0
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x20c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x314], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x210], 0
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
jne 0xa674c7
mov dword [ebp - 4], 0x30000304
jmp 0xa67638
push 1
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x108]
push edx
push 0xbd4efc
call fcn.00a6b429
cmp eax, 1
je 0xa674f2
mov dword [ebp - 4], 0x30000305
jmp 0xa67636
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0xbd4f10
push 0x104
lea edx, [ebp - 0x314]
push edx
call fcn.00a68ee0
add esp, 0x14
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [0xbe6bc4], eax
cmp dword [0xbe6bc4], 0
jne 0xa67540
mov dword [ebp - 4], 0x30000301
jmp 0xa67634
push 1
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x108]
push edx
push 0xbd4f18
call fcn.00a6b429
cmp eax, 1
je 0xa6756b
mov dword [ebp - 4], 0x30000305
jmp 0xa67632
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [0xbe6bc4]
push ecx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0xbe6bb4], eax
cmp dword [0xbe6bb4], 0
jne 0xa67599
mov dword [ebp - 4], 0x30000302
jmp 0xa67630
push 1
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x108]
push eax
push 0xbd4f2c
call fcn.00a6b429
cmp eax, 1
je 0xa675c1
mov dword [ebp - 4], 0x30000305
jmp 0xa6762e
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [0xbe6bc4]
push edx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0xbe6bbc], eax
cmp dword [0xbe6bbc], 0
jne 0xa675ec
mov dword [ebp - 4], 0x30000302
jmp 0xa6762c
push 0
push 0xa6763f
mov eax, dword [0xbe6bb4]
push eax
call fcn.00a6a716
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0xa67609
jmp 0xa6762a
cmp dword [ebp - 4], 0
je 0xa67625
cmp dword [0xbe6bc4], 0
je 0xa67625
mov ecx, dword [0xbe6bc4]
push ecx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
jmp 0xa6763a
jmp 0xa67609
jmp 0xa67609
jmp 0xa67609
jmp 0xa67609
jmp 0xa67609
jmp 0xa67609
jmp 0xa67609
jmp 0xa67609
pop edi
mov esp, ebp
pop ebp
ret
Function at 0xa67dd8
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push 0x94
push 0
lea eax, [ebp - 0x94]
push eax
call fcn.00a70120
add esp, 0xc
mov dword [ebp - 0x94], 0x94
lea ecx, [ebp - 0x94]
push ecx
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
jne 0xa67e1e
mov dword [ebp - 0x98], 0
jmp 0xa67e72
cmp dword [ebp - 0x84], 1
jne 0xa67e2e
mov eax, 1
jmp 0xa67e78
cmp dword [ebp - 0x84], 2
jne 0xa67e72
cmp dword [ebp - 0x90], 5
jne 0xa67e50
cmp dword [ebp - 0x8c], 0
jne 0xa67e50
mov eax, 2
jmp 0xa67e78
cmp dword [ebp - 0x90], 5
jne 0xa67e62
cmp dword [ebp - 0x8c], 1
jae 0xa67e6b
cmp dword [ebp - 0x90], 6
jb 0xa67e72
mov eax, 3
jmp 0xa67e78
mov eax, dword [ebp - 0x98]
mov esp, ebp
pop ebp
ret
Function at 0xa6a630
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0xa6a642
cmp dword [ebp + 0xc], 0
jne 0xa6a646
xor eax, eax
jmp 0xa6a6a7
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0xa6a674
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 8], ecx
jae 0xa6a6a5
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0xc]
jb 0xa6a6a3
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 8]
cmp dword [ebp + 8], edx
jae 0xa6a6a3
mov eax, dword [ebp - 4]
jmp 0xa6a6a7
jmp 0xa6a662
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0xa6abe9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
je 0xa6ac10
cmp dword [ebp + 0xc], 0
jne 0xa6ac1f
push 0x57
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
jmp 0xa6ace5
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
and ecx, 0xfffff000
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x10]
push eax
push 0x40
push 0x1000
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.kernel32.dll_VirtualProtect]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0xa6ac60
mov eax, dword [ebp - 4]
jmp 0xa6ace5
mov dword [ebp - 0x18], 0
jmp 0xa6ac72
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x400
jae 0xa6acc6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
xor edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + eax*4]
cmp edx, dword [ebp - 0xc]
je 0xa6acc4
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx*4]
push eax
call dword [sym.imp.kernel32.dll_InterlockedExchange]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
xor edx, edx
test edx, edx
je 0xa6acc4
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
jmp 0xa6ac69
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x1000
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
mov dword [ebp - 4], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0xa6d0c5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
mov byte [ebp - 0x204], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x203]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0xbd5398
lea edx, [ebp - 0x204]
push edx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call fcn.00a70570
add esp, 4
mov dword [ebp - 0x20c], eax
push 0
lea ecx, [ebp - 0x210]
push ecx
push 4
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0xa6d144
mov eax, 0x30000026
jmp 0xa6d240
cmp dword [ebp - 0x210], 4
je 0xa6d157
mov eax, 0x30000027
jmp 0xa6d240
lea ecx, [ebp + 0x14]
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x208], 0
mov edx, dword [ebp - 0x20c]
mov dword [ebp - 4], edx
jmp 0xa6d184
mov eax, dword [ebp - 0x208]
add eax, 1
mov dword [ebp - 0x208], eax
mov ecx, dword [ebp - 0x208]
cmp ecx, dword [ebp - 0x20c]
jae 0xa6d1fd
mov eax, dword [ebp - 0x208]
xor edx, edx
mov ecx, 4
div ecx
mov eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 0x214]
mov al, byte [ebp + eax - 0x204]
xor al, byte [ecx + edx]
mov ecx, dword [ebp - 0x208]
mov byte [ebp + ecx - 0x204], al
mov edx, dword [ebp - 0x208]
mov al, byte [ebp + edx - 0x204]
xor al, byte [ebp - 4]
mov ecx, dword [ebp - 0x208]
mov byte [ebp + ecx - 0x204], al
mov edx, dword [ebp - 0x208]
xor eax, eax
mov al, byte [ebp + edx - 0x204]
mov ecx, dword [ebp - 4]
add ecx, eax
mov dword [ebp - 4], ecx
jmp 0xa6d175
push 0
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0xa6d229
mov eax, 0x30000028
jmp 0xa6d240
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x20c]
je 0xa6d23e
mov eax, 0x30000029
jmp 0xa6d240
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10