joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003ae8a
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.100910d0
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.100910d0
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.100910d0
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x8d4
call fcn.10094a20
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0x1003af43
mov eax, 0
jmp 0x1003b0af
cmp dword [ebp + 0xc], 0
jne 0x1003af79
mov dword [ebp - 0x18], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x1003af76
push 0xa0
push 0x40f7b95
push 6
call fcn.100910e2
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x1003afa1
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x1003af9b
push ebx
call fcn.100910d6
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x1003afd6
push 0x104
push 0x40f7b95
push 6
call fcn.100910e2
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x100f22f6
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x1003b00c
push 0x12e
push 0x40f7b95
push 6
call fcn.100910e2
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x1003b0aa
push 0x225
push 0x40f7b95
push 6
call fcn.100910e2
add esp, 0xc
jmp 0x1003b0af
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.100910d6
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.100910d6
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.100910d6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1003b30e
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x10118aac]
push ebx
call fcn.100910d6
add esp, 4
mov eax, 0x100f234f
mov dword [0x10118aac], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.100910d6
add esp, 4
mov eax, 0x100f234f
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x1003b469
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x1003b37b
push 0x34
push 0x40f7be6
push 6
call fcn.100910e2
add esp, 0xc
mov eax, dword [0x10118aac]
push eax
push eax
mov ebx, eax
call fcn.100020aa
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.100910d0
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.100910d6
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x10118aac]
call fcn.10002091
jmp 0x1003b3c2
mov esp, ebp
pop ebp
ret 8

Function at 0x1003b585
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x1003b69b
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x1003b5c0
push 0
push 0x40f80bf
push 6
call fcn.100910e2
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x1003b5c8
mov esp, ebp
pop ebp
ret 4

Function at 0x1003b7cd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push pe_nt_image_headers32
push 1
mov ebx, 0x184
call fcn.10093f10
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1003b812
push ebx
call fcn.100910d6
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x1003b847
push 0x36
push 0x40f7be1
push 6
call fcn.100910e2
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1003b85a
mov eax, 0x100f22f6
push eax
push 1
mov ebx, 0x170
call fcn.10093f50
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x1003b878
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1003b889
push ebx
call fcn.100910d6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x10040d85
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x10118958]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x10040dc0
add dword [esp], 5
retf

Function at 0x100410ca
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x10118958]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x10041105
add dword [esp], 5
retf

Function at 0x100411c8
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x100411f4
add dword [esp], 5
retf
Function at 0x1005f1d3
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x1005f208
push 0x25
push 0x40f8cd1
push 6
call fcn.100910e2
add esp, 0xc
jmp 0x1005f20d
mov esp, ebp
pop ebp
ret 4

Function at 0x1005f398
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0x18
call fcn.100910d0
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 1
mov eax, 0x100f2362
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.10010e63
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1005f3f9
push ebx
call fcn.100910d6
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp dword [0x10118b7c], 0
jne 0x1005f41d
cmp dword [ebp - 4], 0
je 0x1005f41d
mov eax, 1
jmp 0x1005f422
mov eax, 0
test eax, eax
je 0x1005f498
mov eax, 0x101164a3
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000d283
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1005f44e
push ebx
call fcn.100910d6
add esp, 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call fcn.10037825
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1005f46d
push ebx
call fcn.100910d6
add esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [0x10118b7c], eax
push htons
push 0
push 0x10061039
push 1
mov ebx, 0x9dc
call fcn.100935a0
add esp, 0x10
mov dword [0x10118b80], eax
push 1
lea eax, [ebp - 8]
push eax
push 1
push 0
push 1
push 0
push dword [0x10118b80]
push dword [0x10118b7c]
call fcn.1005f580
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x1005f502
push 0x1f6
push 0x40f8cd4
push 6
call fcn.100910e2
add esp, 0xc
mov dword [ebp - 0xc], eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.10060df0
cmp dword [ebp - 0xc], 0
je 0x1005f55b
push 2
push dword [ebp - 0xc]
call fcn.1005daaf
cmp dword [ebp + 0x1c], 0
mov eax, 0
sete al
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1005f552
push 1
push 0xffffffff
push dword [ebp + 0x18]
push dword [ebp - 0xc]
call fcn.10060e7d
lea eax, [ebp - 0xc]
push eax
call fcn.1005b6b0
cmp dword [ebp - 0x10], 0
mov eax, 0
setne al
jmp 0x1005f56c
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.100910d6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10060c96
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x101189dc], 1
jne 0x10060cfd
cmp dword [0x101189e0], 1
jne 0x10060cb9
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x10060ce5
push 0xbc
push 0x40f8cb1
push 6
call fcn.100910e2
add esp, 0xc
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ebx, dword [ebp + 0xc]
cmp dword [ebx], 0
mov eax, 0
setne al
jmp 0x10060d71
cmp dword [0x10118b88], 0
jne 0x10060d52
mov eax, 0x101164d9
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.1000d283
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10060d2e
push ebx
call fcn.100910d6
add esp, 4
lea eax, [ebp - 8]
push eax
call fcn.1000d57a
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10060d4a
push ebx
call fcn.100910d6
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x10118b88], eax
push dword [0x10118b88]
call fcn.1001174f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x10060d71
mov esp, ebp
pop ebp
ret 8
Function at 0x100706f4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x18
call fcn.100910d0
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0xffff
jle 0x10070922
cmp dword [ebp + 0x24], 0
je 0x10070755
cmp dword [ebp + 0x2c], 0
mov eax, 0
sete al
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10070755
xor eax, eax
jmp 0x1007075a
mov eax, 1
test eax, eax
je 0x10070769
mov dword [ebp + 0x18], 0
cmp dword [0x10118bf0], 0
jne 0x10070819
mov ebx, dword [0x10118a88]
call fcn.100020aa
mov eax, 0
cmp eax, ecx
jl 0x100707a1
push 0x114
push 0x40f7d06
push 1
call fcn.100910e2
add esp, 0xc
shl eax, 2
add ebx, eax
mov dword [ebp - 0xc], ebx
mov eax, 0x101164a3
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.10023721
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100707cd
push ebx
call fcn.100910d6
add esp, 4
lea eax, [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0xc]
push dword [ebx]
call fcn.1007093e
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x100707ee
push ebx
call fcn.100910d6
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [0x10118bf0], eax
push htons
push 0
push 0x10074dce
push 1
mov ebx, 0x9dc
call fcn.100935a0
add esp, 0x10
mov dword [0x10118bf4], eax
push 1
lea eax, [ebp - 4]
push eax
push 1
push 0
push 1
push 0
push dword [0x10118bf4]
push dword [0x10118bf0]
call fcn.1007218b
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10070883
push 0x24f
push 0x40f7d06
push 6
call fcn.100910e2
add esp, 0xc
mov ebx, dword [ebp + 0x20]
mov dword [ebx], eax
push 1
lea eax, [ebp - 4]
push eax
call fcn.100748eb
mov ebx, dword [ebp + 0x20]
cmp dword [ebx], 0
jle 0x10070922
cmp dword [ebp + 0x2c], 0
mov eax, 0
sete al
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x100708f1
mov ebx, dword [ebp + 0x20]
push dword [ebx]
call fcn.10074978
push 1
push 0xffffffff
push dword [ebp + 0x28]
mov ebx, dword [ebp + 0x20]
push dword [ebx]
call fcn.100749c2
mov ebx, dword [ebp + 0x20]
push dword [ebx]
call fcn.10067554
mov ebx, dword [ebp + 0x20]
mov dword [ebx], 0
mov eax, dword [ebp - 8]
jmp 0x1007092a
cmp dword [ebp + 0x18], 0
jne 0x10070905
mov ebx, dword [ebp + 0x20]
push dword [ebx]
call fcn.10074978
cmp dword [ebp + 0x24], 0
jne 0x10070922
mov ebx, dword [ebp + 0x20]
push dword [ebx]
call fcn.10067554
mov ebx, dword [ebp + 0x20]
mov dword [ebx], 0
mov eax, dword [ebp - 8]
jmp 0x1007092a
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.100910d6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x28
Function at 0x100716a7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10020e7e
test eax, eax
je 0x100716ea
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x100716ea
cmp word [eax], 0x5a4d
jne 0x100716ea
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x100716ea
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10020f50
mov eax, dword [ebp + 8]
jmp 0x10071703
mov esp, ebp
pop ebp
ret 4

Function at 0x10073f6f
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10118a10], 1
jne 0x10073fd6
cmp dword [0x10118a24], 1
jne 0x10073f92
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x10073fbe
push 0xbc
push 0x40f8743
push 6
call fcn.100910e2
add esp, 0xc
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ebx, dword [ebp + 0xc]
cmp dword [ebx], 0
mov eax, 0
setne al
jmp 0x1007404a
cmp dword [0x10118c00], 0
jne 0x1007402b
mov eax, 0x101164d9
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.1001c204
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10074007
push ebx
call fcn.100910d6
add esp, 4
lea eax, [ebp - 8]
push eax
call fcn.1001c4fb
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10074023
push ebx
call fcn.100910d6
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x10118c00], eax
push dword [0x10118c00]
call fcn.10020660
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x1007404a
mov esp, ebp
pop ebp
ret 8

Function at 0x100797e0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x10079815
push 0x25
push 0x40f8763
push 6
call fcn.100910e2
add esp, 0xc
jmp 0x1007981a
mov esp, ebp
pop ebp
ret 4
Function at 0x100798e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0x18
call fcn.100910d0
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 1
mov eax, 0x100f2362
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.1001b8e9
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10079941
push ebx
call fcn.100910d6
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp dword [0x10118c3c], 0
jne 0x10079965
cmp dword [ebp - 4], 0
je 0x10079965
mov eax, 1
jmp 0x1007996a
mov eax, 0
test eax, eax
je 0x100799e0
mov eax, 0x101164a3
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.10023721
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x10079996
push ebx
call fcn.100910d6
add esp, 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call fcn.100239b6
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x100799b5
push ebx
call fcn.100910d6
add esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [0x10118c3c], eax
push htons
push 0
push 0x10074dce
push 1
mov ebx, 0x9dc
call fcn.100935a0
add esp, 0x10
mov dword [0x10118c40], eax
push 1
lea eax, [ebp - 8]
push eax
push 1
push 0
push 1
push 0
push dword [0x10118c40]
push dword [0x10118c3c]
call fcn.10079ac8
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x10079a4a
push 0x1f6
push 0x40f8766
push 6
call fcn.100910e2
add esp, 0xc
mov dword [ebp - 0xc], eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.1007a2e4
cmp dword [ebp - 0xc], 0
je 0x10079aa3
push 2
push dword [ebp - 0xc]
call fcn.1007826d
cmp dword [ebp + 0x1c], 0
mov eax, 0
sete al
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x10079a9a
push 1
push 0xffffffff
push dword [ebp + 0x18]
push dword [ebp - 0xc]
call fcn.1007a371
lea eax, [ebp - 0xc]
push eax
call fcn.10067520
cmp dword [ebp - 0x10], 0
mov eax, 0
setne al
jmp 0x10079ab4
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.100910d6
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1007b831
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x1007b9b6
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x1007b86c
push 0
push 0x40f2afa
push 6
call fcn.100910e2
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x1007b874
mov esp, ebp
pop ebp
ret 4

Function at 0x1007f103
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x10118958]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x1007f13e
add dword [esp], 5
retf

Function at 0x10084b3d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x10084bf0
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x10093b60
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10093bc9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.10091c30
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x10094060
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x100940f2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x100940e4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x100940dc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x100940a5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x10094120
Capabilities:
Get common file path
Get disk size

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x114
test eax, eax
push esi
jne 0x10094145
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x100941af
jmp 0x10094165
mov esi, dword [esp + 0x120]
push esi
call dword [0x10119384]
add esp, 4
test eax, eax
je 0x100941af
mov cl, byte [esi]
mov byte [esp + 0x15], 0x3a
mov byte [esp + 0x14], cl
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 8]
push eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x2a], 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x100941af
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
imul edx, dword [esp + 4]
push 0x400
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
pop esi
add esp, 0x114
ret
or eax, 0xffffffff
pop esi
add esp, 0x114
ret

Function at 0x100941c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x100941de
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x100941d3
pop esi
ret
Function at 0x10095ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x10095d01
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x10095d5b
inc edi
cmp edi, esi
jl 0x10095cf5
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x10095d90
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x10095d4a
cmp byte [eax], bl
je 0x10095d65
cmp byte [eax + 1], bl
je 0x10095d6e
cmp byte [eax + 2], bl
je 0x10095d78
cmp byte [eax + 3], bl
je 0x10095d84
add eax, 4
cmp eax, edi
jb 0x10095d21
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x10096370
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x11c]
lea eax, [esp + 0x18]
mov ebx, edi
xor esi, esi
xor ecx, ecx
sub ebx, eax
mov eax, ecx
lea ebp, [esp + ecx + 0x18]
cdq
idiv dword [esp + 0x124]
mov eax, dword [esp + 0x120]
mov byte [ebx + ebp], cl
inc ecx
cmp ecx, 0x100
mov dl, byte [edx + eax]
mov byte [ebp], dl
jl 0x100963a2
lea ebp, [esp + 0x18]
mov eax, edi
sub ebp, edi
mov dword [esp + 0x10], pe_nt_image_headers32
mov cl, byte [eax]
xor edx, edx
mov dl, byte [eax + ebp]
mov byte [esp + 0x14], cl
mov ebx, dword [esp + 0x14]
add esi, edx
and ebx, 0xff
add esi, ebx
and esi, 0x800000ff
jns 0x10096402
dec esi
or esi, 0xffffff00
inc esi
mov dl, byte [esi + edi]
mov byte [eax], dl
mov byte [esi + edi], cl
mov ecx, dword [esp + 0x10]
inc eax
dec ecx
mov dword [esp + 0x10], ecx
jne 0x100963d9
xor al, al
mov byte [edi + 0x100], al
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret