joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008340
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
push 0
test ecx, ecx
mov edx, 0x17
mov eax, 2
push 1
cmovne eax, edx
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10008366
or eax, eax
pop esi
ret
push 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov eax, esi
pop esi
ret

Function at 0x10008990
Capabilities:
Create thread

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
jne 0x100089aa
call fcn.100adf37
pop edi
pop ebx
mov dword [eax], 0x16
xor eax, eax
ret
push esi
push 0xc
call fcn.100a986c
mov esi, eax
add esp, 4
test esi, esi
je 0x100089f3
mov eax, dword [esp + 0x14]
push 0
push 0
push esi
push 0x10008960
push dword [esp + 0x20]
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
push 0
mov dword [esi + 4], eax
mov dword [esi + 8], edi
call fcn.100b5b45
add esp, 0x18
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x100089f9
push esi
call fcn.100a9867
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
ret
pop esi
pop edi
mov eax, 1
pop ebx
ret

Function at 0x1000bc40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov edx, eax
mov ecx, eax
and edx, 1
shr ecx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [eax*4 + 0x10147f20], ecx
inc eax
cmp eax, 0x100
jb 0x1000bc42
cmp eax, 0x800
jae 0x1000bd13
nop
mov edx, dword [eax*4 + 0x10147b20]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x10147f20]
mov dword [eax*4 + 0x10147f20], edx
inc eax
cmp eax, 0x800
jb 0x1000bcf0
mov dword [0x10147f08], 0x1000cbe0
call fcn.1000ce90
mov ecx, dword [0x10147f08]
test eax, eax
mov edx, 0x1000cc80
cmove ecx, edx
mov dword [0x10147f08], ecx
ret
Function at 0x1000fc00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
xor edi, edi
mov dword [ebp - 8], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x1000fc26
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add edx, 0xfffffffc
add edx, ebx
mov dword [ebp - 4], edx
nop
lea eax, [edi + ebx]
cmp eax, edx
jae 0x1000fc46
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x1000fc46
inc eax
cmp eax, edx
jb 0x1000fc37
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, edx
jae 0x1000fd30
cmp ecx, 2
jbe 0x1000fcea
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x1000fd1c
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
lea ecx, [edi + 5]
sub ebx, ecx
test esi, esi
je 0x1000fcbd
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x1000fcb8
mov edx, 0x100
shl edx, cl
lea ecx, [edi + 5]
dec edx
xor ebx, edx
sub ebx, ecx
mov edx, dword [ebp - 4]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [ebp - 8]
add edi, eax
jmp 0x1000fc30
shr esi, cl
test esi, esi
je 0x1000fc63
cmp esi, 4
ja 0x1000fd11
cmp esi, 3
je 0x1000fd11
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x1000fc63
or esi, 8
shr esi, 1
inc edi
jmp 0x1000fc30
mov ebx, dword [ebp - 8]
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x1000fc30
cmp ecx, 2
jbe 0x1000fd45
mov eax, dword [ebp + 0xc]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
shr esi, cl
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011bf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x150
push esi
push edi
push 0x40
lea eax, [esp + 0x24]
mov esi, ecx
push 0
push eax
mov dword [esp + 0x18], esi
call fcn.100a57f0
push 0xf8
lea eax, [esp + 0x70]
push 0
push eax
call fcn.100a57f0
mov edi, dword [ebp + 8]
add esp, 0x18
mov edx, dword [ebp + 0xc]
mov eax, edi
mov ecx, dword [esi + 4]
xorps xmm0, xmm0
or eax, edx
movlpd qword [esp + 0x10], xmm0
mov eax, dword fs:[0x18]
jne 0x10011c58
mov dword [eax + 0xbf4], 0xc0000141
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword [eax + 0xbf4], 0
lea esi, [esp + 0x10]
mov eax, dword [ecx + 0x4c]
push esi
push 0x40
lea esi, [esp + 0x28]
mov ecx, dword [eax + 8]
push esi
push edx
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
test eax, eax
jne 0x10011c4e
mov eax, 0x5a4d
cmp word [esp + 0x20], ax
jne 0x10011c4e
mov eax, dword [esp + 0x5c]
xorps xmm0, xmm0
cdq
mov esi, eax
movlpd qword [esp + 0x18], xmm0
mov eax, dword [esp + 0xc]
add esi, edi
mov ecx, esi
adc edx, dword [ebp + 0xc]
or ecx, edx
mov edi, dword [eax + 4]
mov eax, dword fs:[0x18]
je 0x10011c44
mov dword [eax + 0xbf4], 0
mov eax, dword [edi + 0x4c]
lea edi, [esp + 0x18]
push edi
push 0xf8
lea edi, [esp + 0x68]
mov ecx, dword [eax + 8]
push edi
push edx
push esi
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
test eax, eax
jne 0x10011c4e
cmp dword [esp + 0x60], 0x4550
jne 0x10011c4e
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10012140
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 8
push ebx
push esi
push edi
lea edi, [eax + 8]
mov dword [ebp - 8], ecx
mov ecx, dword [edi + 0x10]
jb 0x1001215f
mov ebx, dword [edi]
jmp 0x10012161
mov ebx, edi
xor edx, edx
mov esi, 0x811c9dc5
add ecx, ecx
je 0x10012184
mov eax, ecx
nop
movzx ecx, byte [ebx + edx]
inc edx
xor ecx, esi
imul esi, ecx, 0x1000193
cmp edx, eax
jb 0x10012170
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov ecx, dword [edi + 0x18]
xor ecx, esi
and ecx, dword [edx + 0x18]
lea esi, [ecx*8]
mov ecx, dword [edx + 0xc]
add ecx, esi
cmp dword [ecx + 4], eax
jne 0x100121bd
cmp dword [ecx], eax
jne 0x100121b5
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x100121c5
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
jmp 0x100121c5
cmp dword [ecx], eax
jne 0x100121c8
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ecx, [edx + 4]
push eax
push esi
call fcn.10012810
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10012ca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
push esi
push edi
mov dword [ebp - 4], eax
cmp dword [ebx + 0x14], 8
mov ecx, dword [ebx + 0x10]
mov dword [ebp + 0xc], ecx
jb 0x10012cc1
mov esi, dword [ebx]
jmp 0x10012cc3
mov esi, ebx
lea edi, [ecx + ecx]
mov edx, 0x811c9dc5
xor ecx, ecx
test edi, edi
je 0x10012ce5
movzx eax, byte [esi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x10012cd1
mov eax, dword [ebp - 4]
mov ecx, dword [ebx + 0x18]
mov esi, dword [ebp - 4]
mov dword [ebp - 8], ecx
xor ecx, edx
and ecx, dword [eax + 0x18]
mov edx, dword [eax + 0xc]
mov esi, dword [esi + 4]
mov dword [ebp - 4], esi
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
inc ecx
mov dword [ebp - 0x10], edi
lea ecx, [edx + ecx*4]
mov dword [ebp - 0x14], ecx
nop
cmp edi, esi
jne 0x10012d18
mov ecx, esi
jmp 0x10012d1c
mov ecx, dword [ecx]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x10012e11
cmp dword [ebx + 0x14], 8
jb 0x10012d2e
mov esi, dword [ebx]
jmp 0x10012d30
mov esi, ebx
cmp dword [eax + 0x1c], 8
jb 0x10012d3b
mov edx, dword [eax + 8]
jmp 0x10012d3e
lea edx, [eax + 8]
mov ecx, dword [eax + 0x18]
mov edi, dword [ebp + 0xc]
cmp ecx, edi
mov dword [ebp - 0xc], ecx
cmovb edi, ecx
test edi, edi
jne 0x10012d77
xor ecx, ecx
test ecx, ecx
jne 0x10012d6a
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
cmp ecx, edx
jb 0x10012d6a
ja 0x10012d6a
mov ecx, dword [ebp - 8]
cmp dword [eax + 0x20], ecx
je 0x10012d98
mov eax, dword [eax]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
jmp 0x10012d10
mov cx, word [edx]
cmp cx, word [esi]
jne 0x10012d8a
add edx, 2
add esi, 2
sub edi, 1
jmp 0x10012d4e
movzx ecx, word [edx]
cmp cx, word [esi]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x10012d52
cmp dword [eax + 0x1c], 8
jb 0x10012da3
mov edx, dword [eax + 8]
jmp 0x10012da6
lea edx, [eax + 8]
cmp dword [ebx + 0x14], 8
jb 0x10012dae
mov ebx, dword [ebx]
mov ecx, dword [eax + 0x18]
mov esi, ecx
cmp dword [ebp + 0xc], ecx
cmovb esi, dword [ebp + 0xc]
test esi, esi
jne 0x10012df0
xor ecx, ecx
test ecx, ecx
jne 0x10012dd8
mov ecx, dword [eax + 0x18]
mov edx, dword [ebp + 0xc]
cmp edx, ecx
jb 0x10012dd8
ja 0x10012dd8
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x20]
je 0x10012ddb
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 8
mov cx, word [ebx]
cmp cx, word [edx]
jne 0x10012e03
add ebx, 2
add edx, 2
sub esi, 1
jmp 0x10012dbc
movzx ecx, word [ebx]
cmp cx, word [edx]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x10012dc0
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10016bf0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10016c0c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x20], 0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10016c6f
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0xffffffff
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
jne 0x10016c6f
push 0
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0xffffffffffffffff
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [esi + 0x1c], 0
je 0x10016c66
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10016c66
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
push ecx
lea ecx, [esi + 0x28]
call fcn.100100b0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10017050
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e0b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 4
mov dword [ecx + 8], 0xffff0001
mov dword [ecx + 0xc], 0xffffffff
mov dword [ecx + 0x10], 0xff
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 3
mov dword [ecx + 0x1c], 0xffffffff
mov dword [ecx + 0x20], 0xffffffff
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov eax, dword [ebp + 8]
mov dword [ecx + 0x28], 0
mov dword [ecx], 2
mov eax, dword [eax]
mov dword [ecx + 0x28], eax
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1001bc20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x1001bc3b
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x1001bc57
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x1001bc46
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x1001bc8d
cmp dword [ecx], edi
jne 0x1001bc85
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x1001bc95
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1001bc95
cmp dword [ecx], edi
jne 0x1001bc98
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [edx + 8]
call fcn.1001b810
push edi
call fcn.100659a5
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1001c780
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x1001c7a8
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0xc], eax
jmp 0x1001c7b0
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test ecx, ecx
jle 0x1001c7c9
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x1001c7d1
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test ecx, ecx
jle 0x1001c7ea
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1001c7f2
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
test ecx, ecx
jle 0x1001c80b
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x1001c813
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 4], 0
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call fcn.1001c854
Function at 0x1001c8e0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
push ebx
push esi
push edi
test ecx, ecx
je 0x1001c952
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test ecx, ecx
jne 0x1001c901
test eax, eax
je 0x1001c952
test edx, edx
je 0x1001c952
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
push 0x33
call fcn.1001c912
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001c960
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x17
mov dword [ebp - 8], str.LdrGetProcedureAddress
push ebx
push esi
push edi
test ecx, ecx
jne 0x1001c98e
test eax, eax
jne 0x1001c98e
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
push 0x33
call fcn.1001c99f

Function at 0x1001ca00
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e0f7c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5cc
push ebx
push esi
xorps xmm0, xmm0
push edi
movlpd qword [ebp - 0x18], xmm0
push 0x33
call fcn.1001ca30

Function at 0x1001cd40
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100e0fb2
push eax
mov dword fs:[0], esp
sub esp, 0x1a0
mov eax, dword [0x10147d50]
mov edx, dword [0x10147d54]
push ebx
push esi
push edi
test eax, eax
jne 0x1001cd84
test edx, edx
jne 0x1001cd84
call fcn.1001ca00
mov dword [0x10147d50], eax
mov dword [0x10147d54], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x1001cda7
test edx, edx
jne 0x1001cda7
xor eax, eax
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], edx
push 0x33
call fcn.1001cdbd
Function at 0x1001e1d0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e1038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
xor eax, eax
lea ecx, [ebp - 0x50]
push esi
push dword [ebp + 8]
mov edx, str._registrymachineSYSTEMCurrentControlSetServices_
mov word [ebp - 0x20], ax
mov dword [ebp - 0x1e], eax
mov word [ebp - 0x1a], ax
call fcn.1001e580
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x50]
cmp dword [ebp - 0x3c], 8
lea ecx, [ebp - 0x38]
push 0x14
cmovae eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push 0x1011e49c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
call fcn.100133a0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.10015230
mov ecx, eax
call fcn.1001e680
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x1001e27d
inc eax
lea ecx, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
call fcn.10013aa0
push 0xe
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0xf
push 0x1011e40c
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
call fcn.100133a0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.10015230
mov ecx, eax
call fcn.1001e720
mov byte [ebp - 4], 0
mov esi, eax
mov ecx, dword [ebp - 0x24]
cmp ecx, 0x10
jb 0x1001e2d7
inc ecx
push ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
call fcn.10013aa0
push dword [ebp + 8]
mov edx, str.SYSTEMCurrentControlSetServices_
lea ecx, [ebp - 0x38]
call fcn.1001e580
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x1001e2f2
mov eax, dword [eax]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [ebp - 0x24]
cmp eax, 8
jb 0x1001e313
inc eax
lea ecx, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
call fcn.10013a40
mov eax, dword [ebp - 0x3c]
cmp eax, 8
jb 0x1001e328
inc eax
lea ecx, [ebp - 0x50]
push eax
push dword [ebp - 0x50]
call fcn.10013a40
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1001e340
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
mov dword [ebp - 8], 1
push 0
push eax
call fcn.100a57f0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x1001e373
mov eax, dword [eax]
push eax
push str.___s
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.10015030
add esp, 0x10
lea eax, [ebp - 4]
push eax
push str.systemCurrentControlSetServices
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1001e462
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x1001e3b4
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
je 0x1001e3db
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001e3e4
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.ImagePath
push dword [ebp + 0xc]
call esi
mov edi, eax
test edi, edi
je 0x1001e436
push dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.Type
push dword [ebp + 0xc]
call esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
call esi
push dword [ebp - 4]
call esi
test edi, edi
jne 0x1001e42c
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1001f330
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e0796
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [edi + 0x2c]
mov byte [edi + 0x40], 0
test eax, eax
je 0x1001f36e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0x2c], 0
mov eax, dword [edi + 0x24]
test eax, eax
je 0x1001f383
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x24], 0
xor esi, esi
push esi
mov ecx, edi
call fcn.1001f1b0
inc esi
cmp esi, 4
jl 0x1001f385
cmp dword [edi + 8], 0
je 0x1001f411
mov ecx, edi
call fcn.1001f000
test eax, eax
jns 0x1001f411
lea ebx, [edi + 4]
mov dword [ebp - 4], 0
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov esi, eax
cmp byte [eax + 0xd], 0
jne 0x1001f3e0
mov edi, eax
nop dword [eax]
push dword [esi + 8]
mov ecx, ebx
call fcn.1001f730
mov esi, dword [esi]
push edi
call fcn.100659a5
add esp, 4
mov edi, esi
cmp byte [esi + 0xd], 0
je 0x1001f3c0
mov edi, dword [ebp - 0x14]
mov eax, dword [ebx]
mov dword [eax + 4], eax
mov eax, dword [ebx]
mov dword [eax], eax
mov eax, dword [ebx]
mov dword [eax + 8], eax
mov dword [ebx + 4], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x28], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001f970
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push edi
mov edi, ecx
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
mov dword [edi + 4], eax
lea eax, [ebp - 0x24]
mov dword [edi], vtable.blackbone::Native.0
push eax
mov dword [edi + 8], 0
mov word [edi + 0xc], 0
mov byte [edi + 0xe], 0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp - 0x20]
mov dword [edi + 0x10], eax
je 0x1001f9d8
mov word [edi + 0xc], 0x101
mov eax, edi
mov dword [edi + 8], 0
mov byte [edi + 0xe], 1
pop edi
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
lea eax, [ebp + 8]
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov edx, dword [ebp + 0xc]
cmp edx, 1
mov ecx, dword [ebp + 8]
sete al
cmp ecx, 1
mov byte [edi + 0xc], al
sete al
mov byte [edi + 0xd], al
cmp edx, 1
jne 0x1001fa43
mov eax, edi
cmp ecx, edx
jne 0x1001fa35
mov dword [edi + 8], 0
pop edi
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 8], 2
pop edi
mov esp, ebp
pop ebp
ret 8
test edx, edx
jne 0x1001fa5b
test ecx, ecx
jne 0x1001fa5b
mov dword [edi + 8], 1
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 8], 3
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 8