joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf039372
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
cmp byte [ebp + 0xc], bl
lea esi, [eax + eax*4]
lea esi, [esi*8 + 0xf09c4a0]
jne 0xf039393
mov byte [esi + 0x25], bl
jmp 0xf03939c
cmp byte [esi + 0x25], bl
jne 0xf039440
cmp byte [ebp + 0xc], bl
push ebx
sete cl
dec cl
and cl, 0x4c
add cl, 0x40
add cl, al
mov dword [esi + 0x10], ebx
push ecx
call fcn.0f010e25
push 0x400
mov dword [ebp - 4], eax
call fcn.0f0070c9
cmp eax, ebx
pop ecx
mov dword [esi + 0x20], eax
je 0xf039440
mov al, byte [ebp + 0xc]
neg al
push ebx
push 0x80
push 3
push ebx
mov dword [esi + 0x14], 0x3fc
mov byte [esi + 0x24], bl
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
push eax
push 0x40000000
push dword [ebp - 4]
mov byte [esi + 0x1c], bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0xf039423
push dword [esi + 0x20]
call fcn.0f0058e2
cmp byte [ebp + 0xc], bl
pop ecx
je 0xf039440
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0xf039440
mov byte [esi + 0x25], 1
jmp 0xf039440
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp byte [ebp + 0xc], bl
mov dword [esi + 0x18], eax
je 0xf039445
cmp eax, 2
je 0xf039445
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ax, ax
jmp 0xf039484
mov eax, dword [0xf09c518]
mov ecx, dword [ebp + 8]
push ebx
add eax, ecx
push eax
mov byte [esi + 0x1c], 1
call fcn.0f00f717
mov al, byte [ebp + 0xc]
cmp al, bl
mov byte [esi + 0x24], al
je 0xf039478
push 1
push dword [esi + 4]
mov dword [esi + 0x14], 0x3fc
push dword [ebp + 8]
call fcn.0f0440d9
push dword [ebp + 8]
call fcn.0f039323
mov ax, 1
pop esi
pop ebx
leave
ret 8

Function at 0xf0394b1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
lea esi, [eax + eax*4]
xor ebx, ebx
lea esi, [esi*8 + 0xf09c4a0]
cmp byte [esi + 0x24], bl
lea eax, [ebp + 8]
push ebx
push eax
je 0xf0394ef
push ebx
push ebx
push dword [esi + 0x10]
push dword [esi + 0x20]
push 0x2c0004
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor eax, eax
inc eax
mov dword [esi + 0x10], ebx
jmp 0xf039516
push dword [esi + 0x10]
push dword [esi + 0x20]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xf0394ea
cmp dword [esi + 0x18], 3
mov dword [esi + 0x10], ebx
jne 0xf039513
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 4
Function at 0xf03a0bf
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
movzx esi, byte [ebp + 8]
push edi
imul esi, esi, 0x12c
push dword [0xf09c48c]
mov ebx, 0x200
push ebx
xor edi, edi
push edi
push dword [ebp + 8]
add esi, 0xf09c120
call fcn.0f039f7e
cmp eax, ebx
je 0xf03a112
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xf002488
mov dword [0xf071808], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x64
pop eax
mov word [esi + 0x12], ax
jmp 0xf03a162
mov eax, dword [0xf09c48c]
mov cl, byte [eax]
cmp cl, 0x69
je 0xf03a12e
cmp cl, 0xe9
je 0xf03a12e
cmp cl, 0xeb
jne 0xf03a148
cmp byte [eax + 2], 0x90
jne 0xf03a148
mov cl, byte [eax + 0x15]
and cl, 0xf0
cmp cl, 0xf0
jne 0xf03a148
movzx edi, byte [eax + 0x14]
movzx eax, byte [eax + 0x13]
shl edi, 8
add edi, eax
jmp 0xf03a196
cmp dword [0xf0651a8], 0
mov dword [ebp - 4], 0xf0651a8
jne 0xf03a16e
mov word [esi + 0x12], 0x64
mov ax, word [esi + 0x12]
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [0xf09c48c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push ebx
shl eax, 9
push eax
push dword [ebp + 8]
call fcn.0f039f7e
cmp eax, ebx
jne 0xf03a196
mov eax, dword [ebp - 4]
mov edi, dword [eax]
add eax, 4
inc edi
cmp dword [eax], 0
mov dword [ebp - 4], eax
jne 0xf03a169
test edi, edi
je 0xf03a158
cmp edi, 0x2d0
je 0xf03a1d2
cmp edi, 0x5a0
je 0xf03a1d2
cmp edi, 0x960
je 0xf03a1c2
cmp edi, 0xb40
je 0xf03a1c2
cmp edi, 0x1680
je 0xf03a1ca
mov word [esi + 0x12], 1
jmp 0xf03a15e
mov word [esi + 0x12], 2
jmp 0xf03a15e
and word [esi + 0x12], 0
jmp 0xf03a15e
Function at 0xf03a969
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
je 0xf03a9b3
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
lea ecx, [eax + 4]
push ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0xf03a9b3
mov ebx, 0x9000
cmp dword [ebp + 0x10], ebx
ja 0xf03a99f
mov ebx, dword [ebp + 0x10]
cmp dword [0xf09c118], esi
je 0xf03a9bb
call fcn.0f03a897
cmp eax, esi
mov dword [ebp + 0xc], eax
jne 0xf03a9c1
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], esi
mov dword [ebp - 4], esi
je 0xf03aa21
push edi
cmp dword [ebp + 0x10], ebx
jae 0xf03a9d2
mov ebx, dword [ebp + 0x10]
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xf03aa20
cmp dword [ebp - 8], ebx
jne 0xf03aa20
cmp dword [0xf09c118], esi
je 0xf03aa12
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
add dword [ebp + 0x14], ebx
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
jmp 0xf03aa15
add dword [ebp + 0xc], ebx
sub dword [ebp + 0x10], ebx
add dword [ebp - 4], ebx
cmp dword [ebp + 0x10], esi
jne 0xf03a9ca
pop edi
mov eax, dword [ebp - 4]
jmp 0xf03a9b5

Function at 0xf03aa2b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
je 0xf03aae5
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
lea ecx, [eax + 4]
push ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0xf03aae5
mov ebx, 0x9000
cmp dword [ebp + 0x10], ebx
ja 0xf03aa69
mov ebx, dword [ebp + 0x10]
cmp dword [0xf09c118], esi
je 0xf03aa7d
call fcn.0f03a897
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0xf03aae5
cmp dword [ebp + 0x10], esi
mov dword [ebp - 4], esi
je 0xf03aae0
push edi
cmp dword [ebp + 0x10], ebx
jae 0xf03aa8e
mov ebx, dword [ebp + 0x10]
cmp dword [0xf09c118], esi
je 0xf03aab0
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
jmp 0xf03aab6
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xf03aadf
cmp dword [ebp - 8], ebx
jne 0xf03aadf
sub dword [ebp + 0x10], ebx
add dword [ebp + 0x14], ebx
add dword [ebp - 4], ebx
cmp dword [ebp + 0x10], esi
jne 0xf03aa86
pop edi
mov eax, dword [ebp - 4]
jmp 0xf03aae7
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0xf03b78c
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
push 0xffffffffffffffff
call fcn.0f009877
test eax, eax
jne 0xf03b8bb
push edi
push 0x3c
call fcn.0f0313c9
test eax, eax
jne 0xf03b7c7
push 0x3e
call fcn.0f0313c9
test eax, eax
je 0xf03b822
mov edi, 0xf0651f0
push edi
call fcn.0f03ad6f
call fcn.0f009865
push 0x64
call esi
push 0xffffffffffffffff
call fcn.0f009877
test eax, eax
jne 0xf03b81a
push edi
call fcn.0f03ad4b
call fcn.0f009865
push 0x64
call esi
push 0xffffffffffffffff
call fcn.0f009877
test eax, eax
jne 0xf03b81a
push edi
call fcn.0f03ad6f
call fcn.0f009865
push 0x14
call esi
push 0xffffffffffffffff
call fcn.0f009877
test eax, eax
je 0xf03b822
push 1
call dword [sym.imp.KERNEL32.dll_ExitThread]
call fcn.0f03259a
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
call esi
test al, 1
je 0xf03b83c
mov dword [ebp - 4], 0x80
push 0x90
call esi
test al, 1
mov edi, dword [ebp - 4]
je 0xf03b84d
or edi, 0x20
push 0x91
call esi
test al, 1
je 0xf03b85b
or edi, 0x40
mov eax, dword [0xf065220]
xor eax, edi
test al, al
jns 0xf03b877
mov esi, 0xf0651d0
push esi
call fcn.0f03ad4b
push esi
call fcn.0f03ad6f
mov eax, dword [0xf065220]
xor eax, edi
test al, 0x20
je 0xf03b893
mov esi, 0xf065200
push esi
call fcn.0f03ad4b
push esi
call fcn.0f03ad6f
mov eax, dword [0xf065220]
xor eax, edi
test al, 0x40
je 0xf03b8af
mov esi, 0xf065210
push esi
call fcn.0f03ad4b
push esi
call fcn.0f03ad6f
mov dword [0xf065220], edi
call fcn.0f009865
pop edi
pop esi
leave
ret

Function at 0xf03bb39
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push esi
xor esi, esi
cmp dword [0xf06cb24], esi
je 0xf03bb4c
pop esi
jmp fcn.0f034e04
cmp dword [0xf065224], 1
jne 0xf03bbb5
cmp dword [0xf064a70], esi
je 0xf03bbb5
cmp dword [0xf071748], esi
jne 0xf03bbb5
push 0xf09c60c
push dword [0xf09c560]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0xf03bb95
push 0x7b4
push 0xf00253c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3e9
call fcn.0f034a13
call fcn.0f01fc63
movzx eax, word [0xf06b9c4]
movzx ecx, word [0xf06b9d0]
shl eax, 4
push 2
add eax, ecx
push eax
call fcn.0f00f717
call fcn.0f00999c
and byte [0xf071972], 0xfd
call fcn.0f015061
call fcn.0f035cf1
push esi
push dword [0xf09c6e4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.0f032737
call fcn.0f03320f
cmp dword [0xf09c590], 2
je 0xf03bbfb
call fcn.0f036716
push dword [0xf09c5fc]
call fcn.0f0098f9
call sym.ntvdm.exe_ResumeTimerThread
cmp dword [0xf06cb24], esi
jne 0xf03bc0d
call fcn.0f03b0f0
call fcn.0f016531
push dword [0xf09c104]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
ret
Function at 0xf03ccc9
Capabilities:
Resume thread
Suspend thread

Disassembly:
push 0xc
push 0xf002648
call fcn.0f01bb00
and dword [ebp - 0x1c], 0
xor edi, edi
inc edi
mov dword [0xf0719a4], edi
and dword [ebp - 4], 0
call fcn.0f0041b6
push dword [0xf09c6e0]
mov esi, dword [sym.imp.KERNEL32.dll_SuspendThread]
call esi
or ebx, 0xffffffff
cmp eax, ebx
je 0xf03cd6f
cmp dword [0xf06cb24], 0
jne 0xf03cd15
push dword [0xf09c8b0]
call esi
cmp eax, ebx
je 0xf03cd6f
mov dword [0xf09bf48], edi
cmp dword [0xf09c590], edi
jne 0xf03cd2a
call fcn.0f03cc56
jmp 0xf03cd37
push dword [0xf0716c8]
push 0
call fcn.0f03c641
and dword [0xf09bf48], 0
cmp dword [0xf06cb24], 0
jne 0xf03cd57
push dword [0xf09c8b0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, ebx
je 0xf03cd6f
push dword [0xf09c6e0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, ebx
je 0xf03cd6f
call fcn.0f0041a5
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], ebx
jmp 0xf03cd7f
xor esi, esi
cmp dword [ebp - 0x1c], esi
jne 0xf03cdbb
cmp dword [0xf0719a4], esi
je 0xf03cda0
push dword [0xf09bf40]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [0xf0719a4], esi
push 0x215
push 0xf002604
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3e9
call fcn.0f034a13
mov dword [0xf0719a4], esi
call fcn.0f01bb3b
ret
Function at 0xf03cdcc
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [0xf09bf38]
test esi, esi
mov dword [ebp + 0xc], ecx
je 0xf03ce05
mov dx, word [ebp + 8]
cmp word [esi + 8], dx
jne 0xf03cdfa
cmp ecx, dword [esi]
jne 0xf03cdfa
mov eax, dword [ebp + 0x10]
cmp eax, dword [esi + 4]
je 0xf03ce01
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf03cde8
test esi, esi
jne 0xf03ce17
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03cef6
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
add ecx, 0xfff40000
mov dword [ebp - 8], ecx
movzx ecx, dx
sub ecx, 0xfffa
push ebx
mov dword [ebp + 8], eax
je 0xf03ce6d
dec ecx
dec ecx
je 0xf03ce4c
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03cef5
push 0x40
push 0x1000
lea eax, [ebp + 8]
push eax
push 0
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jge 0xf03cee2
push 0xe
jmp 0xf03ce3f
shr eax, 0xc
mov ebx, eax
mov dword [ebp + 8], 0x1000
jmp 0xf03ce97
push dword [ebp + 0xc]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jl 0xf03cedb
add ebx, 0xffff
add dword [ebp + 0xc], 0x1000
test bx, bx
ja 0xf03ce7b
mov eax, dword [esi]
push 0x40
push 0x40000000
push 2
sub eax, 0xc0000
mov dword [ebp - 8], eax
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 4]
lea ecx, [ebp - 8]
push ecx
push eax
push 0
mov dword [ebp + 8], eax
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [0xf09bf34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jge 0xf03cee2
push 5
jmp 0xf03ce3f
push dword [esi + 4]
mov word [esi + 8], 0xfffd
push dword [esi]
call fcn.0f04ff91
xor eax, eax
inc eax
pop ebx
pop esi
leave
ret 0xc
Function at 0xf03cf00
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [0xf09bf38]
test edi, edi
mov dword [ebp + 8], edx
je 0xf03cf43
mov eax, dword [ebp + 0xc]
cmp word [edi + 8], 0xfffa
jne 0xf03cf38
mov ecx, dword [edi]
mov ebx, dword [edi + 4]
lea esi, [edx + eax]
add ebx, ecx
cmp ebx, esi
jb 0xf03cf38
cmp ecx, esi
jbe 0xf03cf3f
mov edi, dword [edi + 0x10]
test edi, edi
jne 0xf03cf1e
test edi, edi
jne 0xf03cf4d
push 0x1e7
jmp 0xf03cffb
mov ecx, edx
sub ecx, dword [edi]
and dword [ebp - 8], 0
xor ebx, ebx
shr ecx, 0xc
inc ebx
shr eax, 0xc
add edx, 0xfff40000
shl ebx, cl
test ax, ax
mov esi, 0x1000
mov dword [ebp - 4], esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], edx
jbe 0xf03cfeb
test dword [edi + 0xc], ebx
jne 0xf03cf9c
push 0x40
push esi
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jl 0xf03cff9
or dword [edi + 0xc], ebx
jmp 0xf03cfd5
push dword [ebp + 8]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jl 0xf03cff5
push 0x40
push 0x40000000
push 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push dword [0xf09bf34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0xf03cff9
add dword [ebp + 0xc], 0xffff
add dword [ebp - 0xc], esi
add dword [ebp + 8], esi
shl ebx, 1
cmp word [ebp + 0xc], 0
ja 0xf03cf79
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
push 5
jmp 0xf03cffb
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03cfee
Function at 0xf03d00a
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0xf09bf38]
test esi, esi
push edi
mov dword [ebp + 8], eax
je 0xf03d04d
mov ecx, dword [ebp + 0xc]
cmp word [esi + 8], 0xfffa
jne 0xf03d042
mov edx, dword [esi]
mov ebx, dword [esi + 4]
lea edi, [eax + ecx]
add ebx, edx
cmp ebx, edi
jb 0xf03d042
cmp edx, edi
jbe 0xf03d049
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf03d028
test esi, esi
jne 0xf03d057
push 0x1e7
jmp 0xf03d0dd
shr ecx, 0xc
mov dword [ebp + 0xc], ecx
mov ebx, 0x1000
mov ecx, eax
mov dword [ebp - 4], ebx
sub ecx, dword [esi]
and dword [ebp - 8], 0
xor edi, edi
shr ecx, 0xc
inc edi
shl edi, cl
sub eax, dword [esi]
mov dword [ebp - 0xc], eax
jmp 0xf03d0ca
test dword [esi + 0xc], edi
je 0xf03d0bb
push dword [ebp + 8]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jl 0xf03d0db
push 0x40
push 0x40000000
push 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push dword [0xf09bf34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0xf03d0db
add dword [ebp - 0xc], ebx
add dword [ebp + 8], ebx
add dword [ebp + 0xc], 0xffff
shl edi, 1
cmp word [ebp + 0xc], 0
ja 0xf03d07c
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03d0d4
Function at 0xf03d12a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
sub ebx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ebx
sub eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
je 0xf03d186
push 0x14
call fcn.0f0070c9
mov edi, eax
test edi, edi
pop ecx
jne 0xf03d162
push 0xe
jmp 0xf03d266
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov dword [edi + 4], eax
mov ecx, dword [ebp + 0xc]
or word [edi + 8], 0xffff
add ecx, edx
mov dword [edi], ecx
mov ecx, dword [esi + 0x10]
mov dword [edi + 0x10], ecx
sub dword [esi + 4], eax
mov dword [esi + 0x10], edi
jmp 0xf03d189
mov edi, dword [ebp + 0x14]
test ebx, ebx
jbe 0xf03d1c3
push 0x14
call fcn.0f0070c9
test eax, eax
pop ecx
mov dword [ebp - 8], eax
je 0xf03d15b
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov cx, word [ebp + 0x14]
mov word [eax + 8], cx
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x10], ecx
or word [esi + 8], 0xffff
mov dword [esi + 0x10], eax
mov dword [esi + 4], ebx
jmp 0xf03d1cb
mov ax, word [ebp + 0x14]
mov word [esi + 8], ax
push dword [esi]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jl 0xf03d264
xor ecx, ecx
cmp ebx, ecx
mov ebx, dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov dword [ebp - 0xc], ecx
jbe 0xf03d227
mov eax, dword [esi + 4]
mov esi, dword [esi]
push 0x40
push 0x40000000
push 2
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ecx
push ecx
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [0xf09bf34]
mov dword [ebp + 0xc], esi
add esi, 0xfff40000
mov dword [ebp - 0x10], esi
call ebx
test eax, eax
jl 0xf03d264
xor ecx, ecx
cmp dword [ebp - 4], ecx
jbe 0xf03d270
mov eax, dword [edi]
push 0x40
mov dword [ebp + 0xc], eax
add eax, 0xfff40000
push 0x40000000
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
push 2
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ecx
push ecx
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [0xf09bf34]
call ebx
test eax, eax
jge 0xf03d270
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03d273
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0xf03d27f
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
test eax, eax
push esi
push edi
je 0xf03d2ba
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
cmp word [eax + 8], 0xffff
jne 0xf03d2af
mov ecx, dword [eax]
cmp ecx, edx
ja 0xf03d2af
mov edi, dword [eax + 4]
add edi, ecx
lea ecx, [edx + esi]
cmp edi, ecx
jae 0xf03d2b6
mov eax, dword [eax + 0x10]
test eax, eax
jne 0xf03d295
test eax, eax
jne 0xf03d2c9
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03d337
push 0xfffa
push esi
push edx
push eax
call fcn.0f03d12a
test eax, eax
je 0xf03d2c5
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
shr esi, 0xc
mov edi, esi
mov esi, 0x1000
add eax, 0xfff40000
mov dword [ebp + 0x10], esi
mov dword [ebp - 8], eax
jmp 0xf03d32f
push 0x40
push 0x40000000
push 2
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push dword [0xf09bf34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0xf03d2c5
add dword [ebp + 8], esi
add edi, 0xffff
add dword [ebp - 8], esi
test di, di
ja 0xf03d2f8
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0xc

Function at 0xf03df27
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0xf062038]
push esi
push edi
mov esi, 0xf0029fc
lea edi, [ebp - 0x130]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
push 0x49
pop ecx
xor eax, eax
lea edi, [ebp - 0x12a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0xf03dfd3
inc dword [0xf0719d8]
js 0xf03dfd3
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x230]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf03df87
lea edi, [ebp - 0x130]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf03df97
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x130]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0xf03dfb6
mov esi, 0xf001690
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x130]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0f01b9b9
leave
ret

Function at 0xf03e979
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push 0x40
push 0x3000
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
mov dword [ebp - 8], 0xa0000
mov dword [ebp - 4], 0x20000
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jge 0xf03e9c0
push 0xd9
push 0xf002a70
push eax
push 0x3e9
call fcn.0f034a13
leave
ret