joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10072eb9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10072f03
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10072eaa
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10072eb9
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10478b5c
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10072f0a
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.10059d80
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10072fa9
add edi, 4
add eax, 2
dec ecx
jne 0x10072eef
call 0x10072f56
loope 0x10072f4c
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10072fa6
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10072fb7
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10072f6a
cmp eax, ecx
ja 0x10072f6a
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10072ff4
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10072fea
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1005a25f
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10001270
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x70
mov dword [esp + 0x68], 0
jmp 0x100012c7
mov eax, esp
mov dword [eax], 0xf1eb68
mov eax, dword [sym.imp.GDI32.dll_BeginPath]
call eax
sub esp, 4
mov dword [esp + 0x64], 0
mov dword [esp + 0x4c], eax
jmp 0x100012a4
cmp dword [esp + 0x64], 0x395
jne 0x100012d6
jmp 0x10001342
jmp 0x10001420
jmp 0x1000130f
mov dword [esp + 0x60], 0
jmp 0x10001395
cmp dword [esp + 0x68], 0x4b
jne 0x10001284
jmp 0x10001432
mov eax, 0x13
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x48], eax
mov eax, ecx
xor edx, edx
mov ecx, dword [esp + 0x48]
div ecx
mov dword [esp + 0x44], edx
mov eax, dword [esp + 0x44]
sub eax, 3
mov dword [esp + 0x40], eax
je 0x100012b8
jmp 0x10001300
mov eax, dword [esp + 0x44]
sub eax, 7
mov dword [esp + 0x3c], eax
jne 0x1000132e
jmp 0x1000130f
mov eax, esp
mov dword [eax + 4], 0xe12
mov dword [eax], 0xa27675
mov eax, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call eax
sub esp, 8
mov dword [esp + 0x38], eax
jmp 0x1000132e
jmp 0x10001330
mov eax, dword [esp + 0x64]
add eax, 1
mov dword [esp + 0x64], eax
jmp 0x100012a4
mov eax, dword [esp + 0x68]
mov dword [esp + 0x34], eax
mov eax, 0xcc29786d
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x30], eax
mov eax, ecx
mov edx, dword [esp + 0x30]
mul edx
shr edx, 8
imul eax, edx, 0x141
sub ecx, eax
mov eax, ecx
sub eax, 2
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
je 0x10001390
jmp 0x1000137b
mov eax, dword [esp + 0x2c]
sub eax, 0x29
mov dword [esp + 0x24], eax
jne 0x100012ba
jmp 0x1000138e
jmp 0x10001390
jmp 0x100012b3
cmp dword [esp + 0x60], 0xa
setne al
mov byte [esp + 0x23], al
mov al, byte [esp + 0x23]
test al, 1
jne 0x100013ae
jmp 0x1000141b
xor eax, eax
mov ecx, 0xc
lea edx, [esp + 0x50]
mov esi, 0x12e6cc
mov dword [esp + 0x5c], esi
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
call fcn.101723c0
mov eax, esp
lea ecx, [esp + 0x50]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x5c]
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov dword [eax + 0xc], 0xd4b
mov eax, dword [sym.imp.KERNEL32.dll_CreatePipe]
call eax
sub esp, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
add eax, 1
mov dword [esp + 0x60], eax
jmp 0x10001395
jmp 0x100012b3
mov eax, dword [esp + 0x68]
add eax, 1
mov dword [esp + 0x68], eax
jmp 0x100012c7
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x10177e17
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102b2bb0]
jne 0x10177e21
repz ret
jmp fcn.101806b8
Function at 0x10178fcc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1017586a
and dword [ebp - 4], 0
cmp dword [0x102b34c4], 0
mov ebx, eax
jne 0x1017907d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1017912e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1017912e
push eax
call fcn.101757f8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x102b34c4], eax
call esi
push eax
call fcn.101757f8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x102b34c8], eax
call esi
push eax
call fcn.101757f8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x102b34cc], eax
call esi
push eax
call fcn.101757f8
pop ecx
mov dword [0x102b34d4], eax
test eax, eax
je 0x1017907d
push 0x1029ff1c
push edi
call esi
push eax
call fcn.101757f8
pop ecx
mov dword [0x102b34d0], eax
mov eax, dword [0x102b34d0]
cmp eax, ebx
je 0x101790d5
cmp dword [0x102b34d4], ebx
je 0x101790d5
push eax
call fcn.10175873
push dword [0x102b34d4]
mov esi, eax
call fcn.10175873
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x101790d5
test edi, edi
je 0x101790d5
call esi
test eax, eax
je 0x101790cc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x101790cc
test byte [ebp - 0xc], 1
jne 0x101790d5
or dword [ebp + 0x10], 0x200000
jmp 0x1017910e
mov eax, dword [0x102b34c8]
cmp eax, ebx
je 0x1017910e
push eax
call fcn.10175873
pop ecx
test eax, eax
je 0x1017910e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1017910e
mov eax, dword [0x102b34cc]
cmp eax, ebx
je 0x1017910e
push eax
call fcn.10175873
pop ecx
test eax, eax
je 0x1017910e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102b34c4]
call fcn.10175873
pop ecx
test eax, eax
je 0x1017912e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10179130
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101850a0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [0x102b1e54], 0x1221
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x1018514b
jmp 0x10185200
mov dword [0x102b1e54], 0x504
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
movzx eax, word [ecx + eax*2 - 0xe]
cmp eax, 0x6c
je 0x101851e8
jmp 0x101851fb
mov dword [0x102b1e50], 0x249b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
je 0x101851a2
jmp 0x10185202
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
sete dl
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x15]
test al, 1
jne 0x1018518a
jmp 0x10185206
cmp dword [ebp - 0x10], 0x104
jge 0x10185176
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
jne 0x10185167
jmp 0x10185176
jmp 0x10185169
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x1018514b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
je 0x10185129
jmp 0x10185208
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + eax*2 - 0x16]
cmp eax, 0x61
je 0x10185108
jmp 0x10185204
mov eax, dword [0x102b1e54]
sub eax, 0x2637
mov dword [0x102b1e50], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x10185200
mov dword [0x102b1e54], 0x142c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
je 0x101850dd
jmp 0x101850d8
mov dword [0x102b1e50], 0x218e
mov dword [ebp - 4], 1
jmp 0x1018520f
jmp 0x101850d8
jmp 0x10185202
jmp 0x10185204
jmp 0x10185206
jmp 0x10185208
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 0x18
pop ebp
ret

Function at 0x10185aa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [fcn.10185aa0]
mov dword [ebp - 8], eax
mov eax, dword [0x102b1e54]
add eax, 0x1ecc
mov dword [0x102b1e54], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10185afa
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 8]
cmp dword [ecx + eax], 0x4550
sete dl
mov byte [ebp - 9], dl
mov al, byte [ebp - 9]
test al, 1
jne 0x10185aea
jmp 0x10185af8
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10185b28
jmp 0x10185afa
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov eax, dword [0x102b1e50]
sub eax, 0x166b
mov dword [0x102b1e50], eax
mov al, 1
test al, 1
jne 0x10185abe
jmp 0x10185b21
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add esp, 0x14
pop ebp
ret
Function at 0x10005cd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
mov edi, ecx
mov esi, eax
movzx ecx, dl
xor edx, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], edx
test ecx, ecx
jne 0x10005cf9
xor cl, cl
jmp 0x10005d14
lea edx, [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0x1c], eax
call ebx
mov edx, dword [ebp - 0x1c]
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov byte [ebp - 0x10], cl
mov ch, byte [esi]
mov byte [ebp - 1], ch
test cl, cl
je 0x10005d37
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push edx
call ebx
mov eax, dword [ebp + 8]
mov ch, byte [ebp - 1]
movzx ecx, ch
sub ecx, 0xe8
je 0x10005e14
sub ecx, 1
je 0x10005e14
sub ecx, 0x16
jne 0x10005e05
mov dword [ebp - 0x1c], ecx
lea esi, [eax + 1]
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x10005d69
xor cl, cl
jmp 0x10005d81
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push eax
push 0x40
push ecx
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov byte [ebp - 0x10], cl
mov dl, byte [esi]
mov byte [ebp - 1], dl
test cl, cl
je 0x10005da6
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov eax, dword [ebp + 8]
mov dl, byte [ebp - 1]
cmp dl, 0x15
je 0x10005db0
cmp dl, 0x25
jne 0x10005e05
lea esi, [eax + 2]
xor ecx, ecx
mov eax, dword [ebp - 8]
shl eax, 2
mov dword [ebp - 0x1c], ecx
test eax, eax
jne 0x10005dc6
xor al, al
jmp 0x10005dde
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x1c], esi
call ebx
mov ecx, dword [ebp - 0x1c]
test eax, eax
setne al
mov byte [ebp - 0x10], al
mov esi, dword [esi]
test al, al
je 0x10005df8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0xc]
push edx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push ecx
call ebx
mov eax, dword [esi]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea esi, [eax + 1]
xor ecx, ecx
mov eax, dword [ebp - 8]
shl eax, 2
mov dword [ebp - 0x1c], ecx
test eax, eax
jne 0x10005e2a
xor al, al
jmp 0x10005e42
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x1c], esi
call ebx
mov ecx, dword [ebp - 0x1c]
test eax, eax
setne al
mov byte [ebp - 0x10], al
mov edx, dword [esi]
mov dword [ebp - 8], edx
test al, al
je 0x10005e62
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0xc]
push edx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push ecx
call ebx
mov edx, dword [ebp - 8]
lea eax, [edx + 4]
add eax, esi
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006170
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
call fcn.10006640
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.10006330
mov bl, byte [ebp + 0x10]
push ecx
mov dl, bl
lea ecx, [ebp + 0x10]
mov esi, dword [eax]
mov eax, esp
mov dword [eax], esi
call fcn.10005cd0
movzx eax, bl
add esp, 4
test bl, bl
mov dword [ebp - 4], eax
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x18], 0
jne 0x100061c4
mov byte [ebp - 0xc], 0
jmp 0x100061da
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe8
cmp byte [ebp - 0xc], 0
je 0x100061f6
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
lea edi, [esi + 1]
mov esi, dword [ebp + 0xc]
sub esi, edi
shl eax, 2
sub esi, 4
mov dword [ebp - 0x18], 0
test eax, eax
jne 0x10006217
mov byte [ebp - 0xc], al
jmp 0x1000622d
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push edi
mov dword [ebp - 0x18], edi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [edi], esi
cmp byte [ebp - 0xc], 0
je 0x10006248
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x18]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006250
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 8]
push esi
call fcn.10006640
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.10006330
mov dword [ebp - 0x18], 0
mov esi, dword [eax]
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x10006284
mov byte [ebp - 0xc], al
jmp 0x1000629e
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov al, byte [ebp + 0xc]
mov byte [esi], al
cmp byte [ebp - 0xc], 0
je 0x100062c0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100062d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
call fcn.10006640
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.10006330
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x10006329
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100063b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor edx, edx
movzx eax, cl
mov dword [ebp - 0x14], edx
push esi
mov esi, dword [ebp + 8]
test cl, cl
jne 0x100063cb
xor al, al
jmp 0x100063e7
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov bl, byte [esi]
test al, al
je 0x10006405
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006480
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov ecx, 0x5c1e70
call fcn.10006640
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.10006330
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x100064dd
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call edi
cmp esi, 0x53e58955
jne 0x100064f0
mov eax, 0x64
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x5c2130
call fcn.10006640
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.10006330
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1000653f
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call edi
cmp esi, 0x53e58955
jne 0x10006552
mov eax, 0x6e
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x5c6fd0
call fcn.100062d0
xor ecx, ecx
mov edx, 0x78
cmp eax, 0x53e58955
pop edi
cmove ecx, edx
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10012fab
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10012fea
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10012fea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10012fea
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10012fea
cmp dword [ecx + 0x74], 0xe
jbe 0x10012fea
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10017505
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100175a2
push ebx
push esi
call fcn.100174ce
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10017462
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001754f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100175a1
push edi
push eax
call fcn.100143d9
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001756f
call fcn.1001439f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100175a0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10017462
add esp, 0x20
test eax, eax
jne 0x1001758e
push edi
call fcn.1001439f
jmp 0x10017596
push ebx
call fcn.1001439f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001780f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100246e0
push 0x100246d8
push str.FlsAlloc
push 0x1f
call fcn.1001772b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10017843
push dword [ebp + 8]
mov ecx, esi
call dword [0x10020130]
call esi
jmp 0x10017849
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001788d
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100246f0
push 0x100246e8
push str.FlsGetValue
push 0x21
call fcn.1001772b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100178c4
push dword [ebp + 8]
mov ecx, esi
call dword [0x10020130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100178cc
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100246f8
push 0x100246f0
push str.FlsSetValue
push 0x22
call fcn.1001772b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10017906
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10020130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1001eda0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001edcd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001edcd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401110
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x401128
cmp eax, 0x80010106
jne 0x4011a6
push edi
push esi
push 0x6a484c
push 1
push 0
push 0x6a483c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x401157
push edi
push str.CoCreateInstance_NetFwMgr_failed:_0x_08lx_n
call fcn.005aa5c0
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebx
lea edi, [esi + 4]
push edi
push eax
call edx
mov ebx, eax
test ebx, ebx
jge 0x401180
push ebx
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.005aa5c0
add esp, 8
mov eax, ebx
pop ebx
pop edi
pop esi
ret
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
add esi, 8
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x4011a4
push esi
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.005aa5c0
mov eax, esi
add esp, 8
pop ebx
pop edi
pop esi
ret

Function at 0x4014a0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x4014b8
cmp eax, 0x80010106
jne 0x40150c
push edi
push esi
push 0x6a488c
push 1
push 0
push 0x6a487c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x4014e7
push edi
push str.CoCreateInstance_NetFwPolicy2_failed:_0x_08lx_n
call fcn.005aa5c0
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
add esi, 4
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x40150b
push esi
push str.get_Rules_failed:_0x_08lx_n
call fcn.005aa5c0
mov eax, esi
add esp, 8
pop edi
pop esi
ret