joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100082d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc28
mov eax, dword [0x10042fd0]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
lea eax, [ebp - 0xc24]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push edx
mov esi, eax
lea eax, [ebp - 0xc14]
push 0x400
push eax
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
movzx ecx, word [ebp - 0xc18]
movzx edx, word [ebp - 0xc1a]
xor eax, eax
push ecx
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
movzx eax, word [ebp - 0xc1c]
push edx
push eax
push str.__02d:_02d:_02d_
lea edx, [ebp - 0x14]
mov byte [ebp - 0x14], 0
call fcn.100083b0
lea ecx, [ebp - 0xc14]
push ecx
lea edx, [ebp - 0x14]
push edx
push str._s__s_n
lea edx, [ebp - 0x814]
call fcn.100083d0
lea eax, [ebp - 0x814]
add esp, 0x2c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10008371
push 0
lea ecx, [ebp - 0xc28]
push ecx
sub eax, edx
push eax
lea edx, [ebp - 0x814]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 7
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, dword [ebp - 8]
xor ecx, ebp
pop esi
call fcn.10036e30
mov esp, ebp
pop ebp
ret

Function at 0x10008830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, 1
xor esi, esi
mov word [ebp - 4], 0xcffc
mov byte [ebp - 2], 0xab
mov ecx, ebx
sub edi, ebx
jmp 0x10008850
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
lea eax, [edx + edx*2]
mov edx, esi
sub edx, eax
movzx eax, byte [ebp + edx - 4]
xor byte [ecx], al
lea edx, [edi + ecx]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, esi
sub edx, eax
movzx eax, byte [ebp + edx - 3]
xor byte [ecx + 1], al
add esi, 2
add ecx, 2
cmp esi, 0xe
jl 0x10008850
pop edi
mov eax, ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b810
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x1000afb0
push 0x5f97b1
mov bl, 0xe8
call fcn.10034b90
push 0x1000afb0
push 0x675d9f
call fcn.10034b90
push 0x1000afb0
push 0x679035
call fcn.10034b90
push 0x1000afe0
push 0x461153
mov bl, 0xe9
call fcn.10034b90
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x20
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x639a36
call esi
mov bl, 0xeb
lea ecx, [ebp - 4]
push ecx
mov byte [0x639a36], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x639a36
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x639a3c
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x639a3c], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x639a3c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x639c29
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x639c29], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x639c29
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x639c2f
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x639c2f], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x639c2f
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x639ccc
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x639ccc], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x639ccc
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x639cd2
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x639cd2], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x639cd2
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c540
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x1000c750
push 0x630ed2
mov bl, 0xe8
call fcn.10034b90
push 0x1000c7c0
push 0x630f24
call fcn.10034b90
push 0x1000c7c0
push 0x630f62
call fcn.10034b90
push 0x1000c7c0
push 0x630f81
call fcn.10034b90
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x20
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x513a8b
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x513a8b], 0xd0
mov edx, dword [ebp - 4]
push edx
push 1
push 0x513a8b
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x513a8c
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x513a8c], 7
mov edx, dword [ebp - 4]
push edx
push 1
push 0x513a8c
call esi
push 0x1000c840
push 0x48e342
call fcn.10034b90
push 0x1000c840
push 0x531e90
call fcn.10034b90
push 0x1000c840
push 0x539a0d
call fcn.10034b90
push 0x1000c840
push 0x5a2f91
call fcn.10034b90
push 0x1000c840
push 0x67ab1c
call fcn.10034b90
push 0x1000c840
push 0x67b81d
call fcn.10034b90
push 0x1000c840
push 0x67bfb5
call fcn.10034b90
push 0x1000c840
push 0x699cd7
call fcn.10034b90
add esp, 0x40
push 0x1000c980
push 0x52d982
or bl, 0xff
call fcn.10034b90
push 0x1000c980
push 0x52d9c3
or bl, 0xff
call fcn.10034b90
push 0x1000c980
push 0x52da04
or bl, 0xff
call fcn.10034b90
push 0x1000c980
push 0x52da45
or bl, 0xff
call fcn.10034b90
push 0x1000c980
push 0x52da86
or bl, 0xff
call fcn.10034b90
push 0x1000c980
push 0x52dac7
or bl, 0xff
call fcn.10034b90
push 0x1000c980
push 0x52db08
or bl, 0xff
call fcn.10034b90
push 0x1000c980
push 0x52db49
or bl, 0xff
call fcn.10034b90
add esp, 0x40
push 0x1000c980
push 0x52db8a
or bl, 0xff
call fcn.10034b90
push 0x1000c980
push 0x52dbcb
or bl, 0xff
call fcn.10034b90
push 0x1000c980
push 0x52dc10
or bl, 0xff
call fcn.10034b90
push 0x1000c980
push 0x52dc55
or bl, 0xff
call fcn.10034b90
push 0x1000c980
push 0x531817
or bl, 0xff
call fcn.10034b90
add esp, 0x28
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d1f0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ecx, ecx
push edi
mov dword [ebp - 4], ecx
lea edi, [ecx + 1]
mov esi, 2
lea edx, [esi + 1]
mov eax, 0xf0f0f0f1
mul edx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x1011643b]
xor al, byte [esi + 0x101163ee]
movzx ebx, al
mov eax, 0xf0f0f0f1
mul esi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x1011643a]
xor al, byte [edi + 0x101163ee]
add esi, 4
movzx edx, al
add bx, dx
mov eax, 0xf0f0f0f1
mul edi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x10116439]
xor al, byte [ecx + 0x101163ee]
add edi, 4
movzx edx, al
add bx, dx
mov eax, 0xf0f0f0f1
mul ecx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x10116438]
xor al, byte [ecx + 0x101163ed]
add ecx, 4
movzx edx, al
add bx, dx
add word [ebp - 4], bx
cmp esi, 0x22
jb 0x1000d204
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 4]
mov edx, dword [0x7565d4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
shr ecx, 8
add cl, 0x77
mov byte [0x101d7d22], cl
lea ecx, [ebp - 4]
push ecx
sub al, 0x12
push 0x40
mov byte [0x101d7d23], al
mov eax, dword [0x7565e4]
push 4
push 0x7565d4
mov dword [0x101d8564], edx
mov dword [0x101d8560], eax
call esi
lea edx, [ebp - 4]
push edx
mov dword [0x7565d4], 0x1000d130
mov eax, dword [ebp - 4]
push eax
push 4
push 0x7565d4
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 4
push 0x7565e4
call esi
lea edx, [ebp - 4]
push edx
mov dword [0x7565e4], 0x1000d190
mov eax, dword [ebp - 4]
push eax
push 4
push 0x7565e4
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fff0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov ecx, 0x101e79a8
mov esi, eax
call fcn.1000fd40
test al, al
jne 0x10010003
pop esi
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
lea ecx, [esi + esi*8]
sub eax, dword [ecx*4 + 0x101e7b6c]
lea esi, [ecx*4 + 0x101e7b6c]
cmp edi, 0x201
jne 0x1001004f
cmp byte [ecx*4 + 0x101e7b70], 0
jne 0x10010037
mov byte [ecx*4 + 0x101e7b70], 1
cmp eax, 0x1f4
jb 0x1001004a
mov byte [ecx*4 + 0x101e7b70], 0
call ebx
mov dword [esi], eax
pop ebx
xor al, al
pop esi
ret
cmp edi, 0x202
jne 0x10010037
cmp byte [ecx*4 + 0x101e7b70], 1
lea edx, [ecx*4 + 0x101e7b70]
jne 0x10010037
pop ebx
mov byte [edx], 0
mov al, 1
pop esi
ret
Function at 0x10016d70
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Log keystrokes via application hook
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
dec eax
jne 0x10016e89
cmp dword [0x101e4958], 1
jne 0x10016d99
push eax
push eax
push eax
push 0x100083f0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp + 8]
push esi
push edi
push eax
mov dword [0x101d8fe0], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10016d50
push eax
call fcn.10036440
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x101d8fdc], eax
call esi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push 0
push 0x10001c40
push 7
call edi
mov dword [0x101df700], eax
call esi
push eax
push 0
push 0x10001df0
push 2
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp + 0xc]
push edx
push 0x40
mov ecx, 0x10016d10
push 5
sub ecx, 0x647cf6
push 0x647cf1
mov dword [0x101df704], eax
mov byte [ebp - 8], 0xe8
mov dword [ebp - 7], ecx
mov dword [ebp + 0xc], 0
call esi
test eax, eax
je 0x10016e4f
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 4]
mov eax, 0x647cf1
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 8]
push eax
push ecx
push 5
push 0x647cf1
mov dword [ebp + 8], 0
call esi
test eax, eax
jne 0x10016e55
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, dword [0x101d8fe0]
push 0
push 0x32
call edi
push eax
push 0x31
call edi
push eax
push 1
push 5
push esi
call dword [sym.imp.USER32.dll_LoadImageA]
pop edi
mov dword [0x101f1c10], eax
mov dword [0x101f1c14], 0
pop esi
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001fe50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [0x101e4788]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareWebzenMuConfig
push getpeername
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001feba
push esi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.Resolution
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1001feba
mov eax, dword [ebp - 0xc]
pop edi
mov esp, ebp
pop ebp
ret
push str.Policy:_value_not_found__n
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10020f80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx eax, al
lea ecx, [ebp - 4]
push ecx
mov dword [0x101f0830], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push str.SoftwareWebzenMuConfig
push getpeername
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10020fc7
push 4
lea edx, [ebp - 8]
push edx
push 4
push eax
mov eax, dword [ebp - 4]
push str.Resolution
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x10022270
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x1001fed0
push 0x6587a6
mov bl, 0xe9
call fcn.10034b90
push 0x1001fef0
push 0x64eb67
call fcn.10034b90
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push 0x694a6e
call esi
mov eax, 0x90909090
mov ecx, 0x694a6e
mov dword [ecx], eax
mov word [ecx + 4], ax
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 6
push 0x694a6e
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026360
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10042fd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100263a7
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036e30
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x18]
push eax
push 6
lea ecx, [ebp - 0x20]
push ecx
push edi
call ebx
mov edx, 0x1112
cmp word [ebp - 0x20], dx
jne 0x100264bc
cmp dword [ebp - 0x1e], 0x36
jne 0x100264bc
cmp byte [ebp + 0xc], 0
push esi
mov esi, 0x10115b44
je 0x100263e7
mov esi, 0x10115b74
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
call ebx
mov edx, dword [0x10115ba4]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi], edx
mov eax, dword [0x10115ba8]
xor eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov ecx, dword [0x10115bac]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 8], ecx
mov edx, dword [0x10115bb0]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0xc], edx
call ebx
mov edx, dword [0x10115ba4]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi + 0x10], edx
mov eax, dword [0x10115ba8]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [0x10115bac]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x18], ecx
mov edx, dword [0x10115bb0]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0x1c], edx
call ebx
mov edx, dword [0x10115ba4]
xor edx, dword [ebp - 0x14]
push edi
mov dword [esi + 0x20], edx
mov eax, dword [0x10115ba8]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov ecx, dword [0x10115bac]
xor ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ecx
mov edx, dword [0x10115bb0]
xor edx, dword [ebp - 8]
mov dword [esi + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036e30
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.10036e30
mov esp, ebp
pop ebp
ret 8
Function at 0x10028a80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x101e95e1], 0
mov edx, eax
je 0x10028ae2
mov eax, 0xc1
mov ecx, 0x101e79a8
call fcn.1000fd40
test al, al
je 0x10028ae2
cmp dword [ebp + 8], 0x201
jne 0x10028abf
mov al, 1
mov byte [0x101e9694], al
pop esi
pop ebp
ret 4
sub edx, dword [0x101e9690]
mov byte [0x101e9694], 0
cmp edx, 0x1f4
jb 0x10028ae2
call esi
mov dword [0x101e9690], eax
mov byte [0x101e95e1], 0
xor al, al
pop esi
pop ebp
ret 4
Function at 0x10029760
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebx
cmp byte [0x101e9b15], 0
mov edi, eax
mov dword [ebp - 4], edi
je 0x100299ea
push esi
mov eax, 0xe6
mov ecx, 0x101e79a8
call fcn.1000fd40
mov esi, dword [ebp + 8]
test al, al
je 0x100297e0
cmp esi, 0x201
jne 0x100297af
pop esi
pop edi
mov byte [0x101e9bc8], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
sub eax, dword [0x101e9bc4]
mov byte [0x101e9bc8], 0
cmp eax, 0x1f4
jb 0x100299e9
call ebx
cmp byte [0x101e9b15], 1
mov dword [0x101e9bc4], eax
setne cl
mov byte [0x101e9b15], cl
mov eax, 0xdd
mov ecx, 0x101e79a8
call fcn.1000fd40
test al, al
je 0x1002983c
mov edx, dword [0x101f1b1c]
inc edx
cmp edx, 1
jle 0x1002983c
cmp esi, 0x201
jne 0x10029817
pop esi
pop edi
mov byte [0x101e9a84], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
sub eax, dword [0x101e9a80]
mov byte [0x101e9a84], 0
cmp eax, 0x64
jb 0x100299e9
call ebx
dec dword [0x101f1b1c]
mov dword [0x101e9a80], eax
mov eax, 0xde
mov ecx, 0x101e79a8
call fcn.1000fd40
test al, al
je 0x10029898
mov ecx, dword [0x101f1b1c]
inc ecx
cmp ecx, 1
jle 0x10029898
cmp esi, 0x201
jne 0x10029873
pop esi
pop edi
mov byte [0x101e9aa8], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, edi
sub edx, dword [0x101e9aa4]
mov byte [0x101e9aa8], 0
cmp edx, 0x64
jb 0x100299e9
call ebx
dec dword [0x101f1b1c]
mov dword [0x101e9aa4], eax
mov eax, 0xdf
mov ecx, 0x101e79a8
call fcn.1000fd40
test al, al
je 0x100298f6
mov eax, dword [0x101f1b1c]
inc eax
cmp eax, dword [0x101f1b20]
jge 0x100298f6
cmp esi, 0x201
jne 0x100298d1
pop esi
pop edi
mov byte [0x101e9acc], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, edi
sub ecx, dword [0x101e9ac8]
mov byte [0x101e9acc], 0
cmp ecx, 0x64
jb 0x100299e9
call ebx
inc dword [0x101f1b1c]
mov dword [0x101e9ac8], eax
mov eax, 0xe0
mov ecx, 0x101e79a8
call fcn.1000fd40
test al, al
je 0x10029953
mov edx, dword [0x101f1b1c]
inc edx
cmp edx, dword [0x101f1b20]
jge 0x10029953
cmp esi, 0x201
jne 0x10029930
pop esi
pop edi
mov byte [0x101e9af0], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
sub edi, dword [0x101e9aec]
mov byte [0x101e9af0], 0
cmp edi, 0x64
jb 0x100299e9
call ebx
inc dword [0x101f1b1c]
mov dword [0x101e9aec], eax
xor esi, esi
cmp dword [0x101f1b18], esi
jle 0x100299e9
mov edi, 0x101e9be8
jmp 0x10029970
lea eax, [esi + 0xe7]
mov ecx, 0x101e79a8
call fcn.1000fd40
test al, al
je 0x100299c9
cmp dword [ebp + 8], 0x201
je 0x100299de
mov eax, dword [ebp - 4]
sub eax, dword [edi]
mov byte [edi + 4], 0
cmp eax, 0x64
jb 0x100299e9
mov eax, dword [0x101f1b1c]
lea ecx, [eax + eax*4]
lea eax, [esi + ecx*2]
lea edx, [eax + eax*2]
shl edx, 4
cmp byte [edx + 0x101f0884], 0
je 0x100299e9
call ebx
mov dword [edi], eax
mov eax, dword [0x101f1b1c]
lea eax, [eax + eax*4]
lea eax, [esi + eax*2]
call fcn.10027a80
inc esi
add edi, 0x24
cmp esi, dword [0x101f1b18]
jl 0x10029970
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [esi + esi*8]
mov byte [ecx*4 + 0x101e9bec], 1
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002b6e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x1002af40
push 0x59fa5e
mov bl, 0xe8
call fcn.10034b90
push 0x1002af40
push 0x59fb67
call fcn.10034b90
push 0x1002af40
push 0x59ecf0
call fcn.10034b90
push 0x1002af40
push 0x59f060
call fcn.10034b90
push 0x1002b210
push 0x59faf6
call fcn.10034b90
push 0x1002b2a0
push 0x5a096c
call fcn.10034b90
push 0x1002b240
push 0x59fbff
call fcn.10034b90
push 0x1002b300
push 0x5a0993
call fcn.10034b90
add esp, 0x40
push 0x1002b270
push 0x59ed97
call fcn.10034b90
push 0x1002b350
push 0x59ed0a
call fcn.10034b90
push fcn.10007f80
push 0x59f07a
call fcn.10034b90
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x59f0b9
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x59f0b9], 0xeb
mov edx, dword [ebp - 4]
push edx
push 1
push 0x59f0b9
call esi
push 0x1002b690
push 0x4f4a06
call fcn.10034b90
push 0x1002b6c0
push 0x5fb486
call fcn.10034b90
push fcn.10007f80
push 0x499418
call fcn.10034b90
push 0x1002b4b0
push 0x5f66c2
mov bl, 0xe9
call fcn.10034b90
push 0x1002b490
push 0x5f6ce1
call fcn.10034b90
push 0x1002b4c0
push 0x5f7e41
call fcn.10034b90
push 0x1002b4e0
push 0x5f84d2
call fcn.10034b90
push 0x1002b500
push 0x5f8625
call fcn.10034b90
add esp, 0x40
push 0x1002b520
push 0x5f8f06
call fcn.10034b90
push 0x1002b3a0
push 0x5f8b94
mov bl, 0xe8
call fcn.10034b90
push 0x1002b580
push 0x68621d
mov bl, 0xe9
call fcn.10034b90
push 0x1002b540
push 0x5f8544
call fcn.10034b90
push 0x1002b560
push 0x5f8694
call fcn.10034b90
mov esi, 0x9b
mov ebx, 0x5f8dc6
call fcn.10034d10
push 0x1002b3c0
push ebx
mov bl, 0xe9
call fcn.10034b90
push 0x1002b990
push 0x4ff521
mov bl, 0xe8
call fcn.10034b90
push 0x1002b990
push 0x67ccc7
call fcn.10034b90
add esp, 0x40
push 0x1002b990
push 0x67d08c
call fcn.10034b90
push 0x1002b990
push 0x67d19a
call fcn.10034b90
push 0x1002b990
push 0x67dda8
call fcn.10034b90
push 0x1002b990
push 0x67de03
call fcn.10034b90
push 0x1002b990
push 0x67de9a
call fcn.10034b90
push 0x1002b990
push 0x67def5
call fcn.10034b90
push 0x1002b990
push 0x67df10
call fcn.10034b90
push 0x1002b990
push 0x6821c9
call fcn.10034b90
add esp, 0x40
push 0x1002b990
push 0x682b1e
call fcn.10034b90
push 0x1002b990
push 0x682b54
call fcn.10034b90
push 0x1002b990
push 0x6835f0
call fcn.10034b90
push 0x1002b990
push 0x683626
call fcn.10034b90
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002b9f0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x10042fd0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea esi, [ebp - 0x408]
call section..text
lea eax, [ebp - 0x408]
push eax
lea esi, [ebx + 0xc0918]
mov eax, str.config.dvg
call fcn.10001140
test al, al
je 0x1002ba63
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.config.dvg
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1002ba63
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xc0914
je 0x1002ba75
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10036e30
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 0x40c]
push ecx
push 0xc0914
lea esi, [ebx + 4]
push esi
push edi
mov dword [ebp - 0x40c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002ba5c
xor eax, eax
mov edi, edi
mov edx, eax
shr edx, 8
xor dl, 0x95
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xca
mov byte [esi + eax], dl
inc eax
cmp eax, 0xc0914
jb 0x1002baa0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.10036e30
mov esp, ebp
pop ebp
ret

Function at 0x1002bae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
mov eax, dword [0x10042fd0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edi + 0x114], 0
push ebx
push esi
je 0x1002bbcb
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1002bb3e
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ebx, [edi + 0xb3]
push ebx
lea esi, [ebp - 0x110]
call fcn.10034cc0
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x1002bb66
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea esi, [ebp - 0x510]
call section..text
mov edx, esi
push edx
lea esi, [ebp - 0x514]
mov eax, ebx
call fcn.10001140
test al, al
jne 0x1002bba1
push 0x10
push str.Error
push str.Error_Cliente_Alterado.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [edi + 0x114]
cmp eax, dword [ebp - 0x514]
je 0x1002bbcb
push 0x10
push str.Error
push str.Error_Cliente_Alterado.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10036e30
mov esp, ebp
pop ebp
ret