joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a94b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000a95a
pop dword [ebp - 8]
mov eax, 0xf8e4ddc4
sub eax, 0xe8e4346a
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3ff24
push 0
mov eax, 0x7faff17c
sub eax, 0x6fad0020
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x46c8
xor edi, edi
add edi, eax
mov esi, 0xce2702b2
sub esi, 0xbe2256b2
add esi, dword [ebp - 8]
mov ebx, 0xaf838a19
sub ebx, 0x7a278dec
xor dword [ebp - 4], 0xc14cf764
mov edx, dword [esi]
add dword [ebp - 4], ebx
add edx, ebx
sub dword [ebp - 4], 0x40117a92
mov dword [edi], edx
add dword [ebp - 4], ecx
add edi, 4
add esi, 0x6497233a
sub esi, 0x64972336
loop 0x1000a9b5
add eax, 0x10df3
mov ebx, eax
add eax, 0xa5e3c681
sub eax, 0xa5e3c67c
mov ecx, 0xc02149d5
sub ecx, 0xb02149d5
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x1000cd31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002cd97
call fcn.10017073
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000cdae
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000cdae
call fcn.10005a99
mov esi, eax
jmp 0x1000ce85
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000cdd1
call fcn.10005a99
jmp 0x1000ce78
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000cdc7
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000ce01
mov esi, 0x8007000e
jmp 0x1000ce7a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000a94b
jmp 0x1000ce27
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cdfa
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000cdc7
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.1000a94b
mov esi, eax
test edi, edi
je 0x1000ce85
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000ce9e
lea ecx, [ebp - 0x418]
call fcn.1000c4af
mov eax, esi
call fcn.10016fc0
ret 0x10
Function at 0x10022560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov dword [ebp - 0x10], edx
mov esi, ecx
call fcn.1008da48
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0xc], ecx
xorps xmm1, xmm1
mov eax, dword [eax]
movsx eax, byte [eax]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], esi
mov cl, byte [esi]
movzx eax, cl
test byte [eax + 0x100e3511], 8
je 0x100225c0
nop
mov cl, byte [esi + 1]
inc esi
movzx eax, cl
test byte [eax + 0x100e3511], 8
jne 0x100225b0
lea edx, [esi + 1]
cmp cl, 0x2d
jne 0x100225d1
mov dword [ebp - 0x14], 1
jmp 0x100225da
cmp cl, 0x2b
mov dword [ebp - 0x14], edi
cmovne edx, esi
cmp byte [edx], 0x30
jne 0x10022721
mov al, byte [edx + 1]
cmp al, 0x78
je 0x100225f2
cmp al, 0x58
jne 0x10022721
movsd xmm2, qword [0x100edfc0]
add edx, 2
xor esi, esi
nop
mov al, byte [edx]
movsx ecx, al
mov dword [ebp - 0x1c], edx
mov byte [ebp - 1], al
cmp ecx, dword [ebp - 0x18]
jne 0x1002261c
test esi, esi
jne 0x10022672
mov esi, 1
inc edx
jmp 0x10022600
movzx eax, al
test byte [eax + 0x100e3511], 0x10
je 0x10022672
mov eax, dword [ebp - 8]
test eax, eax
jne 0x1002263a
cmp byte [ebp - 1], 0x30
jne 0x1002263a
inc dword [ebp - 0xc]
jmp 0x1002266a
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x1e
jg 0x10022669
test byte [ecx + 0x100e3511], 2
je 0x10022651
add ecx, 0xffffffd0
jmp 0x10022657
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x1002266a
inc edi
test esi, esi
je 0x1002266f
dec edi
inc edx
jmp 0x10022600
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
je 0x10022721
mov eax, dword [ebp - 0x10]
shl edi, 2
mov dword [eax], edx
mov al, byte [edx]
cmp al, 0x70
je 0x10022690
cmp al, 0x50
jne 0x100226f2
mov dl, byte [edx + 1]
xor ecx, ecx
cmp dl, 0x2d
jne 0x100226a2
lea esi, [ecx + 1]
lea eax, [ecx + 2]
jmp 0x100226ad
xor eax, eax
xor esi, esi
cmp dl, 0x2b
sete al
inc eax
mov edx, dword [ebp - 0x1c]
add edx, eax
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x100e3511], 2
je 0x10022721
movsx eax, byte [ebp - 1]
lea ecx, [ecx + ecx*4]
inc edx
lea ecx, [ecx - 0x18]
lea ecx, [eax + ecx*2]
mov al, byte [edx]
mov byte [ebp - 1], al
movzx eax, al
test byte [eax + 0x100e3511], 2
jne 0x100226c3
mov eax, ecx
neg eax
test esi, esi
cmove eax, ecx
add edi, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
cmp dword [ebp - 0x14], 0
je 0x100226ff
xorps xmm1, xmmword [0x100ee300]
push edi
sub esp, 8
movsd qword [esp], xmm1
call fcn.10092201
fstp qword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x20]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
pop edi
xorps xmm0, xmm0
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10022950
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x10107008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
lea edx, [ebp - 0xe0]
call fcn.100227a0
mov edx, eax
test edx, edx
je 0x100229aa
mov ecx, dword [ebp - 0xe0]
sub edx, esi
mov dword [ebx], ecx
mov eax, 0x13
mov ecx, dword [ebp - 0xdc]
mov dword [ebx + 4], ecx
mov dword [ebx + 8], eax
lea eax, [edx + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080d10
mov esp, ebp
pop ebp
ret
push str..xXnN
push esi
call fcn.1008efc0
add esp, 8
test eax, eax
je 0x100229da
movzx edi, byte [eax]
or edi, 0x20
cmp edi, 0x6e
jne 0x100229dc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080d10
mov esp, ebp
pop ebp
ret
xor edi, edi
push edi
lea edx, [ebp - 0xf0]
mov ecx, esi
call fcn.10022730
mov edx, eax
add esp, 4
test edx, edx
jne 0x10022a8e
push 0x2e
push esi
call fcn.10084180
mov edx, esi
mov dword [ebp - 0xdc], eax
add esp, 8
lea ecx, [edx + 1]
mov dword [ebp - 0xe4], ecx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10022a13
sub edx, dword [ebp - 0xe4]
cmp edx, 0xc8
ja 0x100229c7
test eax, eax
je 0x100229c7
lea edx, [ebp - 0xd8]
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10022a36
call fcn.1008da48
mov ecx, dword [ebp - 0xdc]
lea edx, [ebp - 0xf0]
sub ecx, esi
push edi
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp + ecx - 0xd8], al
lea ecx, [ebp - 0xd8]
call fcn.10022730
mov edx, eax
add esp, 4
test edx, edx
je 0x100229c7
mov eax, esi
lea ecx, [ebp - 0xd8]
sub eax, ecx
add edx, eax
test edx, edx
je 0x100229c7
movsd xmm0, qword [ebp - 0xf0]
sub edx, esi
mov ecx, dword [ebp - 4]
mov eax, 3
pop edi
movsd qword [ebx], xmm0
xor ecx, ebp
mov dword [ebx + 8], eax
lea eax, [edx + 1]
pop esi
pop ebx
call fcn.10080d10
mov esp, ebp
pop ebp
ret
Function at 0x10028730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x10107008]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x338
push 8
push 0
push ebx
call edi
mov ecx, eax
add esp, 0x10
mov dword [esp + 0xc], ecx
test ecx, ecx
jne 0x10028778
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10080d10
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 4]
mov byte [ecx + 0xbc], 1
lea esi, [ecx + 0x80]
mov dword [eax], 0
xor ecx, ecx
mov dword [eax + 4], pe_nt_image_headers32
mov word [eax + 0x6e], cx
mov dword [eax + 0x10], esi
mov dword [eax + 0x20], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x60], 0
mov dword [eax + 0x2c], eax
mov dword [eax + 0x30], 0
mov dword [eax + 0x58], ecx
mov dword [eax + 0x70], ecx
mov dword [eax + 0x64], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x24], ecx
mov ecx, 1
mov byte [eax + 0x74], 1
mov word [eax + 0x6c], cx
mov byte [eax + 8], 0
mov dword [eax + 0x5c], 0
mov dword [esi + 0x7c], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
mov dword [esi + 4], ebx
lea ebx, [ecx + 0xf]
push 0
mov dword [esi], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x100e3a10
mov dword [esp + 0x24], fcn.10028730
call fcn.10093807
mov edi, eax
add esp, 4
xor edi, ebx
nop dword [eax]
movzx edx, byte [esp + ebx + 0x13]
mov ecx, edi
shl ecx, 5
mov eax, edi
add edx, ecx
shr eax, 2
add edx, eax
dec ebx
xor edi, edx
cmp ebx, 1
jae 0x10028820
mov dword [esi + 0x38], edi
mov edx, 0x10028350
mov word [esi + 0x3e], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x80], 0
mov byte [esi + 0x3d], 7
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x68], 0
mov dword [esi + 8], 0x338
mov dword [esi + 0xc], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0xc8
mov dword [esi + 0x74], 0xc8
mov dword [esi + 0xe8], 0
mov dword [esi + 0xec], 0
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf8], 0
mov dword [esi + 0xfc], 0
mov dword [esi + 0x100], 0
mov dword [esi + 0x104], 0
mov dword [esi + 0x108], 0
mov esi, dword [esp + 0xc]
add esi, 4
push 0
mov ecx, esi
call fcn.100176e0
add esp, 4
test eax, eax
je 0x1002896b
mov ecx, esi
call fcn.10028570
xor esi, esi
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10080d10
mov esp, ebp
pop ebp
ret
Function at 0x10028980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, esi
mov eax, esi
xor eax, dword [ebp + 8]
shr edi, 5
inc edi
cmp esi, edi
jb 0x100289bb
nop dword [eax]
movzx edx, byte [ebx + esi - 1]
mov ecx, eax
shl ecx, 5
sub esi, edi
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp esi, edi
jae 0x100289a0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10028b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov dword [ebp - 8], eax
mov edi, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov esi, eax
mov edx, eax
mov dword [ebp - 4], edi
shr edx, 5
mov ebx, dword [edi + 0x38]
inc edx
xor ebx, eax
cmp eax, edx
jb 0x10028b5e
mov edi, dword [ebp - 0xc]
nop
movzx ecx, byte [edi + esi - 1]
mov eax, ebx
shl eax, 5
sub esi, edx
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp esi, edx
jae 0x10028b40
mov edi, dword [ebp - 4]
mov edx, dword [edi + 0x20]
mov eax, dword [edi + 0x18]
lea ecx, [edx - 1]
and ecx, ebx
mov edi, dword [eax + ecx*4]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x10028c0c
mov ecx, dword [ebp + 8]
nop dword [eax]
movzx eax, byte [edi + 7]
cmp ecx, eax
jne 0x10028bdb
mov edx, dword [ebp - 0xc]
lea eax, [edi + 0x10]
mov esi, ecx
sub esi, 4
jb 0x10028ba6
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x10028bab
add edx, 4
add eax, 4
sub esi, 4
jae 0x10028b95
cmp esi, 0xfffffffc
je 0x10028bea
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x10028bd8
cmp esi, 0xfffffffd
je 0x10028bea
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x10028bd8
cmp esi, 0xfffffffe
je 0x10028bea
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x10028bd8
cmp esi, 0xffffffff
je 0x10028bea
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x10028bea
mov ecx, dword [ebp + 8]
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x10028b80
mov esi, dword [ebp - 4]
mov edx, dword [esi + 0x20]
jmp 0x10028c0f
mov ecx, dword [ebp - 4]
mov al, byte [edi + 5]
xor al, 3
mov cl, byte [ecx + 0x3c]
xor cl, 3
test al, cl
jne 0x10028c95
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cmp dword [esi + 0x1c], edx
jl 0x10028c37
cmp edx, 0x3fffffff
jg 0x10028c37
add edx, edx
mov ecx, edi
call fcn.100289c0
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x18]
dec ecx
and ecx, ebx
lea eax, [eax + ecx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov esi, dword [edi + 0x10]
add eax, 0x11
push eax
push 4
mov ecx, edi
call fcn.10020a80
mov cl, byte [esi + 0x3c]
mov edi, eax
and cl, 3
mov byte [edi + 5], cl
lea eax, [edi + 0x10]
mov byte [edi + 4], 4
mov ecx, dword [esi + 0x40]
mov dword [edi], ecx
mov dword [esi + 0x40], edi
mov dword [edi + 8], ebx
mov ebx, dword [ebp + 8]
push ebx
push dword [ebp - 0xc]
mov byte [edi + 6], 0
push eax
mov byte [edi + ebx + 0x10], 0
call fcn.10084db0
mov ecx, dword [ebp - 0x10]
add esp, 0x14
mov byte [edi + 7], bl
mov eax, dword [ecx]
mov dword [edi + 0xc], eax
mov dword [ecx], edi
mov ecx, dword [ebp - 4]
inc dword [ecx + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037120
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
cmp byte [ebp + 0xc], 0
mov eax, ecx
push edi
mov edi, edx
mov dword [ebp - 4], eax
cmovne esi, edi
test esi, esi
jne 0x10037149
mov byte [ebp - 8], 0
jmp 0x10037169
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, dword [ebp - 4]
setne byte [ebp - 8]
push edi
push eax
push dword [ebp + 8]
call fcn.10084db0
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x10037193
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100371a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], ecx
cmp byte [ebp + 0xc], 0
mov eax, edx
push edi
cmovne esi, eax
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x18], edi
test esi, esi
jne 0x100371c7
xor bl, bl
jmp 0x100371ec
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
setne bl
push eax
push dword [ebp + 8]
mov byte [ebp - 0xc], bl
push ecx
call fcn.10084db0
add esp, 0xc
test bl, bl
je 0x10037215
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0xc], eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037220
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov bl, byte [esi]
test eax, eax
je 0x1003726a
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp bl, 0xe8
jb 0x10037308
cmp bl, 0xe9
jbe 0x100372e7
cmp bl, 0xff
jne 0x10037308
mov eax, dword [ebp + 8]
push ecx
mov ecx, esp
inc eax
mov dword [ecx], eax
call fcn.10063e70
add esp, 4
cmp al, 0x15
je 0x1003729a
cmp al, 0x25
jne 0x10037308
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, 2
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call ebx
test eax, eax
setne byte [ebp - 8]
mov esi, dword [esi]
test eax, eax
je 0x100372da
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call ebx
mov eax, dword [esi]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push ecx
mov eax, esp
inc esi
mov dword [eax], esi
call fcn.10063e20
add eax, 4
add esp, 4
add eax, esi
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10037320
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
mov edx, esp
mov dword [ebp - 4], ecx
mov dword [edx], eax
call fcn.10037220
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe8
cmp byte [ebp - 0xc], 0
je 0x1003737c
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
cmp byte [ebp - 0xc], 0
je 0x100373be
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100602f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1006031b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10060ce0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1006033d
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1006033f
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x100603c3
jg 0x10060354
test esi, esi
je 0x100603c3
test ecx, ecx
jl 0x1006039d
jg 0x1006035e
test eax, eax
je 0x1006039d
cmp edi, ecx
jg 0x10060372
jl 0x10060368
cmp esi, eax
jae 0x10060372
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.10084db0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x100603a0
mov edx, dword [ebp + 8]
test edi, edi
jl 0x100603c3
jg 0x100603aa
test esi, esi
je 0x100603c3
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100603c3
push eax
push esi
push 1
push edx
call fcn.1008d14a
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100609a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10107008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100609d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080d10
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10060a0c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x10060a0c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080d10
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x10060af5
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10060a34
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10060a67
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.10094092
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080d10
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x10060af5
cmp eax, 1
jle 0x10060ac8
cmp eax, 3
jne 0x10060af5
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.10094092
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10080d10
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10060ae5
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.1008d14a
add esp, 0x10
cmp edi, eax
jne 0x10060af5
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x100609f7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10080d10
mov esp, ebp
pop ebp
ret 4