joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001500
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10001546
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10001546
movzx ecx, word [eax + 0x18]
push esi
mov esi, 0x10b
cmp cx, si
jne 0x1000152e
lea eax, [eax + edx*8]
add eax, 0x78
pop esi
ret
mov esi, 0x20b
cmp cx, si
jne 0x10001542
lea eax, [eax + edx*8]
add eax, 0x88
pop esi
ret
xor eax, eax
pop esi
ret
xor eax, eax
ret

Function at 0x10001550
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
test esi, esi
jne 0x10001573
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x10001687
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x10001687
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x10001687
movzx ecx, word [eax + 0x18]
mov edx, 0x10b
cmp cx, dx
jne 0x100015a7
add eax, 0x88
jmp 0x100015ba
mov edx, 0x20b
cmp cx, dx
jne 0x10001687
add eax, 0x98
test eax, eax
je 0x10001687
mov ecx, dword [eax]
test ecx, ecx
je 0x10001687
cmp dword [eax + 4], 0
je 0x10001687
movzx edx, word [ecx + esi + 0xe]
movzx eax, word [ecx + esi + 0xc]
push ebx
lea ebx, [ecx + esi]
mov ecx, 0
add edx, eax
je 0x1000167e
test dword [ebx + ecx*8 + 0x10], 0x80000000
jne 0x10001624
cmp word [ebx + ecx*8 + 0x10], 0x10
jne 0x10001624
mov eax, dword [ebx + ecx*8 + 0x14]
test eax, eax
jns 0x10001624
and eax, 0x7fffffff
test dword [eax + ebx + 0x10], 0x80000000
jne 0x10001624
test dword [eax + ebx + 0x14], 0x80000000
jne 0x10001632
inc ecx
cmp ecx, edx
jb 0x100015f1
mov eax, dword [ebp - 4]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [eax + ebx + 0x14]
xor edx, edx
and edi, 0x7fffffff
xor eax, eax
add edi, ebx
cmp ax, word [edi + 0xe]
jae 0x1000167d
lea esp, [esp]
cmp edx, 0x12c
je 0x1000167d
test dword [edi + edx*8 + 0x10], 0x80000000
jne 0x10001674
mov eax, dword [edi + edx*8 + 0x14]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ebx]
add eax, esi
inc dword [ebp - 4]
mov dword [ecx + edx*4], eax
movzx ecx, word [edi + 0xe]
inc edx
cmp edx, ecx
jb 0x10001650
pop edi
mov eax, dword [ebp - 4]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001e40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1ff
lea eax, [ebp - 0x203]
mov byte [ebp - 0x204], 0
push 0
push eax
call fcn.10028990
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x10001eb6
lea ecx, [ebp + 0xc]
push ecx
push eax
lea eax, [ebp - 0x204]
push 0x200
push eax
call fcn.1002604e
add esp, 0x10
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x80000000
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100253d5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x80000080
xor ecx, ebp
call fcn.100253d5
mov esp, ebp
pop ebp
ret
Function at 0x10019130
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push 0x104
push 0x100450b0
push eax
xor bl, bl
mov dword [0x1004448c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x100450b0
call fcn.100264c8
mov edx, 0x10045784
add esp, 8
lea ecx, [eax + 2]
sub edx, ecx
jmp 0x10019170
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x10019170
push 0x5c
push 0x100450b0
call fcn.100264c8
xor ecx, ecx
add esp, 8
mov word [eax + 2], cx
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x100191c5
mov dword [ebp + 8], ecx
lea edx, [ebp + 0xc]
mov dword [ebp + 0xc], ecx
lea ecx, [ebp + 8]
call fcn.1001f7a0
test al, al
je 0x100191be
mov eax, dword [ebp + 8]
mov dword [0x100452b8], eax
mov eax, dword [ebp + 0xc]
jmp 0x100191cd
mov al, bl
pop ebx
pop ebp
ret 0xc
mov dword [0x100452b8], eax
mov eax, dword [ebp + 0x10]
mov dword [0x100452bc], eax
call fcn.1001fe70
push 0x208
push 0
push 0x1004557c
call fcn.10028990
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x1004557c
mov ecx, eax
call fcn.1001f950
push 0x100457ac
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, 0x3ff
and ax, cx
push 0x100452c0
mov word [0x10044484], ax
call fcn.10020140
add esp, 4
neg al
sbb al, al
and byte [0x100452c0], al
mov al, 1
pop ebx
pop ebp
ret 0xc
Function at 0x1001b4a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x1001b5b1
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1001b5b1
push edi
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x1001b5b0
mov edx, dword [edi + 0x28]
add edx, esi
je 0x1001b5b0
mov ecx, esi
call fcn.10001310
add eax, esi
cmp eax, esi
je 0x1001b5b0
cmp dword [edi], 0x4550
je 0x1001b50c
or ecx, 0xffffffff
jmp 0x1001b50f
mov ecx, dword [edi + 0x38]
mov edx, dword [eax + 0xc]
mov edi, dword [eax + 8]
add edx, esi
mov dword [ebp - 0x28], edx
mov eax, edi
xor edx, edx
div ecx
test edx, edx
je 0x1001b528
sub edi, edx
add edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
xorps xmm0, xmm0
mov esi, dword [ebp - 0x28]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
movdqu xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0xc], 0
movq qword [ebp - 0x14], xmm0
lea esp, [esp]
mov eax, dword [ebp - 0x24]
push 0x1c
test eax, eax
jne 0x1001b562
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
jmp 0x1001b569
lea edx, [ebp - 0x24]
add eax, esi
push edx
push eax
call ecx
cmp dword [ebp - 0x18], edi
mov esi, edi
mov eax, dword [ebp - 0x10]
cmovbe esi, dword [ebp - 0x18]
sub eax, 2
je 0x1001b599
sub eax, 2
je 0x1001b591
sub eax, 4
jne 0x1001b5a5
lea eax, [ebp - 8]
push eax
push 0x80
jmp 0x1001b59f
lea eax, [ebp - 8]
push eax
push 0x40
jmp 0x1001b59f
lea eax, [ebp - 8]
push eax
push 0x20
push esi
push dword [ebp - 0x24]
call ebx
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub edi, esi
jne 0x1001b550
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100253d5
mov esp, ebp
pop ebp
ret
Function at 0x1001c8c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0x1000
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x41334754
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], ebx
jne 0x1001c985
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp eax, 1
jne 0x1001c985
lea eax, [ebp - 0x14]
push eax
push 0x1100
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp eax, 1
jne 0x1001c966
push 0
push 0
push 0
push esi
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1001c956
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1001c966
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0
push eax
push esi
xorps xmm0, xmm0
push edi
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100253d5
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1001ca80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
xor al, al
mov ebx, ecx
test edi, edi
je 0x1001cb3e
push esi
push 0x5c
push ebx
call fcn.10026069
mov esi, eax
xor eax, eax
sub esi, ebx
mov word [edi], ax
shr esi, 1
push esi
push str.CSIDL_APPDATA
push ebx
call fcn.10026d27
add esp, 0x14
test eax, eax
jne 0x1001cac8
push eax
push 0x1a
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
jmp 0x1001cb06
push esi
push str.TEMP
push ebx
call fcn.10026d27
add esp, 0xc
test eax, eax
jne 0x1001cb06
push edi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, edi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001caf0
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [edi + ecx*2 - 2], ax
cmp word [edi], 0
je 0x1001cb3b
lea edx, [ebx + esi*2]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1001cb11
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x1001cb21
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, 1
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x1001d180
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4a8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x4a4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
call fcn.1001cb50
mov eax, dword [esi + 0x720]
cmp byte [eax + 0x20d], 1
jne 0x1001d306
mov ax, word [0x1003f630]
movdqu xmm0, xmmword [str.A3DT.exe]
push 0x40
mov word [esp + 0x34], ax
lea eax, [esp + 0x58]
push 0
push eax
movdqu xmmword [esp + 0x2c], xmm0
call fcn.10028990
mov eax, dword [esi + 0x724]
xorps xmm0, xmm0
add esp, 0xc
mov dword [esp + 0x50], 0x44
movdqu xmmword [esp + 0x10], xmm0
cmp byte [eax + 0x69], 1
jne 0x1001d22c
lea eax, [edi + 0x46a]
push eax
push dword [edi + 0x450]
lea eax, [esp + 0x28]
push eax
push esi
lea eax, [esp + 0xa8]
push str.__s_s___d___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
jmp 0x1001d27f
cmp byte [eax + 0x6a], 1
jne 0x1001d25d
lea eax, [edi + 0xa82]
push eax
push dword [edi + 0x450]
lea eax, [esp + 0x28]
push eax
push esi
lea eax, [esp + 0xa8]
push str.__s_s___d___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
jmp 0x1001d27f
push dword [edi + 0x450]
lea eax, [esp + 0x24]
push eax
push esi
lea eax, [esp + 0xa4]
push str.__s_s___d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0xb8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, 1
jne 0x1001d2ea
mov eax, dword [esi + 0x724]
cmp byte [eax + 0x68], 1
jne 0x1001d2c2
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x10]
call esi
pop edi
pop esi
mov ecx, dword [esp + 0x4a4]
xor ecx, esp
call fcn.100253d5
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [esp + 0x4a4]
xor ecx, esp
call fcn.100253d5
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x4c]
push eax
push 0x18
lea eax, [esp + 0x28]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x10044494]
test eax, eax
jne 0x1001d330
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1001d330
mov dword [eax + 0x10], edi
mov ecx, dword [esp + 0x4ac]
pop edi
pop esi
xor ecx, esp
call fcn.100253d5
mov esp, ebp
pop ebp
ret 4
Function at 0x1001d350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x728], 0
je 0x1001d4a4
mov eax, dword [esi + 0x724]
test eax, eax
je 0x1001d3aa
cmp byte [eax + 0x65], 1
jne 0x1001d3aa
mov dword [0x1004502c], 0
push 1
mov byte [esi + 0x728], 0
call fcn.100215c0
mov byte [esi + 0x728], 1
test ebx, ebx
jne 0x1001d3c9
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], edi
push eax
push 1
push ebx
push 0xc0000005
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [esi + 0x724]
cmp byte [eax + 0x67], 1
jne 0x1001d3dd
push edi
mov ecx, esi
call fcn.1001d180
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.10028990
mov eax, dword [esi + 0x720]
add esp, 0xc
mov al, byte [eax + 0x20d]
cmp al, 1
jne 0x1001d428
lea eax, [esi + 0x2c4]
push eax
lea eax, [ebp - 0x210]
push str._sAEFulldump.dmp
push eax
call fcn.1002619b
add esp, 0xc
jmp 0x1001d461
movzx eax, word [edi + 0x10]
push eax
movzx eax, word [edi + 0xe]
push eax
movzx eax, word [edi + 0xc]
push eax
movzx eax, word [edi + 0xa]
push eax
movzx eax, word [edi + 6]
push eax
movzx eax, word [edi + 4]
push eax
lea eax, [esi + 0x2c4]
push eax
lea eax, [ebp - 0x210]
push str._s_04d_02d_02d_02d_02d_02d.dmp
push eax
call fcn.1002619b
add esp, 0x24
cmp word [ebp - 0x210], 0
je 0x1001d496
mov eax, dword [esi + 0x720]
mov edx, 0x802
mov ecx, 0x135
cmp byte [eax + 0x20d], 1
cmove ecx, edx
mov edx, ebx
push ecx
lea ecx, [ebp - 0x210]
call fcn.1001ffb0
add esp, 4
push dword [edi + 0x450]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100253d5
mov esp, ebp
pop ebp
ret 8
Function at 0x1001f850
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edi
lea ecx, [esi + 2]
lea ecx, [ecx]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1001f870
sub esi, ecx
mov ebx, 0
sar esi, 1
je 0x1001f91e
lea eax, [ebp - 0x20a]
mov edx, 2
lea ecx, [ebp - 0x20c]
sub eax, edi
sub ecx, edi
mov dword [ebp - 0x218], eax
sub edx, edi
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], edx
movzx eax, word [edi]
mov word [ecx + edi], ax
cmp eax, 0x5c
je 0x1001f8c4
cmp eax, 0x2f
jne 0x1001f916
lea eax, [edx + edi]
cmp eax, 0x208
jae 0x1001f944
mov eax, dword [ebp - 0x218]
xor ecx, ecx
mov word [eax + edi], cx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001f90a
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1001f90a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1001f931
mov ecx, dword [ebp - 0x214]
mov edx, dword [ebp - 0x210]
inc ebx
add edi, 2
cmp ebx, esi
jb 0x1001f8b3
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100253d5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100253d5
mov esp, ebp
pop ebp
ret
call fcn.10026939
int3

Function at 0x1001fb70
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x424
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x430], 0
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.10028990
add esp, 0xc
xor ebx, ebx
push esi
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001fbcf
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100253d5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 0x428
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x1001fc2a
mov ebx, dword [sym.imp.KERNEL32.dll_Module32NextW]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001fbf6
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x410]
push eax
push edi
call fcn.10026faf
add esp, 0xc
test eax, eax
je 0x1001fc44
lea eax, [ebp - 0x430]
push eax
push esi
call ebx
test eax, eax
jne 0x1001fbf1
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100253d5
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x41c]
jmp 0x1001fc2a
Function at 0x1001fcb0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov dword [ebp - 0x238], edx
mov esi, ecx
mov byte [ebp - 0x231], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001fdd3
push ebx
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1001fd2e
lea esp, [esp]
cmp esi, dword [ebp - 0x228]
je 0x1001fd28
lea eax, [ebp - 0x230]
push eax
push edi
call ebx
test eax, eax
jne 0x1001fd10
jmp 0x1001fd2e
mov esi, dword [ebp - 0x218]
mov dword [ebp - 0x230], 0x22c
jmp 0x1001fd40
lea eax, [ebp - 0x230]
mov byte [ebp - 0x232], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1001fd98
lea esp, [esp]
cmp esi, dword [ebp - 0x228]
je 0x1001fd78
lea eax, [ebp - 0x230]
push eax
push edi
call ebx
test eax, eax
jne 0x1001fd60
jmp 0x1001fd98
lea eax, [ebp - 0x20c]
mov byte [ebp - 0x232], 1
push eax
push dword [ebp - 0x238]
call fcn.10026e41
add esp, 8
test eax, eax
je 0x1001fda9
cmp byte [ebp - 0x232], 0
mov esi, dword [ebp - 0x218]
jne 0x1001fd40
jmp 0x1001fdb0
mov byte [ebp - 0x231], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x231], 1
pop ebx
jne 0x1001fdd3
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100253d5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.100253d5
mov esp, ebp
pop ebp
ret

Function at 0x1001fdf0
Capabilities:
Check if file exists
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push str.GlobalBFURLSM
push 0
push 6
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [esi], eax
test eax, eax
jne 0x1001fe40
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1001fe22
xor eax, eax
pop esi
pop ebp
ret
push str.GlobalBFURLSM
push 0x400
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi], eax
test eax, eax
je 0x1001fe1d
push edi
push 0x400
push 0
push 0
push 6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x1001fe62
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x1001fe70
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.NtAllocateVirtualMemory
push 0x1003ed30
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.NtFreeVirtualMemory
push 0x1003ed30
mov dword [0x1004449c], eax
call edi
push eax
call esi
push str.NtQueryInformationProcess
push 0x1003ed30
mov dword [0x100444a8], eax
call edi
push eax
call esi
push str.NtQueryInformationThread
push 0x1003ed30
mov dword [0x10044494], eax
call edi
push eax
call esi
push str.NtUnmapViewOfSection
push 0x1003ed30
mov dword [0x100444a0], eax
call edi
push eax
call esi
push str.IsWow64Process
push str.kernel32.dll
mov dword [0x100444a4], eax
call edi
push eax
call esi
push str.IsWow64Process2
push str.kernel32.dll
mov dword [0x100444ac], eax
call edi
push eax
call esi
pop edi
mov dword [0x10044498], eax
pop esi
ret

Function at 0x1001ffb0
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ecx
mov edi, edx
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10020044
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
xor ecx, ecx
mov dword [ebp - 0x10], eax
push 0
test edi, edi
mov dword [ebp - 0xc], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 1
cmove eax, ecx
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
cmp eax, 1
jne 0x10020044
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100253d5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100253d5
mov esp, ebp
pop ebp
ret

Function at 0x100205d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 1
add edi, 0xffff0000
lea ebx, [ebx]
push 0x40
push 0x3000
push 0x10000
push edi
call ebx
test eax, eax
jne 0x10020672
inc esi
sub edi, 0x10000
cmp esi, 0x64
jbe 0x100205f0
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x10020625
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x1002061c
mov eax, dword [eax + ecx + 0x50]
mov edx, eax
and edx, 0xffff
je 0x10020646
sub eax, edx
add eax, 0x10000
lea edi, [ecx + 0x10000]
mov esi, 1
add edi, eax
push 0x40
push 0x3000
push 0x10000
push edi
call ebx
test eax, eax
jne 0x10020672
inc esi
add edi, 0x10000
cmp esi, 0x64
jbe 0x10020653
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10021420
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x70]
cmp byte [esi], 0xe9
je 0x10021454
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100253d5
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x10021480
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100253d5
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x78]
mov dword [esi], eax
mov al, byte [edi + 0x7c]
mov byte [esi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
neg eax
pop esi
call fcn.100253d5
mov esp, ebp
pop ebp
ret 4
Function at 0x10024820
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov eax, ecx
xor bh, bh
push esi
xor bl, bl
mov dword [esp + 0xc], eax
push edi
test eax, eax
je 0x10024915
test edx, edx
je 0x10024915
mov esi, dword [ebp + 8]
test esi, esi
je 0x10024915
cmp esi, 2
jb 0x100248c9
mov ecx, 0x5a4d
cmp word [edx], cx
jne 0x100248c9
mov ecx, dword [edx + 0x3c]
add ecx, edx
mov edi, ecx
sub edi, edx
lea eax, [edi + 4]
cmp eax, esi
ja 0x100248c5
cmp dword [ecx], 0x4550
jne 0x100248c5
lea eax, [edi + 0x88]
cmp eax, esi
ja 0x100248c5
movzx eax, word [ecx + 4]
mov edx, 0x14c
cmp ax, dx
je 0x100248a5
mov edx, 0x8664
cmp ax, dx
jne 0x100248c5
cmp dword [ecx + 0x7c], 0
jne 0x100248c3
cmp dword [ecx + 0x78], 0
jne 0x100248c3
cmp dword [ecx + 0x84], 0
jne 0x100248c3
cmp dword [ecx + 0x80], 0
je 0x100248c5
mov bl, 1
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
cmp bl, 1
jne 0x10024901
push 1
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp eax, 1
jne 0x10024901
mov eax, dword [esp + 0x10]
or eax, dword [esp + 0x14]
jne 0x10024901
mov bh, bl
mov al, bh
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100253d5
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100253d5
mov esp, ebp
pop ebp
ret