joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006e1d0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10163a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1006c730
push 0x20
push str.BEqEKPqGhmtNa3xthcYEgKRS5GeaHXhE
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0xc], 0x4ed
mov dword [esi + 4], 3
mov dword [esi + 0x14], 6
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x34]
call fcn.100025e0
push 0x20
push str.BEqEKPqGhmszmUN9RmwtLBw7q6rKz0cy
lea ecx, [esi + 0x20]
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x38]
call fcn.100025e0
push 0x20
push str.BEqEKPqGhmsH9DaRSMwlclRBIhVvpGX
lea ecx, [esi + 0x24]
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x3c]
call fcn.100025e0
push 0x2c
push str.8M6QhtBsA3ZAc1xfKYfPBiM4YlSFvvmA1iKaqeE2Hc
lea ecx, [esi + 0x28]
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x40]
call fcn.100025e0
push 0x20
push str.8M6QhtBsA216EGaRYEazgNYimqnhNh3
lea ecx, [esi + 0x2c]
call fcn.100025e0
push 0xc
push str.WmobnHXWkqw
lea ecx, [esi + 0x44]
call fcn.100025e0
push 0x20
push str.8M6QhtBsA3Wc2tHdQ8V2YaP9_9lNNUp
lea ecx, [esi + 0x30]
call fcn.100025e0
push 0xc
push str.WmobnHXWkqw
lea ecx, [esi + 0x48]
call fcn.100025e0
mov ecx, dword [esp + 8]
mov dword [esi + 0x60], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x1006e4a0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10163a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1006c730
push 0x20
push str.BEqEKPqGhmtNa3xthcYEgKRS5GeaHXhE
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0xc], 0x4ee
mov dword [esi + 4], 3
mov dword [esi + 0x14], 6
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x34]
call fcn.100025e0
push 0x20
push str.BEqEKPqGhmszmUN9RmwtLBw7q6rKz0cy
lea ecx, [esi + 0x20]
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x38]
call fcn.100025e0
push 0x20
push str.BEqEKPqGhmsH9DaRSMwlclRBIhVvpGX
lea ecx, [esi + 0x24]
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x3c]
call fcn.100025e0
push 0x20
push str.BEqEKPqGhmu_EmyNt6YMVIaP9_9lNNUp
lea ecx, [esi + 0x28]
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x40]
call fcn.100025e0
push 0x20
push str.BEqEKPqGhmspmVepmQYqn4aP9_9lNNUp
lea ecx, [esi + 0x2c]
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x44]
call fcn.100025e0
push 0x20
push str.BEqEKPqGhms6Qd_0sKsLW1CnLvx3avwF
lea ecx, [esi + 0x30]
call fcn.100025e0
push 0x18
push str.Vo1RuXlZTgwDWIpqp4TYdw
lea ecx, [esi + 0x48]
call fcn.100025e0
mov ecx, dword [esp + 8]
mov dword [esi + 0x64], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10070df0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10163a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1006c730
push 0x18
push str.B48NwkuSznYA6jZkCkcDQ
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0xc], 0x1b72
mov dword [esi + 4], 3
mov dword [esi + 0x14], 6
call fcn.100025e0
push 0xc
push str.0L4NTLPfzak
lea ecx, [esi + 0x20]
call fcn.100025e0
push 0xc
push str.3yj9CiQRaZE
lea ecx, [esi + 0x24]
call fcn.100025e0
push 0xc
push str.Zxy8gI0YSw4
lea ecx, [esi + 0x28]
call fcn.100025e0
push 0xc
push str.Ya3n_rDmMD8
lea ecx, [esi + 0x2c]
call fcn.100025e0
push 0xc
push str.BA7ns0we55s
lea ecx, [esi + 0x30]
call fcn.100025e0
mov ecx, dword [esp + 8]
mov dword [esi + 0x60], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10070eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10163a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1006c730
push 0x18
push str.7zpp4MaLfow3vj2gJDeDbw
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0xc], 0x4f2
mov dword [esi + 4], 3
mov dword [esi + 0x14], 6
call fcn.100025e0
push 0x18
push str.21e7mkA_fjbp5iXX3XdEoA
lea ecx, [esi + 0x20]
call fcn.100025e0
push 0x18
push str.Yz2AGtI4mnXVWmi7oVgaSw
lea ecx, [esi + 0x38]
call fcn.100025e0
push 0x18
push str.a4mrrJYmPDTBXMwVDJFAag
lea ecx, [esi + 0x24]
call fcn.100025e0
push 0x18
push str.T2lJPT23GVsA6jZkCkcDQ
lea ecx, [esi + 0x28]
call fcn.100025e0
push 0x18
push str.bXnWFFTUWu0A6jZkCkcDQ
lea ecx, [esi + 0x2c]
call fcn.100025e0
push 0x18
push str.KVo1IaRAEC22Egyjy6qCg
lea ecx, [esi + 0x30]
call fcn.100025e0
mov ecx, dword [esp + 8]
mov dword [esi + 0x60], 1
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10070f80
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10163a58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.1006c730
push 0x18
push str.TWt8bYXGBICICFzrMTizpg
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esi + 0xc], 0x4f1
mov dword [esi + 4], 3
mov dword [esi + 0x14], 6
call fcn.100025e0
push 0xc
push str.dR2AVzFdSYQ
lea ecx, [esi + 0x34]
call fcn.100025e0
push 0x18
push str.M5lDfUZsLSy6UTrNhReNbw
lea ecx, [esi + 0x20]
call fcn.100025e0
push 0xc
push str.Z5u9jQb0Hig
lea ecx, [esi + 0x38]
call fcn.100025e0
push 0x18
push str.MuprfsXnQFwUgZG6xAr5JQ
lea ecx, [esi + 0x24]
call fcn.100025e0
push 0xc
push str.dR2AVzFdSYQ
lea ecx, [esi + 0x3c]
call fcn.100025e0
push 0x18
push str.vxJsjbemDFQm45XZBDBiQ
lea ecx, [esi + 0x28]
call fcn.100025e0
push 0xc
push str.dR2AVzFdSYQ
lea ecx, [esi + 0x40]
call fcn.100025e0
push 0x18
push str.KZlXqZkGKp8m45XZBDBiQ
lea ecx, [esi + 0x2c]
call fcn.100025e0
push 0xc
push str.dR2AVzFdSYQ
lea ecx, [esi + 0x44]
call fcn.100025e0
push 0x18
push str.OkHf9LCrC1tmk5lmow9zcw
lea ecx, [esi + 0x30]
call fcn.100025e0
push 0xc
push str.dR2AVzFdSYQ
lea ecx, [esi + 0x48]
call fcn.100025e0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x100787f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10163ef8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 8]
sub esp, 0x18
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
mov dword [esp + 0x30], 0
call fcn.100599f0
push edi
mov ecx, esi
call fcn.100758d0
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10078856
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10078874
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10078892
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100788b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 0x18
Function at 0x10089660
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov ecx, edi
mov eax, edi
and ecx, 0xff
shr eax, 8
or ecx, eax
test edi, edi
jbe 0x10089691
mov eax, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
sub esi, eax
mov dl, byte [esi + eax]
not dl
xor dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x10089683
pop esi
pop edi
ret 0xc

Function at 0x10089cb0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
push edi
xor edi, edi
cmp eax, edi
je 0x10089cc9
push eax
call fcn.10152975
add esp, 4
mov dword [esi + 0x14], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x10089cfd
push 0xc8
push eax
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x24]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], edi
pop edi
mov eax, 1
pop esi
ret

Function at 0x1008a6c0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
jne 0x1008a6df
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x1008a6df
xor eax, eax
jmp 0x1008a771
push 0x1017e884
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1008a70b
push 0x1017e884
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1008a70b
xor eax, eax
jmp 0x1008a771
je 0x1008a718
jne 0x1008a718
call 0x27f11784
adc byte [ebx - 0xae03b3], cl
adc eax, sym.imp.KERNEL32.dll_GetProcAddress
push str.SystemFunction041
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 8], 0
jne 0x1008a73a
xor eax, eax
jmp 0x1008a771
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 8]
mov dword [eax + 4], 1
push 0
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x1008a660
push 0
push 0
call fcn.101021ba
add esp, 0x18
mov edx, dword [ebp - 8]
mov dword [edx + 0x24], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x1008a780
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2130
call fcn.10101f10
mov eax, dword [0x101b9578]
mov dword [esp + 0x212c], eax
push esi
push edi
xor eax, eax
mov ecx, 0x800
lea edi, [esp + 0x130]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
sub eax, 2
je 0x1008a7d6
sub eax, 2
jne 0x1008a7ef
mov eax, dword [str.ERROR]
mov ecx, dword [0x1017e8b4]
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], ecx
jmp 0x1008a7ef
mov edx, dword [str.INFO]
mov eax, dword [0x1017e8ac]
mov dword [esp + 0x130], edx
mov dword [esp + 0x134], eax
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push edx
lea eax, [esp + 0x13f]
push 0x1ff9
push eax
call fcn.101044aa
call fcn.10104437
lea ecx, [esp + 0x18]
push ecx
call fcn.10103d9d
lea edi, [esp + 0x1c]
add esp, 0x14
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1008a820
mov dx, word [0x101738dc]
lea eax, [esp + 0x11]
push eax
mov word [edi], dx
call fcn.10103d2d
lea edi, [esp + 0xc]
add esp, 4
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1008a844
mov cx, word [0x1017e8a4]
push 0x104
lea edx, [esp + 0x2c]
push edx
mov word [edi], cx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x28]
dec edi
jmp 0x1008a870
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1008a870
mov eax, dword [str.HintSock.log]
mov ecx, dword [0x1017e898]
mov edx, dword [0x1017e89c]
mov dword [edi], eax
mov ax, word [0x1017e8a0]
mov dword [edi + 4], ecx
lea ecx, [esp + 0x28]
mov dword [edi + 8], edx
push 0x1016939c
push ecx
mov word [edi + 0xc], ax
call fcn.101038f1
mov esi, eax
add esp, 8
test esi, esi
je 0x1008a912
lea eax, [esp + 8]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1008a8c0
sub eax, edx
push esi
push eax
lea edx, [esp + 0x10]
push 1
push edx
call fcn.10103ce1
lea eax, [esp + 0x140]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1008a8e4
sub eax, edx
push esi
push eax
lea eax, [esp + 0x138]
push 1
push eax
call fcn.10103ce1
push esi
push 0x101684cc
call fcn.10103b69
push esi
call fcn.1010370f
add esp, 0x1c
mov ecx, dword [esp + 0x2134]
call fcn.1010122d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1008aad0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017e8c8
push 0x10101244
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
mov eax, dword [0x101b9578]
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
mov esi, 0x10000
je 0x1008ab13
lea esi, [eax + 0x10000]
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
or ebx, 0xffffffff
lea ecx, [ecx]
push 0x1c
lea ecx, [ebp - 0x78]
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
jbe 0x1008ab4e
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x6c]
add eax, edx
cmp eax, esi
jae 0x1008ab6b
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.1010122d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp - 0x68], 0x1000
jne 0x1008ac2f
mov eax, dword [ebp - 0x64]
cmp al, 1
je 0x1008ac2f
test ah, 1
jne 0x1008ac2f
mov dword [ebp - 4], 0
push 0
push 0x40
lea ecx, [ebp - 0x5c]
push ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1008abb8
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x78]
lea esi, [ecx + edx]
jmp 0x1008ab30
cmp word [ebp - 0x5c], 0x5a4d
jne 0x1008ac02
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x6c]
ja 0x1008ac02
cmp eax, 0x40
jb 0x1008ac02
push 0
push 0xf8
mov edx, dword [ebp + 0x10]
push edx
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1008abf7
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x78]
lea esi, [ecx + edx]
jmp 0x1008ab30
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x4550
je 0x1008ac13
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x78]
lea esi, [ecx + edx]
jmp 0x1008ab30
mov dword [ebp - 4], ebx
mov eax, esi
jmp 0x1008ab50
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x78]
lea esi, [ecx + edx]
jmp 0x1008ab30
Function at 0x1008b850
Capabilities:
Create process on windows
Print debug messages
Resume thread

Disassembly:
mov ecx, dword [esp + 0x30]
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x34]
mov eax, ebx
or eax, 4
test ecx, ecx
jne 0x1008b86b
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x40]
push edx
push eax
call ecx
test eax, eax
jne 0x1008b8a6
pop ebx
add esp, 0x18
ret 0x30
mov ecx, dword [esp + 0x48]
xor eax, eax
test ecx, ecx
je 0x1008b8b9
mov dword [esp + 4], ecx
mov eax, 1
mov edx, dword [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push edx
call fcn.1008b520
test eax, eax
jne 0x1008b8d8
push str.UpdateProcessA_Err
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x44]
test eax, eax
mov ecx, dword [esp + 0x10]
je 0x1008b8fb
mov edx, dword [esp + 0xc]
mov dword [eax], edx
mov edx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0xc], edx
test bl, 4
jne 0x1008b907
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop ebx
add esp, 0x18
ret 0x30

Function at 0x1008b920
Capabilities:
Create process on windows
Print debug messages
Resume thread

Disassembly:
mov ecx, dword [esp + 0x30]
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x34]
mov eax, ebx
or eax, 4
test ecx, ecx
jne 0x1008b93b
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x40]
push edx
push eax
call ecx
test eax, eax
jne 0x1008b976
pop ebx
add esp, 0x18
ret 0x30
mov ecx, dword [esp + 0x48]
xor eax, eax
test ecx, ecx
je 0x1008b989
mov dword [esp + 4], ecx
mov eax, 1
mov edx, dword [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push edx
call fcn.1008b520
test eax, eax
jne 0x1008b9a8
push str.UpdateProcessW_Err
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x44]
test eax, eax
mov ecx, dword [esp + 0x10]
je 0x1008b9cb
mov edx, dword [esp + 0xc]
mov dword [eax], edx
mov edx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 0xc], edx
test bl, 4
jne 0x1008b9d7
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop ebx
add esp, 0x18
ret 0x30
Function at 0x1008b9f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017e908
push 0x10101244
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x3c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], ecx
cmp word [ecx], 0x5a4d
jne 0x1008ba87
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [eax], 0x4550
jne 0x1008ba87
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x1008ba87
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x1008ba87
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1008bb50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [0x101c83e8]
test esi, esi
je 0x1008bb7a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x1008bb63
pop edi
pop esi
pop ecx
ret

Function at 0x1008bbd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x1c
push ebp
push esi
mov esi, eax
and eax, 0xffff
push edi
je 0x1008bbe6
lea esi, [eax + esi - 0x10000]
cmp esi, dword [esp + 0x2c]
jae 0x1008bc94
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea esp, [esp]
cmp esi, 0x50000000
jb 0x1008bc17
cmp esi, 0x80000000
ja 0x1008bc17
mov esi, 0x80010000
jmp 0x1008bc8a
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push 0x1c
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], eax
push ecx
mov dword [esp + 0x28], eax
push esi
mov dword [esp + 0x30], eax
call ebp
test eax, eax
je 0x1008bc94
cmp dword [esp + 0x1c], 0x10000
mov eax, dword [esp + 0x18]
jne 0x1008bc73
cmp eax, 0x10000
jb 0x1008bc73
push 0x40
push 0x3000
push 0x10000
push esi
call edi
test eax, eax
jne 0x1008bc96
add esi, 0x10000
jmp 0x1008bc8a
mov edx, dword [esp + 0xc]
lea esi, [edx + eax]
mov eax, esi
and eax, 0xffff
je 0x1008bc8a
lea esi, [esi + eax - 0x10000]
cmp esi, dword [esp + 0x2c]
jb 0x1008bc00
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x1008bca0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, eax
add esi, 0xffff0000
mov eax, esi
and eax, 0xffff
push edi
je 0x1008bcba
sub esi, eax
cmp esi, dword [esp + 0x30]
jbe 0x1008bd52
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, 0x10000
cmp esi, 0x50000000
jb 0x1008bcec
cmp esi, 0x80000000
ja 0x1008bcec
mov esi, 0x4fff0000
jmp 0x1008bd4c
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0x1c
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], eax
push ecx
mov dword [esp + 0x2c], eax
push esi
mov dword [esp + 0x34], eax
call ebp
test eax, eax
je 0x1008bd52
cmp dword [esp + 0x20], ebx
jne 0x1008bd37
cmp dword [esp + 0x1c], ebx
jb 0x1008bd37
push 0x40
push 0x3000
push ebx
push esi
call edi
test eax, eax
jne 0x1008bd54
sub esi, ebx
jmp 0x1008bd4c
mov esi, dword [esp + 0x14]
add esi, 0xffff0000
mov eax, esi
and eax, 0xffff
je 0x1008bd4c
sub esi, eax
cmp esi, dword [esp + 0x30]
ja 0x1008bcd5
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x1008bd60
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
cmp esi, 0x7ff80000
push edi
lea ebx, [esi - 0x7ff80000]
ja 0x1008bd79
mov ebx, 0x10000
cmp esi, 0x80000000
lea ebp, [esi + 0x7ff80000]
jb 0x1008bd8c
mov ebp, 0xfff80000
mov eax, dword [0x101c83ec]
test eax, eax
mov edx, dword [0x101c83e8]
jne 0x1008bda6
test edx, edx
je 0x1008bdb9
mov eax, edx
mov dword [0x101c83ec], eax
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x1008bdb9
cmp ecx, ebx
jb 0x1008bdb9
cmp ecx, ebp
jbe 0x1008bea5
test edx, edx
mov eax, edx
mov dword [0x101c83ec], eax
je 0x1008bde7
test eax, eax
je 0x1008bddb
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x1008bddb
cmp ecx, ebx
jb 0x1008bddb
cmp ecx, ebp
jbe 0x1008bea0
mov eax, dword [eax + 4]
test eax, eax
jne 0x1008bdc8
mov dword [0x101c83ec], eax
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, 0x40000000
jbe 0x1008be22
lea edi, [esi - 0x40000000]
push esi
mov eax, edi
call fcn.1008bbd0
add esp, 4
test eax, eax
jne 0x1008be66
push ebx
mov eax, edi
call fcn.1008bca0
add esp, 4
test eax, eax
jne 0x1008be66
cmp esi, 0x40000000
jae 0x1008be48
lea edi, [esi + 0x40000000]
push esi
mov eax, edi
call fcn.1008bca0
add esp, 4
test eax, eax
jne 0x1008be66
push ebp
mov eax, edi
call fcn.1008bbd0
add esp, 4
test eax, eax
jne 0x1008be66
push ebx
mov eax, esi
call fcn.1008bca0
add esp, 4
test eax, eax
jne 0x1008be66
push ebp
mov eax, esi
call fcn.1008bbd0
add esp, 4
test eax, eax
je 0x1008becb
xor edx, edx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov ecx, dword [0x101c83e8]
mov dword [eax + 4], ecx
mov dword [0x101c83ec], eax
mov dword [0x101c83e8], eax
lea ecx, [eax + 0xffa8]
mov esi, 0x38b
nop
mov dword [ecx + 0x40], edx
mov edx, ecx
sub ecx, 0x48
dec esi
jne 0x1008be90
mov dword [eax + 8], edx
jmp 0x1008bea5
mov dword [0x101c83ec], eax
mov edx, dword [eax + 8]
cmp edx, ebx
jb 0x1008becb
cmp edx, ebp
ja 0x1008becb
mov ecx, dword [edx + 0x40]
mov dword [eax + 8], ecx
mov eax, 0xcccccccc
mov ecx, 0x12
mov edi, edx
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
mov eax, edx
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x1008bf00
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov eax, dword [0x101c83e8]
test eax, eax
push ebx
mov ebx, 0x101c83e8
je 0x1008bf6b
push esi
push edi
cmp dword [eax], 0x52727464
jne 0x1008bf60
lea edi, [eax + 0x10000]
xor esi, esi
lea edx, [eax + 0x88]
mov ecx, dword [edx]
test ecx, ecx
je 0x1008bf35
cmp ecx, eax
jb 0x1008bf60
cmp ecx, edi
jae 0x1008bf60
inc esi
add edx, 0x48
cmp esi, 0x38d
jb 0x1008bf27
mov ecx, dword [eax + 4]
push 0x8000
push 0
push eax
mov dword [ebx], ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x101c83ec], 0
jmp 0x1008bf63
lea ebx, [eax + 4]
mov eax, dword [ebx]
test eax, eax
jne 0x1008bf11
pop edi
pop esi
pop ebx
ret