joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10067d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
mov edi, edi
mov edx, dword [edi + 0x3c]
sub edx, dword [edi + 0x74]
mov eax, dword [edi + 0x2c]
sub edx, dword [edi + 0x6c]
add eax, 0xfffffefa
add eax, esi
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x10067dec
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call sub.MSVCR110.dll_memcpy
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
add esp, 0xc
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
mov edi, edi
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x10067dbf
sub eax, esi
jmp 0x10067dc1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x10067db0
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x10067ddf
sub eax, esi
jmp 0x10067de1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x10067dd0
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x10067f20
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x10067e19
xor eax, eax
jmp 0x10067e6c
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x10067e36
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.1006b960
jmp 0x10067e4e
cmp eax, 2
jne 0x10067e54
mov edx, dword [ebx]
test edx, edx
jne 0x10067e45
xor eax, eax
jmp 0x10067e51
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.1006bbf0
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call sub.MSVCR110.dll_memcpy
mov eax, dword [ebp - 4]
add dword [ebx], eax
add esp, 0xc
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x10067e94
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x10067ea8
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x10067d70
mov edx, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp edx, ecx
jae 0x10067f20
mov esi, dword [edi + 0x6c]
add esi, ebx
cmp edx, esi
jae 0x10067ef0
sub ecx, esi
mov eax, 0x102
cmp ecx, eax
cmova ecx, eax
mov eax, dword [edi + 0x38]
push ecx
add eax, esi
push 0
push eax
mov dword [ebp - 8], ecx
call sub.MSVCR110.dll_memset
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, esi
mov dword [edi + 0x16c0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x102]
cmp edx, eax
jae 0x10067f20
mov eax, dword [edi + 0x38]
sub esi, edx
sub ecx, edx
add esi, 0x102
cmp esi, ecx
cmova esi, ecx
push esi
add eax, edx
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006bbd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x1006bbdb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.1006bbf0
Function at 0x1006cb90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007abfc
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x1009e034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100a557c]
mov esi, 0x409
mov dword [ebp - 0x7c], 0
test al, 1
jne 0x1006cbfa
or eax, 1
mov dword [0x100a557c], eax
mov dword [ebp - 4], 0
call fcn.1006e020
push 0x1007b8c0
call fcn.1006e627
add esp, 4
mov dword [ebp - 4], 0xffffffff
push ecx
lea eax, [ebp - 0x78]
push eax
mov ecx, 0x100a554c
call fcn.1006cb20
cmp dword [eax + 0x14], 8
jb 0x1006cc11
mov eax, dword [eax]
lea ecx, [ebp - 0x7c]
push ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp dword [ebp - 0x64], 8
mov edi, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
jb 0x1006cc35
push dword [ebp - 0x78]
call edi
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x1006cce2
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x84]
push ecx
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push 0
push str.language
push eax
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x80], 4
mov dword [ebp - 0x84], 4
call edi
test eax, eax
jne 0x1006cc8c
mov esi, dword [ebp - 0x88]
jmp 0x1006cd90
xor eax, eax
push 0x4e
push eax
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x5e]
push eax
mov dword [ebp - 0x84], 0x28
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.language
push dword [ebp - 0x7c]
call edi
test eax, eax
jne 0x1006cd90
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCR110.dll__wtoi]
add esp, 4
mov esi, eax
jmp 0x1006cd90
mov eax, dword [0x100a557c]
test al, 1
jne 0x1006cd13
or eax, 1
mov dword [0x100a557c], eax
mov dword [ebp - 4], 1
call fcn.1006e020
push 0x1007b8c0
call fcn.1006e627
add esp, 4
mov dword [ebp - 4], 0xffffffff
push ecx
lea eax, [ebp - 0x78]
push eax
mov ecx, 0x100a554c
call fcn.1006cb20
cmp dword [eax + 0x14], 8
jb 0x1006cd2a
mov eax, dword [eax]
lea ecx, [ebp - 0x7c]
push ecx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp dword [ebp - 0x64], 8
jb 0x1006cd48
push dword [ebp - 0x78]
call edi
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x1006cd99
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x84]
push ecx
push 0
push str.language
push eax
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 4
mov dword [ebp - 0x88], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
cmove esi, dword [ebp - 0x80]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006e4e6
mov esp, ebp
pop ebp
ret
Function at 0x1006cdc0
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0xffffffff
jne 0x1006cdd5
call fcn.1006cb90
mov esi, eax
mov edi, 0x10084ab4
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
movzx ebx, ax
xor eax, eax
mov ecx, 0x10084ab0
lea ebx, [ebx]
mov edx, dword [ecx]
cmp edx, ebx
jne 0x1006cdf9
lea edi, [ecx + 4]
cmp edx, esi
je 0x1006ce12
add ecx, 0x54
inc eax
cmp ecx, 0x10088ef0
jl 0x1006cdf0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
imul eax, eax, 0x54
pop edi
pop esi
add eax, 0x10084ab4
pop ebx
pop ebp
ret 4

Function at 0x1006d1e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1006d211
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 8], esi
call fcn.10071800
mov dword [esp + 0xc], eax
test esi, esi
jne 0x1006d219
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov edx, 0x1008c750
lea ecx, [esp + 8]
call fcn.1006d080
int3

Function at 0x1006d260
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007acf0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1009e034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_class_std::exception_const__]
mov dword [ebp - 4], 0
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x14]
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.10001d20
mov dword [ebp - 4], 1
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x1006d2eb
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1006d650
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007a4b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1009e034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_class_std::exception_const__]
mov dword [ebp - 4], 0
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea ecx, [edi + 0x14]
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x14]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.10001d20
mov dword [edi + 0x2c], vtable.boost::exception.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.1.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::system::system_error_.0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1006d720
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
xorps xmm0, xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
call fcn.1006d780
mov ecx, esi
call fcn.1006d830
movq xmm0, qword [esi + 0x58]
mov eax, dword [ebp + 0x10]
movq qword [eax], xmm0
movq xmm0, qword [esi + 0x60]
movq qword [eax + 8], xmm0
pop esi
pop ebp
ret 0xc
Function at 0x100700a0
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [0x100a2544]
test eax, eax
je 0x10070107
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call esi
test eax, eax
je 0x10070106
mov eax, dword [0x100a2544]
test eax, eax
jne 0x100700c5
xor ecx, ecx
jmp 0x100700cf
push eax
call esi
mov ecx, eax
mov eax, dword [0x100a2544]
cmp byte [ecx + 0x18], 0
je 0x10070106
test eax, eax
je 0x10070106
push eax
call esi
test eax, eax
je 0x10070106
mov eax, dword [0x100a2544]
test eax, eax
je 0x100700ec
push eax
call esi
push 0
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x10070106
mov eax, dword [0x100a2544]
test eax, eax
jne 0x10070109
jmp 0x1007010c
pop esi
pop ecx
ret
push eax
call esi
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x10091804
lea eax, [esp + 0xb]
push eax
mov byte [esp + 0xf], 0
call sub.MSVCR110.dll__CxxThrowException
int3
Function at 0x10070320
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10071f08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1009e034]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x100a2544]
test eax, eax
jne 0x10070352
xor ebx, ebx
jmp 0x1007035b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [esp + 0x14], ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
or ecx, 0xffffffff
mov dword [esp + 0x20], 0
test ebx, ebx
je 0x1007039f
jmp 0x10070386
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [ebx + 0x14], 0
mov edi, dword [ebx + 0x10]
jne 0x100703d9
test edi, edi
jne 0x100703e0
push edi
call fcn.10070480
add esp, 4
or ecx, 0xffffffff
mov dword [esp + 0x20], 0xffffffff
test ebx, ebx
je 0x100703c5
lea eax, [ebx + 4]
lock xadd dword [eax], ecx
dec ecx
jne 0x100703c5
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax]
push ebx
push 0
call esi
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test edi, edi
je 0x10070418
lea ecx, [ecx]
mov eax, dword [edi + 4]
mov dword [ebx + 0x10], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x10070409
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
push 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebp
push edi
push 0
call esi
push eax
call ebp
mov edi, dword [ebx + 0x10]
test edi, edi
jne 0x100703e0
mov esi, dword [ebx + 0x14]
test esi, esi
je 0x10070380
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x14], eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10070438
mov eax, dword [ecx]
push dword [esi + 0xc]
call dword [eax + 4]
mov edi, dword [esi + 8]
test edi, edi
je 0x10070465
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10070465
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
lea eax, [edi + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x10070465
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov esi, dword [ebx + 0x14]
test esi, esi
jne 0x10070423
jmp 0x10070380

Function at 0x10070480
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10071f38
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1009e034]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x1006f620
push 0x100a253c
call fcn.1006f1b0
mov eax, dword [0x100a2544]
add esp, 8
test eax, eax
je 0x100704d9
push dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
lea ecx, [esp + 4]
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_void_]
mov dword [esp + 0x10], 0
mov dword [esp + 4], vtable.boost::thread_resource_error.0
lea eax, [esp + 4]
push eax
mov dword [esp + 0x20], 0
call fcn.10010ce0
int3
Function at 0x10070510
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x10071f68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1009e034]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x1c]
push eax
push 4
push edx
push 0x10070710
push 0
push 0
call dword [sym.imp.MSVCR110.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x1007057d
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_void_]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x2c], ebx
call fcn.10010ce0
mov ecx, dword [esi]
add ecx, 4
mov eax, 1
lock xadd dword [ecx], eax
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x100705a0
cmp eax, 0xffffffff
je 0x100705a0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x4082a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x4082b7
pop dword [ebp - 0x38]
mov eax, 0x3ff43a65
sub eax, 0x3fb3b7ae
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x92062552
sub dword [ebp - 0x48], 0x43b3e007
mov dword [ebp - 0x44], 0x3fa4e4df
sub dword [ebp - 0x44], 0xd71989a
mov dword [ebp - 0x40], 0xb2647de9
add dword [ebp - 0x40], 0x99e7c645
mov dword [ebp - 0x3c], 0x99714198
sub dword [ebp - 0x3c], 0x99714198
lea eax, [ebp - 0x48]
push eax
mov eax, 0xdf7161c6
sub eax, 0xdf30c1ba
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x785fc5f6
sub dword [ebp - 0x48], 0x3ed5ca0
mov dword [ebp - 0x44], 0x604d7678
add dword [ebp - 0x44], 0xe11eeafd
mov dword [ebp - 0x40], 0xfb80f0e5
add dword [ebp - 0x40], 0x67ee7b87
mov dword [ebp - 0x3c], 0xdc8f0195
add dword [ebp - 0x3c], 0x2370fe6b
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3a382
push 0
call eax
mov ecx, 0x98a3d44d
sub ecx, 0x98a386ad
mov esi, eax
mov edi, 0x43be00
add edi, dword [ebp - 0x38]
mov edx, 0x6184a3c7
sub dword [ebp - 0x24], edx
mov ebx, dword [edi]
xor dword [ebp - 0xc], 0x529f2798
xor ebx, edx
sub dword [ebp - 0x18], ebx
mov dword [esi], ebx
xor dword [ebp - 0x24], 0x5370f859
add esi, 0xf2e89be2
sub esi, 0xf2e89bde
add edi, 0xfea90c35
add edi, 0x156f3cf
loop 0x4083c8
add eax, 0x12953
mov ebx, eax
add eax, 0xaaf89db3
add eax, 0x55076252
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x4018ff
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40193e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40193e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40193e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40193e
cmp dword [ecx + 0x74], 0xe
jbe 0x40193e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100119c6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100119ea
xor eax, eax
jmp 0x10011b52
push 0x597c
lea eax, [ebp - 0x10]
push eax
push 0x465d
lea eax, [ebp + 8]
push eax
push 0x2383
push 0x13ed
push 0x2a8f
push 1
lea eax, [ebp - 8]
push eax
push 0x4b3e
call fcn.1001179b
add esp, 0x28
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10011a30
xor eax, eax
jmp 0x10011b52
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 0x69ec
call fcn.100118b2
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x10011a53
xor eax, eax
jmp 0x10011b52
lea eax, [ebp - 0xc]
push eax
push 0x4a21
push 0x642d
lea eax, [ebp - 4]
push eax
push 0x678
push 1
push dword [ebp - 8]
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.1001163a
add esp, 0x24
push 1
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.10009138
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x10011ab9
push dword [ebp - 4]
push 0xf7e
push dword [ebp - 0x14]
push 1
push 0x1f7b
call fcn.1000d36f
add esp, 0x14
push dword [ebp - 4]
call fcn.10010de1
pop ecx
test eax, eax
jne 0x10011acd
xor eax, eax
jmp 0x10011b52
push 1
push 0x4d6d
push 0x185
lea eax, [ebp - 4]
push eax
call fcn.100118b2
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10011b3a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10011b04
xor eax, eax
jmp 0x10011b52
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10011b1d
xor eax, eax
jmp 0x10011b52
lea eax, [ebp - 4]
push eax
push 0x51dd
push 1
push 0x68ce
push 0x3749
call fcn.10011951
add esp, 0x14
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10011b4b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10011b4f
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x100313a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100313d6
push 0x21ee
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10031466
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
and dword [ebp - 4], 0
jmp 0x1003141f
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax]
jge 0x10031466
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 4]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov esi, dword [ebp - 8]
add edx, dword [esi]
mov esi, dword [ebp - 0x10]
mov esi, dword [esi]
mov ax, word [ecx + eax]
mov word [esi + edx], ax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x10031418
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003c3d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003c418
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003c416
push 0x21ee
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1003c43a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003c43a
push 0
push 0
push 0x192e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov esp, ebp
pop ebp
ret