joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb176bc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x504047
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x58e2fc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0x520c2c
mov dword [esi], 0x520cb8
mov dword [esi + 8], 0x520c74
mov dword [esi + 0xc], 0x520bcc
mov dword [esi + 0x30], ebx
mov eax, 0xf
mov dword [esi + 0x34], eax
mov byte [esi + 0x20], bl
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ebx
mov byte [esi + 0x58], bl
xor eax, eax
xor ecx, ecx
xor edx, edx
mov byte [esi + 0x10], bl
mov word [esi + 0x12], ax
mov word [esi + 0x14], cx
mov word [esi + 0x16], dx
mov byte [esi + 0x18], 1
mov word [esi + 0x70], ax
mov word [esi + 0x72], cx
mov byte [esi + 0x74], bl
mov byte [esi + 0x75], bl
mov byte [esi + 0x76], bl
mov byte [esi + 0x77], bl
mov dword [esi + 0x98], ebx
lea ecx, [esi + 0xa0]
mov byte [esp + 0x18], 3
call fcn.00b1750c
mov ecx, dword [esi + 0x98]
mov byte [esp + 0x18], 4
cmp ecx, ebx
je 0xb17788
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov dword [esi + 0x98], ebx
mov ecx, dword [esp + 0x20]
cmp ecx, ebx
je 0xb1779a
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x98], ecx
xor edx, edx
mov byte [esi + 0x94], bl
mov word [esi + 0x96], dx
mov byte [esi + 0x9c], bl
mov byte [esi + 0x9d], bl
mov dword [esp + 0x18], 0xffffffff
cmp ecx, ebx
je 0xb177ce
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0xb504bc
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50a6ae
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x58e2fc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 8]
mov dword [esi], 0x528424
mov dword [ecx], 0x5283bc
mov dword [esp + 0x14], 2
call fcn.00b5045c
mov ecx, dword [esi + 0x30]
mov byte [esp + 0x14], 1
test ecx, ecx
je 0xb50513
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov ecx, dword [esi + 0x10]
mov byte [esp + 0x14], 0
test ecx, ecx
je 0xb50526
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov dword [esi], 0x510354
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0xb7012c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, 1
lea ecx, [eax + 1]
push esi
lea ecx, [ecx]
mov esi, eax
imul esi, edx
not esi
and esi, ecx
add ecx, ecx
xor eax, esi
test ecx, ecx
jne 0xb7013c
pop esi
ret
Function at 0xbb4433
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.00bdbdec
mov eax, dword [0x58e2fc]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
je 0xbb4596
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
movzx ecx, byte [esi + 2]
movzx edx, byte [esi + 3]
shl eax, 8
or ebx, eax
movzx eax, byte [esi + 4]
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 5]
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 6]
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 7]
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 8
mov byte [edi], dl
mov byte [ebp], al
call fcn.00bc23bc
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.00bc243c
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00bc08fc
push ebp
call fcn.00bc23bc
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.00bc243c
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.00bc08fc
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ebx
shr edx, 0x10
mov byte [eax + 2], dl
mov edx, dword [esp + 0x44]
shr ebx, 0x18
mov byte [eax + 3], bl
mov ebx, edx
add esp, 0x30
mov byte [eax + 4], dl
shr ebx, 8
mov byte [eax + 5], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax + 6], bl
mov byte [eax + 7], dl
mov eax, ebp
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x10]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 0x18
dec dword [esp + 0x18]
mov byte [eax + 6], dl
mov byte [eax + 7], cl
jne 0xbb444f
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.00bd9175
add esp, 0xa0
ret
Function at 0xbc52ec
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0xbc5305
mov esi, edi
mov edi, eax
jmp 0xbc5307
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0xbc5317
mov eax, ebx
jmp 0xbc5321
push eax
push ebx
call fcn.00b8380c
add esp, 8
test eax, eax
jne 0xbc5329
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0xbc5345
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0xbc5330
cmp eax, dword [esi + 4]
jge 0xbc535c
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0xbc534c
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0xbc537d
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0xbc537a
dec eax
test eax, eax
jg 0xbc536c
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x10001000
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100160c0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1001d24c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
push 4
push 0x3000
xor ebx, ebx
push 0x104
push ebx
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov dword [ebp - 0x24], esi
cmp esi, ebx
jne 0x10001068
push 0x1001b2f0
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], str.VirtualAllocEx_failed_
call fcn.10009825
push ebx
push 0x104
push 0x1001e170
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10001094
push 0x1001b2f0
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], str.WriteProcessMemory_failed_
call fcn.10009825
mov edx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
push ebx
push esi
push edx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
jne 0x100010d9
push 0x1001b2f0
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], str.CreateRemoteThread_failed_
call fcn.10009825
mov ecx, dword [ebp - 0x28]
push ecx
push str._MuterHook__InjectIntoProcessByForce_failed___s_n
call fcn.10004eb0
add esp, 8
mov eax, 0x100010f2
ret
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100010f8
test esi, esi
je 0x1000110b
push 0x8000
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100015e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100015fb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001632
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x1000162e
jmp 0x10001620
cmp esi, eax
jae 0x10001632
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10001620
cmp esi, eax
jb 0x10001639
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x10001796
push 0x80004005
call fcn.100015c0
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push edi
push esi
lea eax, [ebp + 0x10]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
mov dword [ebp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x100017fb
mov ecx, dword [edi]
test ecx, ecx
je 0x100017f6
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1000181e
cmp edx, 2
jbe 0x10001801
cmp edx, 7
jne 0x1000181e
test cl, 1
jne 0x100017f1
shr ecx, 1
cmp ecx, 1
jb 0x100017f1
cmp word [esi + ecx*2 - 2], 0
jne 0x100017f1
cmp ecx, 1
jbe 0x100017fb
cmp word [esi + ecx*2 - 4], 0
je 0x100017fb
mov eax, 0xd
xor ecx, ecx
mov word [esi], cx
pop edi
pop esi
pop ebp
ret 0xc
test cl, 1
jne 0x10001810
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x100017fb
xor edx, edx
pop edi
mov word [esi], dx
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc

Function at 0x100019c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push 0
push 0x42b
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x100019e1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ebp
ret
Function at 0x10004430
Capabilities:
Check if file exists
Create process on windows
Create thread
Enumerate gui resources
Read .ini file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.mydll.dll_verifyid

Function at 0x10004540
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x100057e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1001e3c8]
mov dword [ebp - 4], eax
jmp 0x100057f9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10005816
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100057f0
mov esp, ebp
pop ebp
ret

Function at 0x10005820
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1001e3d8], eax
je 0x1000583e
mov eax, 0x10dd
jmp 0x1000591f
mov eax, dword [0x1001e3e8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100058bc
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000589a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1000589a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10005990
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.100093d6
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x10005846
mov dword [0x1001e3e8], 0
call fcn.10005930
mov ecx, dword [0x1001e3e4]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x10005909
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.100093d6
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x100058d4
mov dword [0x1001e3e4], 0
mov dword [0x1001e3d8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10005e90
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10005ea5
xor eax, eax
jmp 0x10005f1a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x10005ed2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x10005f15
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x10005f13
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x10005f0f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x10005f13
xor eax, eax
jmp 0x10005f1a
jmp 0x10005ec9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10005fc0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1001e3dc], 0
je 0x10005fd9
mov eax, dword [0x1001e3dc]
jmp 0x10006079
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10005feb
xor eax, eax
jmp 0x10006079
push 8
call fcn.1000a8d4
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10006041
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x1000602a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100093d6
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x1001e3dc], eax
mov dword [0x1001e3e0], 0
mov eax, dword [ebp - 4]
jmp 0x10006079
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1000605b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x1000600b
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x1001e3e4]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x1001e3e4], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10006890
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10006960
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000694c
cmp dword [ebp - 4], 0x50000000
jb 0x100068cc
cmp dword [ebp - 4], 0x80000000
ja 0x100068cc
mov dword [ebp - 4], 0x80010000
jmp 0x100068a5
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.10009880
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100068f2
jmp 0x1000694c
cmp dword [ebp - 0x10], 0x10000
jne 0x10006935
cmp dword [ebp - 0x14], 0x10000
jb 0x10006935
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10006928
mov eax, dword [ebp - 0x24]
jmp 0x1000694e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10006947
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10006960
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100068a5
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10006990
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10006a60
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10006a54
cmp dword [ebp - 4], 0x50000000
jb 0x100069d1
cmp dword [ebp - 4], 0x80000000
ja 0x100069d1
mov dword [ebp - 4], 0x4fff0000
jmp 0x100069aa
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.10009880
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100069f7
jmp 0x10006a54
cmp dword [ebp - 0x10], 0x10000
jne 0x10006a3a
cmp dword [ebp - 0x14], 0x10000
jb 0x10006a3a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10006a2d
mov eax, dword [ebp - 0x24]
jmp 0x10006a56
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10006a4f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10006a60
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100069aa
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10006a90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1001e3d8], eax
je 0x10006ab5
mov eax, 0x10dd
jmp 0x10006c4d
cmp dword [0x1001e3dc], 0
je 0x10006ac8
mov eax, dword [0x1001e3dc]
jmp 0x10006c4d
cmp dword [ebp + 8], 0
jne 0x10006ad8
mov eax, 6
jmp 0x10006c4d
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10006b01
mov dword [ebp - 0xc], 6
mov ecx, dword [ebp - 0xc]
mov dword [0x1001e3dc], ecx
mov edx, dword [ebp + 8]
mov dword [0x1001e3e0], edx
mov eax, dword [ebp - 0xc]
jmp 0x10006c4d
push 0x18
call fcn.1000a8d4
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x10006b5a
mov dword [ebp - 0xc], 8
mov ecx, dword [ebp - 0xc]
mov dword [0x1001e3dc], ecx
cmp dword [ebp - 0x18], 0
je 0x10006b49
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.100093d6
add esp, 4
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [0x1001e3e0], ecx
mov eax, dword [ebp - 0xc]
jmp 0x10006c4d
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10005570
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10005570
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 8], 0
je 0x10006b9a
cmp dword [ebp - 8], 0x1e
jbe 0x10006bb6
mov dword [ebp - 0xc], 9
cmp dword [0x1001e3d0], 0
je 0x10006bb1
jmp 0x10006b2a
jmp 0x10006b21
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x10006bdd
mov dword [ebp - 0xc], 9
cmp dword [0x1001e3d0], 0
je 0x10006bd8
jmp 0x10006b2a
jmp 0x10006b21
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0x40
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10006c0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
jmp 0x10006b21
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [0x1001e3e8]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [0x1001e3e8], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10007030
Capabilities:
Encrypt data using rc4 prga
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1001b420
push 0x1000abe0
mov eax, dword fs:[0]
push eax
add esp, 0xffffff8c
mov eax, dword [0x1001d24c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x3c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
cmp dword [ebp + 0xc], 0
jne 0x10007075
mov dword [ebp - 0x1c], 0x10000
jmp 0x10007080
mov eax, dword [ebp + 0xc]
add eax, 0x10000
mov dword [ebp - 0x1c], eax
push 0x1c
push 0
lea ecx, [ebp - 0x38]
push ecx
call fcn.10009880
add esp, 0xc
jmp 0x1000709b
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], edx
push 0x1c
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
ja 0x100070b8
jmp 0x100071c3
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x1c]
jae 0x100070c8
jmp 0x100071c3
cmp dword [ebp - 0x28], 0x1000
jne 0x100070ea
mov ecx, dword [ebp - 0x24]
and ecx, 0xff
cmp ecx, 1
je 0x100070ea
mov edx, dword [ebp - 0x24]
and edx, 0x100
je 0x100070ec
jmp 0x10007092
mov dword [ebp - 4], 0
push 0
push 0x40
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x10007119
mov dword [ebp - 4], 0xfffffffe
jmp 0x10007092
movzx eax, word [ebp - 0x80]
cmp eax, 0x5a4d
jne 0x10007132
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x2c]
ja 0x10007132
cmp dword [ebp - 0x44], 0x40
jae 0x1000713e
mov dword [ebp - 4], 0xfffffffe
jmp 0x10007092
push 0
push 0xf8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x44]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1000716a
mov dword [ebp - 4], 0xfffffffe
jmp 0x10007092
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0x4550
je 0x10007181
mov dword [ebp - 4], 0xfffffffe
jmp 0x10007092
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x84], eax
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x84]
jmp 0x100071c5
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x3c]
xor ecx, ebp
call fcn.10009816
mov esp, ebp
pop ebp
ret 0xc