joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e510
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf8
call esi
mov bl, 0xeb
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebf8], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebfe
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebfe], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee42
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee42], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee42
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee48
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee48], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee48
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee5
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62eee5], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62eee5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eeeb
call esi
mov byte [0x62eeeb], bl
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push 0x62eeeb
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ebf7
call esi
mov bl, 0x69
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ebf7], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62ee41
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62ee41], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62ee41
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62eee4
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62eee4], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62eee4
call esi
push 0x1000e700
push 0x520ecf
mov bl, 0xe8
call fcn.10017e50
push 0x1000e700
push 0x520f1f
call fcn.10017e50
push 0x1000e700
push 0x63e743
call fcn.10017e50
push 0x1000e700
push 0x640eb2
call fcn.10017e50
push 0x1000e700
push 0x7d2dd9
call fcn.10017e50
push 0x1000e700
push 0x7e6c0f
call fcn.10017e50
push 0x1000e700
push 0x84aef7
call fcn.10017e50
push 0x1000e750
push 0x47fe12
call fcn.10017e50
add esp, 0x40
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000e7b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x100b95ff], 0
je 0x1000e84f
push ebx
push esi
push 0x64
push 0
push 0x1015cb50
call sub.MSVCR100.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x63e7e4
call esi
mov edx, 0x63e7e4
mov ecx, 0x90909090
lea eax, [ebp - 4]
push eax
mov word [edx], cx
mov ecx, dword [ebp - 4]
push ecx
push 2
push edx
call esi
push 0x1000e860
push 0x62eb26
or bl, 0xff
call fcn.10017e50
push 0x1000e870
push 0x888d5f
mov bl, 0xe8
call fcn.10017e50
push 0x1000e920
push 0x886cd7
or bl, 0xff
call fcn.10017e50
push 0x1000e920
push 0x7d3cbd
or bl, 0xff
call fcn.10017e50
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e940
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x559b85
call esi
mov bl, 0xff
lea ecx, [ebp - 4]
push ecx
mov byte [0x559b85], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x559b85
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x559b86
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x559b86], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x559b86
call esi
push 0x1000ea70
push 0x4e199d
mov bl, 0xe8
call fcn.10017e50
push 0x1000ea70
push 0x587049
call fcn.10017e50
push 0x1000ea70
push 0x590ccc
call fcn.10017e50
push 0x1000ea70
push 0x5bbee6
call fcn.10017e50
push 0x1000ea70
push 0x64229d
call fcn.10017e50
push 0x1000ea70
push 0x642d51
call fcn.10017e50
push 0x1000ea70
push 0x643229
call fcn.10017e50
push 0x1000ea70
push 0x65ea86
call fcn.10017e50
add esp, 0x40
push 0x1000ea70
push 0x911a53
call fcn.10017e50
push 0x1000ea70
push 0x911a6d
call fcn.10017e50
push 0x1000ea70
push 0x911a87
call fcn.10017e50
push 0x1000ea70
push 0x911aa1
call fcn.10017e50
push 0x1000ea70
push 0x911abb
call fcn.10017e50
add esp, 0x28
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f700
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 4], eax
fld dword [0x1015e9c4]
push ebx
push esi
push edi
call fcn.10019450
lea esi, [eax + 0x14]
push 0x3f
lea eax, [ebp - 0x43]
push 0
push eax
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x44], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x482
mov edx, 0x402320
mov ecx, 0x8128adc
call edx
push eax
lea edx, [ebp - 0x44]
call fcn.10011660
fldz
add esp, 4
push ecx
fst dword [esp]
push 1
fld dword [0x1001abf8]
push 1
sub esp, 0x20
cmp dword [0x1015e9d8], 0
fstp dword [esp + 0x1c]
fld1
fstp dword [esp + 0x18]
jne 0x1000f7b5
fld dword [0x1001abf4]
mov eax, 0x637c60
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [0x1001ab20]
fst dword [esp + 0xc]
fstp dword [esp + 8]
fild dword [ebp - 0x48]
fstp dword [esp + 4]
fld dword [0x1015e9c8]
fstp dword [esp]
push 0x7b69
call eax
jmp 0x1000f7e7
fst dword [esp + 0x14]
mov ecx, 0x637c60
fstp dword [esp + 0x10]
fld dword [0x1001ab20]
fst dword [esp + 0xc]
fstp dword [esp + 8]
fild dword [ebp - 0x48]
fstp dword [esp + 4]
fld dword [0x1015e9c8]
fstp dword [esp]
push 0x7b69
call ecx
fld dword [0x1015e9c8]
add esp, 0x30
push 0
call fcn.10019450
add eax, 0xf
push eax
push 0
lea ebx, [ebp - 0x44]
lea eax, [esi + 5]
call fcn.1000ee50
fld dword [0x1015e9c8]
add esp, 0xc
push 0xa
push 0xa
push esi
call fcn.10019450
push eax
mov edx, 0x790b10
call edx
add esp, 0x10
test al, al
je 0x1000f947
push 1
mov eax, 0x791070
call eax
add esp, 4
test al, al
je 0x1000f947
mov ecx, 0x83c080
call ecx
xor ebx, ebx
push ebx
push ebx
push 0x19
mov edx, 0x6d6c20
call edx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
xor dword [0x1015e9d8], 1
je 0x1000f8d4
lea eax, [ebp - 0x48]
push eax
push 0x40
push 0xa
push 0x4d9a02
mov dword [ebp - 0x54], 0x90909090
mov dword [ebp - 0x50], 0x90909090
mov word [ebp - 0x4c], 0x9090
call esi
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
mov eax, 0x4d9a02
mov dword [eax], ecx
mov cx, word [ebp - 0x4c]
mov dword [eax + 4], edx
lea edx, [ebp - 0x48]
push edx
mov word [eax + 8], cx
mov eax, dword [ebp - 0x48]
push eax
push 0xa
push 0x4d9a02
call esi
lea ecx, [ebp - 0x48]
push ecx
push 0x40
push 1
push 0x5edfe0
call esi
lea edx, [ebp - 0x48]
mov byte [0x5edfe0], 0xc3
mov eax, dword [ebp - 0x48]
push edx
push eax
jmp 0x1000f93e
lea ecx, [ebp - 0x48]
push ecx
push 0x40
push 0xa
push 0x4d9a02
mov dword [ebp - 0x54], 0x17e8006a
mov dword [ebp - 0x50], 0x8300102e
mov word [ebp - 0x4c], 0x4c4
call esi
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
mov eax, 0x4d9a02
mov dword [eax], edx
mov dx, word [ebp - 0x4c]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x48]
push eax
push ecx
push 0xa
push 0x4d9a02
call esi
lea edx, [ebp - 0x48]
push edx
push 0x40
push 1
push 0x5edfe0
call esi
lea eax, [ebp - 0x48]
mov byte [0x5edfe0], 0x55
mov ecx, dword [ebp - 0x48]
push eax
push ecx
push 1
push 0x5edfe0
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
Function at 0x1000fcc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 4], eax
fld dword [0x1015e9c4]
push ebx
push esi
push edi
call fcn.10019450
lea esi, [eax + 0x50]
push 0x3f
lea eax, [ebp - 0x43]
push 0
push eax
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x44], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x592
mov edx, 0x402320
mov ecx, 0x8128adc
call edx
push eax
lea edx, [ebp - 0x44]
call fcn.10011660
fldz
add esp, 4
push ecx
fst dword [esp]
push 1
fld dword [0x1001abf8]
push 1
sub esp, 0x20
cmp dword [0x1015e9e4], 0
fstp dword [esp + 0x1c]
fld1
fstp dword [esp + 0x18]
jne 0x1000fd75
fld dword [0x1001abf4]
mov eax, 0x637c60
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [0x1001ab20]
fst dword [esp + 0xc]
fstp dword [esp + 8]
fild dword [ebp - 0x48]
fstp dword [esp + 4]
fld dword [0x1015e9c8]
fstp dword [esp]
push 0x7b69
call eax
jmp 0x1000fda7
fst dword [esp + 0x14]
mov ecx, 0x637c60
fstp dword [esp + 0x10]
fld dword [0x1001ab20]
fst dword [esp + 0xc]
fstp dword [esp + 8]
fild dword [ebp - 0x48]
fstp dword [esp + 4]
fld dword [0x1015e9c8]
fstp dword [esp]
push 0x7b69
call ecx
fld dword [0x1015e9c8]
add esp, 0x30
push 0
call fcn.10019450
add eax, 0xf
push eax
push 0
lea ebx, [ebp - 0x44]
lea eax, [esi + 5]
call fcn.1000ee50
fld dword [0x1015e9c8]
add esp, 0xc
push 0xa
push 0xa
push esi
call fcn.10019450
push eax
mov edx, 0x790b10
call edx
add esp, 0x10
test al, al
je 0x1000fe78
push 1
mov eax, 0x791070
call eax
add esp, 4
test al, al
je 0x1000fe78
mov ecx, 0x83c080
call ecx
push 0
push 0
push 0x19
mov edx, 0x6d6c20
call edx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
xor dword [0x1015e9e4], 1
lea eax, [ebp - 0x48]
push eax
push 0x40
push 1
push 0x74cd30
je 0x1000fe37
call esi
mov bl, 0xc3
jmp 0x1000fe3b
call esi
mov bl, 0x55
lea ecx, [ebp - 0x48]
push ecx
mov byte [0x74cd30], bl
mov edx, dword [ebp - 0x48]
push edx
push 1
push 0x74cd30
call esi
lea eax, [ebp - 0x48]
push eax
push 0x40
push 1
push 0x771310
call esi
lea ecx, [ebp - 0x48]
push ecx
mov byte [0x771310], bl
mov edx, dword [ebp - 0x48]
push edx
push 1
push 0x771310
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
Function at 0x1000fe90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 4], eax
fld dword [0x1015e9c4]
push ebx
push esi
push edi
call fcn.10019450
lea esi, [eax + 0x64]
push 0x3f
lea eax, [ebp - 0x43]
push 0
push eax
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x44], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x593
mov edx, 0x402320
mov ecx, 0x8128adc
call edx
push eax
lea edx, [ebp - 0x44]
call fcn.10011660
fldz
add esp, 4
push ecx
fst dword [esp]
push 1
fld dword [0x1001abf8]
push 1
sub esp, 0x20
cmp dword [0x1015e9e8], 0
fstp dword [esp + 0x1c]
fld1
fstp dword [esp + 0x18]
jne 0x1000ff45
fld dword [0x1001abf4]
mov eax, 0x637c60
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [0x1001ab20]
fst dword [esp + 0xc]
fstp dword [esp + 8]
fild dword [ebp - 0x48]
fstp dword [esp + 4]
fld dword [0x1015e9c8]
fstp dword [esp]
push 0x7b69
call eax
jmp 0x1000ff77
fst dword [esp + 0x14]
mov ecx, 0x637c60
fstp dword [esp + 0x10]
fld dword [0x1001ab20]
fst dword [esp + 0xc]
fstp dword [esp + 8]
fild dword [ebp - 0x48]
fstp dword [esp + 4]
fld dword [0x1015e9c8]
fstp dword [esp]
push 0x7b69
call ecx
fld dword [0x1015e9c8]
add esp, 0x30
push 0
call fcn.10019450
add eax, 0xf
push eax
push 0
lea ebx, [ebp - 0x44]
lea eax, [esi + 5]
call fcn.1000ee50
fld dword [0x1015e9c8]
add esp, 0xc
push 0xa
push 0xa
push esi
call fcn.10019450
push eax
mov edx, 0x790b10
call edx
add esp, 0x10
test al, al
je 0x100100c6
push 1
mov eax, 0x791070
call eax
add esp, 4
test al, al
je 0x100100c6
mov ecx, 0x83c080
call ecx
push 0
push 0
push 0x19
mov edx, 0x6d6c20
call edx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
xor dword [0x1015e9e8], 1
lea eax, [ebp - 0x48]
push eax
push 0x40
push 1
push 0x626190
je 0x1001005e
call esi
mov bl, 0xc3
lea ecx, [ebp - 0x48]
push ecx
mov byte [0x626190], bl
mov edx, dword [ebp - 0x48]
push edx
push 1
push 0x626190
call esi
lea eax, [ebp - 0x48]
push eax
push 0x40
push 1
push 0x72d1b0
call esi
lea ecx, [ebp - 0x48]
push ecx
mov byte [0x72d1b0], bl
mov edx, dword [ebp - 0x48]
push edx
push 1
push 0x72d1b0
call esi
lea eax, [ebp - 0x48]
push eax
push 0x40
push 1
push 0x6d9116
call esi
mov byte [0x6d9116], 0
jmp 0x100100b5
call esi
mov bl, 0x55
lea ecx, [ebp - 0x48]
push ecx
mov byte [0x626190], bl
mov edx, dword [ebp - 0x48]
push edx
push 1
push 0x626190
call esi
lea eax, [ebp - 0x48]
push eax
push 0x40
push 1
push 0x72d1b0
call esi
lea ecx, [ebp - 0x48]
push ecx
mov byte [0x72d1b0], bl
mov edx, dword [ebp - 0x48]
push edx
push 1
push 0x72d1b0
call esi
lea eax, [ebp - 0x48]
push eax
push 0x40
push 1
push 0x6d9116
call esi
mov byte [0x6d9116], 1
mov edx, dword [ebp - 0x48]
lea ecx, [ebp - 0x48]
push ecx
push edx
push 1
push 0x6d9116
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
Function at 0x10010720
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 4], eax
fld dword [0x1015e9c4]
push ebx
push esi
push edi
call fcn.10019450
lea esi, [eax + 0x28]
push 0x3f
lea eax, [ebp - 0x43]
push 0
push eax
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x44], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x182
mov edx, 0x402320
mov ecx, 0x8128adc
call edx
push eax
lea edx, [ebp - 0x44]
call fcn.10011660
fldz
add esp, 4
push ecx
fst dword [esp]
push 1
push 1
sub esp, 0x20
cmp dword [0x1015e9f4], 0
jne 0x100107d5
fld dword [0x1001abf4]
mov eax, 0x637c60
fstp dword [esp + 0x1c]
fld1
fstp dword [esp + 0x18]
fld dword [0x1001ac04]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [0x1001ab20]
fst dword [esp + 0xc]
fstp dword [esp + 8]
fild dword [ebp - 0x48]
fstp dword [esp + 4]
fld dword [0x1015e9cc]
fstp dword [esp]
push 0x7b69
call eax
jmp 0x10010817
fld dword [0x1001abf8]
mov ecx, 0x637c60
fstp dword [esp + 0x1c]
fld1
fstp dword [esp + 0x18]
fst dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [0x1001ab20]
fst dword [esp + 0xc]
fstp dword [esp + 8]
fild dword [ebp - 0x48]
fstp dword [esp + 4]
fld dword [0x1015e9cc]
fstp dword [esp]
push 0x7b69
call ecx
fld dword [0x1015e9cc]
add esp, 0x30
push 0
call fcn.10019450
add eax, 0xf
push eax
push 0
lea ebx, [ebp - 0x44]
lea eax, [esi + 5]
call fcn.1000ee50
fld dword [0x1015e9cc]
add esp, 0xc
push 0xa
push 0xa
push esi
call fcn.10019450
push eax
mov edx, 0x790b10
call edx
add esp, 0x10
test al, al
je 0x10010916
push 1
mov eax, 0x791070
call eax
add esp, 4
test al, al
je 0x10010916
mov ecx, 0x83c080
call ecx
xor ebx, ebx
push ebx
push ebx
push 0x19
mov edx, 0x6d6c20
call edx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
xor dword [0x1015e9f4], 1
lea eax, [ebp - 0x48]
push eax
push 0x40
push 1
push 0x59af55
je 0x100108d5
call esi
lea ecx, [ebp - 0x48]
push ecx
mov byte [0x59af55], bl
mov edx, dword [ebp - 0x48]
push edx
push 1
push 0x59af55
call esi
lea eax, [ebp - 0x48]
push eax
push 0x40
push 1
push 0x59b24a
call esi
mov byte [0x59b24a], bl
jmp 0x10010905
call esi
lea ecx, [ebp - 0x48]
push ecx
mov byte [0x59af55], 1
mov edx, dword [ebp - 0x48]
push edx
push 1
push 0x59af55
call esi
lea eax, [ebp - 0x48]
push eax
push 0x40
push 1
push 0x59b24a
call esi
mov byte [0x59b24a], 1
mov edx, dword [ebp - 0x48]
lea ecx, [ebp - 0x48]
push ecx
push edx
push 1
push 0x59b24a
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
Function at 0x10011790
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100117d7
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a8d
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x18]
push eax
push 6
lea ecx, [ebp - 0x20]
push ecx
push edi
call ebx
mov edx, 0x1112
cmp word [ebp - 0x20], dx
jne 0x100118ec
cmp dword [ebp - 0x1e], 0x36
jne 0x100118ec
cmp byte [ebp + 0xc], 0
push esi
mov esi, 0x100b8b8c
je 0x10011817
mov esi, 0x100b8bbc
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
call ebx
mov edx, dword [0x100b8bec]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi], edx
mov eax, dword [0x100b8bf0]
xor eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov ecx, dword [0x100b8bf4]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 8], ecx
mov edx, dword [0x100b8bf8]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0xc], edx
call ebx
mov edx, dword [0x100b8bec]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi + 0x10], edx
mov eax, dword [0x100b8bf0]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [0x100b8bf4]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x18], ecx
mov edx, dword [0x100b8bf8]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0x1c], edx
call ebx
mov edx, dword [0x100b8bec]
xor edx, dword [ebp - 0x14]
push edi
mov dword [esi + 0x20], edx
mov eax, dword [0x100b8bf0]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov ecx, dword [0x100b8bf4]
xor ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ecx
mov edx, dword [0x100b8bf8]
xor edx, dword [ebp - 8]
mov dword [esi + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a8d
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.10018a8d
mov esp, ebp
pop ebp
ret 8

Function at 0x10011d30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x10011e20
push 0x5bafab
mov bl, 0xe8
call fcn.10017e50
push 0x10011da0
push 0x7c5db0
call fcn.10017e50
push 0x10011d20
push 0x842859
mov bl, 0xe9
call fcn.10017e50
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x81c03fa
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x81c03fa], 1
mov edx, dword [ebp - 4]
push edx
push 1
push 0x81c03fa
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013300
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x1001d018]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call fcn.10003e70
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x9b99c]
mov eax, str.DataLocalMainInfo.bmd
call fcn.10003fb0
test al, al
jne 0x10013361
push str._Error__ReadMainFile_1:_Failed_to_calculate_CRC_for_the_main_file.
call fcn.10018080
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.DataLocalMainInfo.bmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100133a5
push str._Error__ReadMainFile_2:_Failed_to_open_the_main_file.
call fcn.10018080
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x9b998
je 0x100133df
push str._Error__ReadMainFile_3:_Unexpected_size_for_the_main_file.
call fcn.10018080
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x9b998
lea esi, [ebx + 4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10013409
push str._Error__ReadMainFile_4:_Failed_to_read_the_main_file_data.
jmp 0x100133ba
xor eax, eax
jmp 0x10013410
mov edx, eax
shr edx, 8
xor dl, 0x95
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xca
mov byte [esi + eax], dl
inc eax
cmp eax, 0x9b998
jb 0x10013410
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
Function at 0x10013450
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x518
mov eax, dword [0x1001d018]
xor eax, esp
mov dword [esp + 0x514], eax
cmp dword [edi + 0xf4], 0
push ebx
push esi
je 0x1001354d
push 0x103
lea eax, [esp + 0x415]
push 0
push eax
mov byte [esp + 0x41c], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x414]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100134c6
push str._Error__CheckClientFile_1:_Failed_to_get_the_module_file_name.
call fcn.10018080
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ebx, [edi + 0xd3]
push ebx
lea esi, [esp + 0x414]
call fcn.10017ed0
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x100134fc
push str._Error__CheckClientFile_2:_Unexpected_client_file_name.
call fcn.10018080
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea esi, [esp + 0x10]
call fcn.10003e70
mov edx, esi
push edx
lea esi, [esp + 0x10]
mov eax, ebx
call fcn.10003fb0
test al, al
jne 0x1001352c
push str._Error__CheckClientFile_3:_Failed_to_calculate_CRC_for_the_client_file.
call fcn.10018080
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [edi + 0xf4]
cmp eax, dword [esp + 0xc]
je 0x1001354d
push str._Error__CheckClientFile_4:_Client_file_CRC_does_not_match.
call fcn.10018080
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x51c]
pop esi
pop ebx
xor ecx, esp
call fcn.10018a8d
mov esp, ebp
pop ebp
ret