joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4042b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x144], edx
mov esi, ecx
xorps xmm0, xmm0
mov edx, 0x40e0e4
push ecx
lea ecx, [ebp - 0x140]
movdqu xmmword [ebp - 0x14], xmm0
movdqu xmmword [ebp - 0x24], xmm0
call fcn.004020b0
add esp, 4
lea eax, [ebp - 0x14]
xor edx, edx
lea ecx, [ebp - 0x140]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0x10
call fcn.00402d30
add esp, 0x10
mov ebx, 5
nop
xor edx, edx
movzx ecx, byte [edx + 0x40c1f0]
movzx eax, byte [ecx + 0x40c200]
xor byte [ebp + ecx - 0x14], al
movzx ecx, byte [edx + 0x40c1f1]
movzx eax, byte [ecx + 0x40c200]
xor byte [ebp + ecx - 0x14], al
movzx ecx, byte [edx + 0x40c1f2]
movzx eax, byte [ecx + 0x40c200]
xor byte [ebp + ecx - 0x14], al
movzx ecx, byte [edx + 0x40c1f3]
add edx, 4
movzx eax, byte [ecx + 0x40c200]
xor byte [ebp + ecx - 0x14], al
cmp edx, 0x10
jl 0x404312
mov esi, 0x40c1fe
mov edi, 3
lea esp, [esp]
movzx edx, byte [esi]
lea esi, [esi - 5]
movzx ecx, byte [esi + 6]
movzx eax, byte [ebp + edx - 0x14]
xor byte [ebp + ecx - 0x14], al
movzx ecx, byte [esi + 4]
movzx eax, byte [ebp + ecx - 0x14]
xor byte [ebp + edx - 0x14], al
movzx edx, byte [esi + 3]
movzx eax, byte [ebp + edx - 0x14]
xor byte [ebp + ecx - 0x14], al
movzx ecx, byte [esi + 2]
movzx eax, byte [ebp + ecx - 0x14]
xor byte [ebp + edx - 0x14], al
movzx eax, byte [esi + 1]
movzx eax, byte [ebp + eax - 0x14]
xor byte [ebp + ecx - 0x14], al
dec edi
jne 0x404370
xor edx, edx
xor esi, esi
mov edi, edi
movzx ecx, byte [esi + 0x40c1f0]
lea edi, [ebp - 0x14]
add edi, ecx
mov cl, byte [ecx + 0x40c1e0]
mov al, byte [edi]
sub al, dl
cmp edx, 1
jne 0x4043e3
cmp al, 0xff
jne 0x4043e3
or al, al
jmp 0x4043e9
cmp al, cl
sbb edx, edx
neg edx
sub al, cl
inc esi
mov byte [edi], al
cmp esi, 0x10
jl 0x4043c0
dec ebx
jne 0x404310
mov eax, dword [ebp - 0x144]
movdqu xmm0, xmmword [ebp - 0x14]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
movdqu xmmword [eax], xmm0
pop ebx
call fcn.0040abe5
mov esp, ebp
pop ebp
ret
Function at 0x40a500
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0x67452301
mov dword [ebp - 0xd4], 0xefcdab89
mov dword [ebp - 0xd0], 0x98badcfe
mov dword [ebp - 0xcc], 0x10325476
mov dword [ebp - 0xc8], 0xc3d2e1f0
push esi
mov esi, dword [ebp + 8]
test edx, edx
je 0x40a572
push edx
mov edx, ecx
lea ecx, [ebp - 0xe0]
call fcn.0040a280
add esp, 4
mov edx, esi
lea ecx, [ebp - 0xe0]
call fcn.0040a330
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040abe5
mov esp, ebp
pop ebp
ret

Function at 0x40a590
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
mov edi, edx
cmp eax, 0x40
jbe 0x40a61f
push eax
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0x67452301
mov dword [ebp - 0xe8], 0xefcdab89
mov dword [ebp - 0xe4], 0x98badcfe
mov dword [ebp - 0xe0], 0x10325476
mov dword [ebp - 0xdc], 0xc3d2e1f0
call fcn.0040a280
add esp, 4
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0xf4]
call fcn.0040a330
mov dword [ebp + 8], 0x14
lea edi, [ebp - 0x18]
push 0x40
lea eax, [ebx + 0x5c]
push 0x36
push eax
call sub.MSVCR120.dll_memset
push 0x40
lea esi, [ebx + 0x9c]
push 0x5c
push esi
call sub.MSVCR120.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0x18
test ecx, ecx
je 0x40a65c
movzx eax, byte [edi]
lea edi, [edi + 1]
xor byte [esi - 0x40], al
lea esi, [esi + 1]
movzx eax, byte [edi - 1]
xor byte [esi - 1], al
dec ecx
jne 0x40a646
lea edx, [ebx + 0x5c]
mov dword [ebx + 4], 0
mov ecx, ebx
mov dword [ebx + 8], 0x67452301
mov dword [ebx + 0xc], 0xefcdab89
mov dword [ebx + 0x10], 0x98badcfe
mov dword [ebx + 0x14], 0x10325476
mov dword [ebx + 0x18], 0xc3d2e1f0
mov dword [ebx], 0x40
call fcn.00409160
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040abe5
mov esp, ebp
pop ebp
ret
Function at 0x40a6b0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x24], edx
mov ebx, ecx
push edi
lea edx, [ebp - 0x18]
call fcn.0040a330
lea edx, [ebx + 0x9c]
mov dword [ebx + 4], 0
mov ecx, ebx
mov dword [ebx + 8], 0x67452301
mov dword [ebx + 0xc], 0xefcdab89
mov dword [ebx + 0x10], 0x98badcfe
mov dword [ebx + 0x14], 0x10325476
mov dword [ebx + 0x18], 0xc3d2e1f0
mov dword [ebx], 0x40
call fcn.00409160
mov eax, dword [ebx]
lea edi, [ebp - 0x18]
mov ecx, eax
mov esi, 0x14
and ecx, 0x3f
mov edx, 0x40
add eax, esi
sub edx, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebx], eax
cmp eax, esi
jae 0x40a731
inc dword [ebx + 4]
test ecx, ecx
je 0x40a78c
cmp edx, esi
ja 0x40a78c
push edx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebx + 0x1c]
add eax, ecx
push eax
call sub.MSVCR120.dll_memcpy
add esp, 0xc
lea edx, [ebx + 0x1c]
mov ecx, ebx
call fcn.00409160
sub esi, dword [ebp - 0x1c]
lea edi, [ebp - 0x18]
add edi, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
cmp esi, 0x40
jb 0x40a788
mov eax, esi
shr eax, 6
mov dword [ebp - 0x1c], eax
mov edx, edi
mov ecx, ebx
call fcn.00409160
add edi, 0x40
sub esi, 0x40
dec dword [ebp - 0x1c]
jne 0x40a771
mov ecx, dword [ebp - 0x20]
test esi, esi
je 0x40a79c
push esi
lea eax, [ebx + 0x1c]
add eax, ecx
push edi
push eax
call sub.MSVCR120.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.0040a330
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040abe5
mov esp, ebp
pop ebp
ret

Function at 0x40a860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
lea esi, [eax + 0xf]
lea ebx, [edi + 0xf]
cmp edi, esi
ja 0x40a879
cmp ebx, eax
jae 0x40a884
lea ecx, [edx + 0xf]
cmp edi, ecx
ja 0x40a8b0
cmp ebx, edx
jb 0x40a8b0
sub edx, eax
mov esi, 0x10
sub edi, eax
lea ecx, [ecx]
mov cl, byte [edx + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [edi + eax - 1], cl
dec esi
jne 0x40a890
pop edi
pop esi
pop ebx
pop ebp
ret
movdqu xmm1, xmmword [edx]
movdqu xmm0, xmmword [eax]
pxor xmm1, xmm0
movdqu xmmword [edi], xmm1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x577c0908
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x31e200b9
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10005260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
shr eax, 5
xor ebx, ebx
cmp byte [ebp + 0x10], bl
push edi
mov edi, dword [ebp + 8]
setne bl
dec ebx
and ecx, 0x1f
or esi, 0xffffffff
shl esi, cl
lea edx, [edi + eax*4]
mov eax, dword [edx]
xor eax, ebx
and esi, eax
jne 0x10005296
add edx, 4
mov esi, dword [edx]
xor esi, ebx
je 0x1000528d
push esi
call fcn.100010c2
add esp, 4
sub edx, edi
sar edx, 2
shl edx, 5
add eax, edx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001fdf4
Capabilities:
Create thread

Disassembly:
push 0x104
mov eax, 0x1003f6ae
call fcn.100276a5
mov edi, ecx
push 0xe8
lea ecx, [ebp - 0xfc]
call fcn.100013f2
lea ecx, [ebp - 0xfc]
call fcn.10020e8f
and dword [ebp - 4], 0
lea eax, [ebp - 0x100]
and dword [ebp - 0x100], 0
mov ecx, edi
push eax
call fcn.10020a34
lea ecx, [ebp - 0xfc]
mov esi, eax
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022ce5
push dword [ebp + 0xc]
lea eax, [ebp - 0xfc]
mov ecx, edi
push eax
call fcn.100209dd
push dword [ebp + 8]
mov ebx, 0x1004f948
lea ecx, [ebp - 0xfc]
push ebx
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022842
push ebx
lea ecx, [ebp - 0xfc]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.100223f0
push ebx
xor ebx, ebx
lea eax, [ebp - 0x110]
push ebx
push esi
push eax
call fcn.100225f4
add esp, 0xc
lea ecx, [ebp - 0xfc]
push eax
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022869
lea ecx, [ebp - 0xfc]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022ca6
push 4
lea ecx, [ebp - 0xfc]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022d3f
lea ecx, [ebp - 0xfc]
call fcn.10022d9e
push eax
lea ecx, [ebp - 0xfc]
call fcn.10022425
push eax
mov ecx, edi
call fcn.10022ddc
push ebx
push ebx
push ebx
push eax
push ebx
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 4
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.10028e00
add esp, 0xc
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
push esi
call fcn.100209e6
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0xfc]
call fcn.1002107c
mov eax, esi
call fcn.10027654
ret 8
Function at 0x1001ff48
Capabilities:
Create thread

Disassembly:
push 0x104
mov eax, 0x1003f6e8
call fcn.100276a5
mov ebx, ecx
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0xf8]
push 0xe8
call fcn.100013f2
lea ecx, [ebp - 0xf8]
call fcn.10020e8f
and dword [ebp - 4], 0
lea eax, [ebp - 0x100]
and dword [ebp - 0x100], 0
mov ecx, ebx
push eax
call fcn.10020a34
lea ecx, [ebp - 0xf8]
mov edi, eax
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022ce5
push esi
lea eax, [ebp - 0xf8]
mov ecx, ebx
push eax
call fcn.100209b0
push dword [ebp + 8]
mov esi, 0x1004f948
lea ecx, [ebp - 0xf8]
push esi
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022842
push esi
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.100223f0
push esi
xor esi, esi
lea eax, [ebp - 0x110]
push esi
push edi
push eax
call fcn.100225f4
add esp, 0xc
lea ecx, [ebp - 0xf8]
push eax
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022869
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022ca6
push 4
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022d3f
lea ecx, [ebp - 0xf8]
call fcn.10022d9e
push eax
lea ecx, [ebp - 0xf8]
call fcn.10022425
push eax
mov ecx, ebx
call fcn.10022ddc
push esi
push esi
push esi
push eax
push esi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 4
lea eax, [ebp - 0xfc]
push esi
push eax
call fcn.10028e00
add esp, 0xc
lea eax, [ebp - 0xfc]
mov ecx, ebx
push eax
push edi
call fcn.100209e6
mov esi, dword [ebp - 0xfc]
lea ecx, [ebp - 0xf8]
call fcn.1002107c
mov eax, esi
call fcn.10027654
ret 8
Function at 0x100200a6
Capabilities:
Create thread

Disassembly:
push 0x104
mov eax, 0x1003f6e8
call fcn.100276a5
mov edi, ecx
push 0xe8
lea ecx, [ebp - 0xf8]
call fcn.100013f2
lea ecx, [ebp - 0xf8]
call fcn.10020e8f
and dword [ebp - 4], 0
lea eax, [ebp - 0x100]
and dword [ebp - 0x100], 0
mov ecx, edi
push eax
call fcn.10020a34
lea ecx, [ebp - 0xf8]
mov esi, eax
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022ce5
push dword [ebp + 0x14]
lea eax, [ebp - 0xf8]
mov ecx, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.100209b9
push dword [ebp + 8]
mov ebx, 0x1004f948
lea ecx, [ebp - 0xf8]
push ebx
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022842
push ebx
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.100223f0
push ebx
xor ebx, ebx
lea eax, [ebp - 0x110]
push ebx
push esi
push eax
call fcn.100225f4
add esp, 0xc
lea ecx, [ebp - 0xf8]
push eax
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022869
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022ca6
push 4
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022d3f
lea ecx, [ebp - 0xf8]
call fcn.10022d9e
push eax
lea ecx, [ebp - 0xf8]
call fcn.10022425
push eax
mov ecx, edi
call fcn.10022ddc
push ebx
push ebx
push ebx
push eax
push ebx
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 4
push ebx
lea eax, [ebp - 0xfc]
push eax
call fcn.10028e00
add esp, 0xc
lea eax, [ebp - 0xfc]
mov ecx, edi
push eax
push esi
call fcn.100209e6
mov esi, dword [ebp - 0xfc]
lea ecx, [ebp - 0xf8]
call fcn.1002107c
mov eax, esi
call fcn.10027654
ret 0x10
Function at 0x10020209
Capabilities:
Create thread

Disassembly:
push 0x104
mov eax, 0x1003f6e8
call fcn.100276a5
mov ebx, ecx
mov esi, dword [ebp + 0x10]
lea ecx, [ebp - 0xf8]
push 0xe8
call fcn.100013f2
lea ecx, [ebp - 0xf8]
call fcn.10020e8f
and dword [ebp - 4], 0
lea eax, [ebp - 0x100]
and dword [ebp - 0x100], 0
mov ecx, ebx
push eax
call fcn.10020a34
lea ecx, [ebp - 0xf8]
mov edi, eax
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022ce5
push esi
push dword [ebp + 0xc]
lea eax, [ebp - 0xf8]
mov ecx, ebx
push eax
call fcn.100209c2
push dword [ebp + 8]
mov esi, 0x1004f948
lea ecx, [ebp - 0xf8]
push esi
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022842
push esi
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.100223f0
push esi
xor esi, esi
lea eax, [ebp - 0x110]
push esi
push edi
push eax
call fcn.100225f4
add esp, 0xc
lea ecx, [ebp - 0xf8]
push eax
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022869
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022ca6
push 4
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022d3f
lea ecx, [ebp - 0xf8]
call fcn.10022d9e
push eax
lea ecx, [ebp - 0xf8]
call fcn.10022425
push eax
mov ecx, ebx
call fcn.10022ddc
push esi
push esi
push esi
push eax
push esi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 4
push esi
lea eax, [ebp - 0xfc]
push eax
call fcn.10028e00
add esp, 0xc
lea eax, [ebp - 0xfc]
mov ecx, ebx
push eax
push edi
call fcn.100209e6
mov esi, dword [ebp - 0xfc]
lea ecx, [ebp - 0xf8]
call fcn.1002107c
mov eax, esi
call fcn.10027654
ret 0xc
Function at 0x1002036a
Capabilities:
Create thread

Disassembly:
push 0x104
mov eax, 0x1003f6e8
call fcn.100276a5
mov ebx, ecx
mov esi, dword [ebp + 0x14]
lea ecx, [ebp - 0xf8]
push 0xe8
call fcn.100013f2
lea ecx, [ebp - 0xf8]
call fcn.10020e8f
and dword [ebp - 4], 0
lea eax, [ebp - 0x100]
and dword [ebp - 0x100], 0
mov ecx, ebx
push eax
call fcn.10020a34
lea ecx, [ebp - 0xf8]
mov edi, eax
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022ce5
push dword [ebp + 0x18]
lea eax, [ebp - 0xf8]
mov ecx, ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.100209cb
push dword [ebp + 8]
mov esi, 0x1004f948
lea ecx, [ebp - 0xf8]
push esi
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022842
push esi
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.100223f0
push esi
xor esi, esi
lea eax, [ebp - 0x110]
push esi
push edi
push eax
call fcn.100225f4
add esp, 0xc
lea ecx, [ebp - 0xf8]
push eax
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022869
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022ca6
push 4
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022d3f
lea ecx, [ebp - 0xf8]
call fcn.10022d9e
push eax
lea ecx, [ebp - 0xf8]
call fcn.10022425
push eax
mov ecx, ebx
call fcn.10022ddc
push esi
push esi
push esi
push eax
push esi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 4
push esi
lea eax, [ebp - 0xfc]
push eax
call fcn.10028e00
add esp, 0xc
lea eax, [ebp - 0xfc]
mov ecx, ebx
push eax
push edi
call fcn.100209e6
mov esi, dword [ebp - 0xfc]
lea ecx, [ebp - 0xf8]
call fcn.1002107c
mov eax, esi
call fcn.10027654
ret 0x14
Function at 0x100204d1
Capabilities:
Create thread

Disassembly:
push 0x104
mov eax, 0x1003f6e8
call fcn.100276a5
mov ebx, ecx
mov esi, dword [ebp + 0x14]
lea ecx, [ebp - 0xf8]
push 0xe8
call fcn.100013f2
lea ecx, [ebp - 0xf8]
call fcn.10020e8f
and dword [ebp - 4], 0
lea eax, [ebp - 0x100]
and dword [ebp - 0x100], 0
mov ecx, ebx
push eax
call fcn.10020a34
lea ecx, [ebp - 0xf8]
mov edi, eax
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022ce5
push dword [ebp + 0x18]
lea eax, [ebp - 0xf8]
mov ecx, ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.100209d4
push dword [ebp + 8]
mov esi, 0x1004f948
lea ecx, [ebp - 0xf8]
push esi
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022842
push esi
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.100223f0
push esi
xor esi, esi
lea eax, [ebp - 0x110]
push esi
push edi
push eax
call fcn.100225f4
add esp, 0xc
lea ecx, [ebp - 0xf8]
push eax
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022869
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022ca6
push 4
lea ecx, [ebp - 0xf8]
call fcn.1002110e
lea ecx, [eax + 0x78]
call fcn.10022d3f
lea ecx, [ebp - 0xf8]
call fcn.10022d9e
push eax
lea ecx, [ebp - 0xf8]
call fcn.10022425
push eax
mov ecx, ebx
call fcn.10022ddc
push esi
push esi
push esi
push eax
push esi
push esi
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 4
push esi
lea eax, [ebp - 0xfc]
push eax
call fcn.10028e00
add esp, 0xc
lea eax, [ebp - 0xfc]
mov ecx, ebx
push eax
push edi
call fcn.100209e6
mov esi, dword [ebp - 0xfc]
lea ecx, [ebp - 0xf8]
call fcn.1002107c
mov eax, esi
call fcn.10027654
ret 0x14

Function at 0x10021731
Capabilities:
Link many functions at runtime

Disassembly:
push 0x1c
mov eax, 0x1003f89d
call fcn.10027672
mov edi, ecx
push 0x1004fd00
jmp loc.100a5b44

Function at 0x10022150
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x10
mov eax, 0x1003f8fb
call fcn.10027672
mov edi, ecx
push 0x40
push 0x3000
push dword [ebp + 8]
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x100221c8
push 8
lea ecx, [ebp - 0x1c]
call fcn.100013f2
sub esp, 0xc
mov dword [ebp + 8], edi
mov eax, esp
mov dword [ebp - 0x10], 0x10022687
lea ecx, [ebp + 8]
push 0x1004f959
push ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.1001fdc6
add esp, 0x10
lea ecx, [ebp - 0x1c]
push esi
call fcn.1001f63a
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [edi + 4]
call fcn.10022cdc
lea ecx, [ebp - 0x1c]
call fcn.10021068
mov eax, esi
call fcn.10027640
ret 4
Function at 0x10022495
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1007f7c4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x14], 0
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0xc], eax
je 0x100224d8
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 0x40
push dword [ebp + 0x10]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x10022508
mov eax, dword [ebp - 0xc]
push 0
push dword [ebp + 0x10]
push eax
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [ebp + 0x14], 0
je 0x10022508
mov eax, dword [ebp - 8]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 0x10]
mov dword [ebp - 8], 1
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10027632
leave
ret 0x10

Function at 0x10023074
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ecx + 0xc]
push 1
push eax
call fcn.10023bbf
pop ecx
pop ecx
test eax, eax
jne 0x100230a1
push eax
push eax
push dword [ebp + 8]
push 0x10023cdd
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret 4
Function at 0x100233a6
Capabilities:
Acquire debug privileges

Disassembly:
push 0x30
mov eax, 0x1003fa68
call fcn.100276a5
or dword [ebp - 0x2c], 0xffffffff
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
lea ecx, [ebp - 0x3c]
push edi
call fcn.10020aa6
xor ebx, ebx
mov dword [ebp - 4], ebx
test edi, edi
je 0x10023479
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenProcessToken
push edi
call esi
push str.LookupPrivilegeValueW
push edi
mov dword [ebp - 0x30], eax
call esi
push str.AdjustTokenPrivileges
push edi
mov dword [ebp - 0x34], eax
call esi
mov edi, eax
cmp dword [ebp - 0x30], ebx
je 0x10023479
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x10023479
test edi, edi
je 0x10023479
lea eax, [ebp - 0x2c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x30]
test eax, eax
je 0x1002346a
lea eax, [ebp - 0x18]
push eax
push str.SeDebugPrivilege
push ebx
call esi
test eax, eax
je 0x1002346a
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
movzx eax, byte [ebp + 8]
push ebx
push ebx
add eax, eax
mov dword [ebp - 0x28], 1
push 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push ebx
push dword [ebp - 0x2c]
mov dword [ebp - 0x20], ecx
call edi
test eax, eax
je 0x1002346a
inc ebx
jmp 0x10023479
cmp dword [ebp - 0x2c], 0xffffffff
je 0x10023479
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x3c]
call fcn.10020f80
mov al, bl
call fcn.10027654
ret 4