joyce8/EMBER2024-capa huggingface dataset:
Function at 0xca9e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x119bd0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x13206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], 0x129974
call fcn.000f178c
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.000ef5b0
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x10], ecx
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x34], esi
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov ecx, edi
mov eax, dword [edi + 0x20]
push 0
push 0
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov dword [edi], 0x1299b4
call fcn.000ca750
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0xcd120
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11a183
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x13206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x68], edi
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0xf
mov dword [ebp - 0x6c], edi
mov byte [edi + 0xc], 0
mov dword [ebp - 4], 0
cmp dword [0x1329e8], 0x75bcd0d
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
mov byte [edi + 8], 0
je 0xcd252
cmp dword [0x1329e8], 0x75bcd0e
je 0xcd252
xor eax, eax
mov dword [ebp - 0x2c], 0x129c14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push 0x12
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
inc dword [0x134754]
push 0x129b5c
call fcn.000d1370
push 0x20a
mov byte [ebp - 4], 2
call fcn.000f17ca
add esp, 4
mov esi, eax
xor eax, eax
push 0x104
push esi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push esi
lea ecx, [ebp - 0x64]
call fcn.000ce970
push esi
call fcn.000f1787
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x64]
lea ecx, [ebp - 0x48]
call fcn.000d0be0
add esp, 8
lea ecx, [ebp - 0x64]
call fcn.000ced70
lea ecx, [ebp - 0x2c]
call fcn.000ced70
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
lea ecx, [ebp - 0x48]
neg eax
sbb eax, eax
add eax, 0x75bcd0e
mov dword [0x1329e8], eax
call fcn.000ced70
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.000f1776
mov esp, ebp
pop ebp
ret
Function at 0xcd2d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x13206c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1349c8], 0
push ebx
push edi
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x124], edi
jne 0xcd4dd
cmp byte [0x1349cd], 0
push esi
jne 0xcd37b
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.000f3cb0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
push eax
call esi
test eax, eax
jne 0xcd350
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call esi
test eax, eax
je 0xcd374
cmp dword [ebp - 0x118], 2
jb 0xcd374
movzx eax, byte [0x1349cc]
mov ecx, 1
cmp dword [ebp - 0x11c], 6
cmovae eax, ecx
mov byte [0x1349cc], al
mov byte [0x1349cd], 1
cmp byte [0x1349cc], 0
je 0xcd4dc
lea eax, [ebp - 0x128]
mov dword [0x1349c8], 0
push eax
push 0x129b9c
mov dword [ebp - 0x130], 0
xor esi, esi
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x12c], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0xcd4a6
mov eax, dword [ebp - 0x128]
test eax, eax
je 0xcd4b7
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0xcd4a6
lea eax, [ebp - 0x12c]
push eax
push 0x129b84
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0xcd4a6
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0xcd4a6
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0xcd4a6
push dword [ebp - 0x12c]
mov edi, dword [sym.imp.ADVAPI32.dll_GetLengthSid]
call edi
push dword [ebp - 0x128]
mov esi, eax
call edi
lea edi, [eax + 0x18]
add edi, esi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0xcd4a0
push 2
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0xcd4a0
push dword [ebp - 0x128]
mov edi, dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
push 0x10000000
push 2
push esi
call edi
test eax, eax
je 0xcd4a0
push dword [ebp - 0x12c]
push 0x10000000
push 2
push esi
call edi
mov edi, dword [ebp - 0x124]
test eax, eax
je 0xcd4a6
mov dword [0x1349c8], esi
mov dword [ebp - 0x130], 1
jmp 0xcd4a6
mov edi, dword [ebp - 0x124]
mov eax, dword [ebp - 0x128]
test eax, eax
je 0xcd4b7
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0xcd4c8
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0xcd4dc
cmp dword [ebp - 0x130], 0
jne 0xcd4dc
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push dword [0x1349c8]
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov ecx, dword [ebp - 4]
mov dword [edi + 4], ebx
xor ecx, ebp
mov dword [edi], 0xc
mov dword [edi + 8], 0
pop edi
pop ebx
call fcn.000f1776
mov esp, ebp
pop ebp
ret
Function at 0xcde50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11a2cc
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x13206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 4], 0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [edi], 0
je 0xcdfeb
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 0x834], 1
push 0
push eax
call fcn.000f3cb0
lea eax, [esi + 4]
mov dword [ebp - 0x830], 0x800
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0xcdecb
mov eax, dword [eax]
lea ecx, [ebp - 0x830]
push ecx
lea ecx, [ebp - 0x810]
push ecx
lea ecx, [ebp - 0x834]
push ecx
push 0
push eax
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
lea edi, [ebx + 4]
xor eax, eax
mov dword [ebp - 0x82c], 0x129c14
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
test esi, esi
jne 0xcdf94
lea ecx, [ebp - 0x810]
mov dword [ebp - 4], esi
inc dword [0x134754]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xcdf36
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x828]
call fcn.000d1370
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 1
cmp edi, eax
je 0xcdf85
cmp dword [ebp - 0x814], 8
mov ecx, edi
push dword [ebp - 0x818]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.000d1370
lea ecx, [ebp - 0x82c]
call fcn.000ced70
mov al, 1
jmp 0xcdfed
push 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x828]
inc dword [0x134754]
push 0x1295b4
call fcn.000d1370
lea eax, [ebp - 0x828]
mov dword [ebp - 4], 3
cmp edi, eax
je 0xcdfe0
cmp dword [ebp - 0x814], 8
mov ecx, edi
push dword [ebp - 0x818]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.000d1370
lea ecx, [ebp - 0x82c]
call fcn.000ced70
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.000f1776
mov esp, ebp
pop ebp
ret 8
Function at 0xcf3a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11a5c7
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x13206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x830]
push eax
mov dword [ebp - 0x834], esi
call fcn.000d0230
push 0x802
lea eax, [ebp - 0x814]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.000f3cb0
add esp, 0xc
lea ecx, [ebp - 0x814]
cmp dword [ebp - 0x818], 8
lea eax, [ebp - 0x82c]
cmovae eax, dword [ebp - 0x82c]
push 0x400
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esi], 0x129c14
lea edx, [esi + 4]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
test eax, eax
je 0xcf478
xor eax, eax
mov word [edx], ax
lea ecx, [ebp - 0x814]
mov byte [ebp - 4], 1
inc dword [0x134754]
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0xcf460
sub ecx, edi
lea eax, [ebp - 0x814]
sar ecx, 1
push ecx
jmp 0xcf4a5
xor eax, eax
mov word [edx], ax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x82c]
inc dword [0x134754]
cmp edx, eax
je 0xcf4ad
cmp dword [ebp - 0x818], 8
push dword [ebp - 0x81c]
cmovae eax, dword [ebp - 0x82c]
push eax
mov ecx, edx
call fcn.000d1370
lea ecx, [ebp - 0x830]
call fcn.000ced70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.000f1776
mov esp, ebp
pop ebp
ret 4
Function at 0xd38f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xa8
mov eax, dword [0x13206c]
xor eax, esp
mov dword [esp + 0xa4], eax
push esi
mov esi, dword [ebp + 0xc]
mov eax, edx
mov dword [esp + 8], ecx
mov ecx, dword [ebp + 8]
push edi
mov edx, dword [eax]
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi]
mov dword [esi], 0
mov dword [eax], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
mov dword [edi], 0
cmp ecx, 5
jae 0xd395f
mov eax, 6
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.000f1776
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
movzx ecx, byte [edx + 4]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov eax, 0x1000
cmp ecx, eax
cmovb ecx, eax
mov al, byte [edx]
mov dword [esp + 0x2c], ecx
cmp al, 0xe1
jae 0xd3aa2
xor edx, edx
movzx eax, al
mov ecx, 9
div ecx
mov ecx, 5
mov dword [esp + 0x20], edx
xor edx, edx
movzx eax, al
div ecx
push ecx
mov dword [esp + 0x28], edx
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x24]
mov dword [esp + 0x2c], eax
call fcn.000d3890
add esp, 4
test eax, eax
jne 0xd3aa7
mov ecx, dword [esp + 0x10]
mov edx, ecx
movups xmm0, xmmword [esp + 0x20]
mov eax, dword [esp + 0xc]
push edi
push ecx
push esi
push dword [esp + 0x24]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x48]
movups xmmword [esp + 0x48], xmm0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x94], 1
mov dword [esp + 0x90], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x98], 1
mov dword [esi], eax
call fcn.000d35f0
mov ecx, dword [esp + 0x6c]
mov esi, eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov dword [eax], ecx
test esi, esi
jne 0xd3a7a
cmp dword [edi], 3
mov eax, 6
cmove esi, eax
push dword [esp + 0x48]
push 0x132acc
call dword [fcn.00132ad0]
add esp, 8
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.000f1776
mov esp, ebp
pop ebp
ret
mov eax, 4
mov ecx, dword [esp + 0xac]
pop edi
pop esi
xor ecx, esp
call fcn.000f1776
mov esp, ebp
pop ebp
ret
Function at 0xd43b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x119910
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x13206c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x11e104
call fcn.000f178c
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.000ef5b0
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xe4970
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x13206c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x22c
lea eax, [ebp - 0x230]
mov dword [ebp - 0x234], ecx
push 0
push eax
call fcn.000f3cb0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x23c], ebx
cmp ebx, 0xffffffff
je 0xe4c01
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0xe4c01
push esi
push edi
nop dword [eax]
mov cx, word [ebp - 0x20c]
mov bx, word [ebp - 0x202]
mov di, word [ebp - 0x204]
mov si, word [ebp - 0x206]
mov dx, word [ebp - 0x208]
mov ax, word [ebp - 0x20a]
cmp cx, 0x69
jne 0xe4a23
cmp ax, 0x64
jne 0xe4be3
cmp dx, 0x61
jmp 0xe4b93
cmp cx, 0x77
jne 0xe4a50
cmp ax, 0x69
jne 0xe4be3
cmp dx, 0x6e
jne 0xe4be3
cmp si, 0x64
jne 0xe4be3
cmp di, 0x62
jmp 0xe4b93
cmp cx, 0x4f
jne 0xe4a7c
cmp ax, 0x6c
jne 0xe4be3
cmp dx, ax
jne 0xe4be3
cmp si, 0x79
jne 0xe4be3
cmp di, 0x44
jmp 0xe4b93
cmp cx, 0x57
jne 0xe4aa9
cmp ax, 0x69
jne 0xe4be3
cmp dx, 0x72
jne 0xe4be3
cmp si, 0x65
jne 0xe4be3
cmp di, 0x73
jmp 0xe4b93
cmp cx, 0x53
jne 0xe4af9
cmp ax, 0x6e
jne 0xe4ac8
cmp dx, 0x69
jne 0xe4be3
cmp si, 0x66
jmp 0xe4b93
cmp ax, 0x75
jne 0xe4be3
cmp dx, 0x70
jne 0xe4be3
cmp si, 0x65
jne 0xe4be3
cmp di, 0x72
jne 0xe4be3
cmp bx, 0x4b
jmp 0xe4b93
cmp cx, 0x56
jne 0xe4b08
cmp ax, 0x4d
jmp 0xe4b93
cmp cx, 0x76
jne 0xe4b14
cmp ax, 0x6d
jmp 0xe4b93
cmp cx, 0x50
jne 0xe4b71
cmp ax, 0x72
jne 0xe4b43
cmp dx, 0x6f
jne 0xe4be3
cmp si, 0x63
jne 0xe4be3
cmp di, 0x6d
jne 0xe4be3
cmp bx, dx
jmp 0xe4b93
cmp ax, 0x43
jne 0xe4be3
cmp dx, 0x48
jne 0xe4be3
cmp si, 0x75
jne 0xe4be3
cmp di, 0x6e
jne 0xe4be3
cmp bx, 0x74
jmp 0xe4b93
cmp cx, 0x70
jne 0xe4baa
cmp ax, 0x72
jne 0xe4be3
cmp dx, 0x6f
jne 0xe4be3
cmp si, 0x63
jne 0xe4be3
cmp di, 0x65
jne 0xe4be3
cmp bx, 0x78
jne 0xe4be3
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x234]
mov byte [eax], 1
mov eax, dword [ebp - 0x238]
cmp cx, 0x51
jne 0xe4bb5
cmp ax, cx
jmp 0xe4bd7
cmp cx, 0x54
jne 0xe4be3
cmp ax, 0x58
jne 0xe4be3
cmp dx, 0x50
jne 0xe4be3
cmp si, 0x6c
jne 0xe4be3
cmp di, 0x61
jne 0xe4be3
cmp bx, 0x74
jne 0xe4be3
mov eax, dword [ebp - 0x234]
mov byte [eax + 1], 1
mov ebx, dword [ebp - 0x23c]
lea eax, [ebp - 0x230]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0xe49e0
pop edi
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.000f1776
mov esp, ebp
pop ebp
ret
Function at 0xe59f0
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x158
mov ecx, dword [ebp + 8]
mov dword [esp + 0x14], edx
push esi
push edi
test ecx, ecx
je 0xe5bbb
mov esi, dword [ebp + 0xc]
test esi, esi
je 0xe5bbb
cmp esi, 0x40
jb 0xe5bbb
movups xmm0, xmmword [ecx + 0x10]
mov edx, 0x5a4d
movups xmm1, xmmword [ecx]
movups xmmword [esp + 0x30], xmm0
movups xmm0, xmmword [ecx + 0x20]
movd eax, xmm1
movups xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x20], xmm1
movups xmm0, xmmword [ecx + 0x30]
movups xmmword [esp + 0x50], xmm0
cmp ax, dx
jne 0xe5bbb
mov edx, dword [esp + 0x5c]
lea eax, [edx + 0xf8]
cmp esi, eax
jb 0xe5bbb
lea eax, [edx + ecx]
mov ecx, 0x3e
mov esi, eax
mov dword [esp + 0x18], eax
lea edi, [esp + 0x68]
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x68], 0x4550
jne 0xe5bbb
mov eax, 0xe0
cmp word [esp + 0x7c], ax
jne 0xe5bbb
mov eax, dword [esp + 0x6c]
shr eax, 0x10
lea ecx, [eax + eax*4]
shl ecx, 3
lea eax, [edx + 0xf8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0xe5bbb
push ecx
call fcn.00103709
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0xe5bbb
movzx edi, word [esp + 0x6e]
mov dword [esp + 0x14], edi
lea esi, [edi + edi*4]
shl esi, 3
push esi
push 0
push eax
call fcn.000f3cb0
mov eax, dword [esp + 0x24]
add esp, 0xc
add eax, 0xf8
push esi
push eax
push dword [esp + 0x18]
call fcn.000f31b0
mov esi, dword [esp + 0xc8]
xor edx, edx
mov ecx, dword [esp + 0xac]
mov eax, esi
div ecx
add esp, 0xc
test edx, edx
je 0xe5b1d
lea esi, [eax + 1]
imul esi, ecx
test edi, edi
je 0xe5b52
mov edi, dword [esp + 0x10]
add edi, 8
mov ecx, dword [edi]
test ecx, ecx
je 0xe5b48
xor edx, edx
mov eax, ecx
div dword [esp + 0xa0]
test edx, edx
je 0xe5b46
sub ecx, edx
add ecx, dword [esp + 0xa0]
add esi, ecx
add edi, 0x28
sub dword [esp + 0x14], 1
jne 0xe5b28
push 0x40
push 0x1000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0xe5b71
lea eax, [edi + 0xb]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x68]
push edi
push dword [esp + 0x14]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.000e5480
add esp, 0x10
test eax, eax
jne 0xe5b99
mov eax, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x6c]
push esi
push edi
push ecx
push eax
lea eax, [esp + 0x34]
push eax
call fcn.000e5640
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xa
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xe5c30
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
lea eax, [ebp - 0x64]
push esi
push edi
push 0x44
push 0
push eax
mov esi, edx
call fcn.000f3cb0
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x64]
add esp, 0xc
push edi
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0xe5cae
mov esi, dword [ebp + 0xc]
push esi
mov dword [esi], 0x10007
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [esi + 0xa4]
lea ecx, [ebp - 4]
mov esi, dword [ebp + 0x10]
add eax, 8
push ecx
push 4
push esi
push eax
push dword [edi]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0xe5cb6
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [esi]
lea eax, [ebp - 0x20]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xorps xmm0, xmm0
push 0x1c
push eax
push esi
push dword [edi]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], 0
movq qword [ebp - 0x10], xmm0
call ebx
test eax, eax
je 0xe5cfc
cmp dword [ebp - 0x10], 0x10000
je 0xe5cfc
add esi, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
push dword [edi]
call ebx
test eax, eax
jne 0xe5ce1
mov eax, dword [ebp + 0x10]
pop ebx
pop edi
sub esi, dword [eax]
mov dword [eax + 4], esi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xec850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, edx
mov ebx, ecx
xor cl, cl
mov dword [ebp - 0x14], eax
mov byte [ebp - 1], cl
test eax, eax
je 0xeca2c
test ebx, ebx
je 0xeca2c
push esi
mov esi, ebx
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0xec880
sub esi, ecx
sar esi, 1
push edi
lea eax, [esi*2 + 2]
push eax
call fcn.000f17ca
mov edi, eax
add esp, 4
test edi, edi
je 0xeca22
lea eax, [esi*2 + 2]
push eax
push 0
push edi
call fcn.000f3cb0
add esp, 0xc
lea eax, [esi*2 + 1]
push 0
push 0
push eax
push edi
push esi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, edi
lea ecx, [ebx + 1]
nop dword [eax + eax]
mov al, byte [ebx]
inc ebx
test al, al
jne 0xec8e0
sub ebx, ecx
mov ecx, 0
je 0xec95f
cmp ebx, 0x40
jb 0xec953
movsx eax, bl
mov edx, ebx
and edx, 0xffffffc0
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
nop
movups xmm0, xmmword [edi + ecx]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [edi + ecx], xmm1
movups xmm0, xmmword [edi + ecx + 0x10]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [edi + ecx + 0x10], xmm0
movups xmm0, xmmword [edi + ecx + 0x20]
pxor xmm0, xmm2
movups xmmword [edi + ecx + 0x20], xmm0
movups xmm0, xmmword [edi + ecx + 0x30]
pxor xmm1, xmm0
movups xmmword [edi + ecx + 0x30], xmm1
add ecx, 0x40
cmp ecx, edx
jb 0xec910
cmp ecx, ebx
jae 0xec95f
xor byte [ecx + edi], bl
inc ecx
cmp ecx, ebx
jb 0xec957
lea eax, [ebx + ebx]
mov dword [ebp - 0x10], eax
inc eax
push eax
mov dword [ebp - 0xc], eax
call fcn.000f17ca
mov esi, eax
add esp, 4
test esi, esi
je 0xeca0e
push dword [ebp - 0xc]
push 0
push esi
call fcn.000f3cb0
lea eax, [ebx + ebx]
push eax
push 0
push esi
call fcn.000f3cb0
xor ecx, ecx
add esp, 0x18
mov dword [ebp - 0xc], ecx
test ebx, ebx
je 0xec9f2
nop
movzx ecx, byte [ecx + edi]
xor eax, eax
mov word [ebp - 8], ax
mov byte [ebp - 6], al
mov eax, ecx
and eax, 0xf
shr ecx, 4
movsx eax, byte [eax + 0x12971c]
push eax
movsx eax, byte [ecx + 0x12971c]
push eax
push 0x12a2c4
lea eax, [ebp - 8]
push 3
push eax
call fcn.000ce050
mov ecx, dword [ebp - 0xc]
add esp, 0x14
movzx eax, byte [ebp - 8]
mov byte [esi + ecx*2], al
movzx eax, byte [ebp - 7]
mov byte [esi + ecx*2 + 1], al
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, ebx
jb 0xec9a0
mov eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
call fcn.000f1787
add esp, 4
push edi
mov bl, 1
call fcn.000f1787
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret