joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024300
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x4fd743
mov dword [0x1013e3f0], 0x782a00
mov dword [0x1013e3f4], 0x4b2940
mov dword [0x1013e3f8], 0x7829f0
mov dword [0x1013e3fc], 0x7829e0
mov dword [0x1013e400], 0x7829d0
mov dword [0x1013e404], 0x782a10
mov dword [0x1013e408], 0x782a20
mov dword [0x1013e40c], 0x4fd755
call esi
mov byte [0x4fd743], 0xe9
mov eax, 0x10024150
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffb028b8
mov dword [0x4fd744], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x4fd743
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4fd748
call esi
mov eax, 0x4fd748
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4fd748
call esi
push 0
push 3
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x8cf90200
push eax
push 0x999725
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0xc]
mov dword [0x1013e410], 0x599729
push eax
push 0x40
push 5
push 0x5996ad
call esi
mov byte [0x5996ad], 0xe9
mov eax, 0x10024260
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffa6694e
mov dword [0x5996ae], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x5996ad
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push 0x5996b2
call esi
mov eax, 0x5996b2
mov dword [eax], 0x90909090
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 4
push 0x5996b2
call esi
lea eax, [ebp - 0xc]
mov dword [0x1013e414], 0x50687d
push eax
push 0x40
push 5
push 0x506878
call esi
mov byte [0x506878], 0xe9
mov eax, 0x100241e0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffaf9783
mov dword [0x506879], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x506878
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x558a0b
call esi
mov byte [0x558a0b], 0xe9
mov eax, 0x100242e0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffaa75f0
mov dword [0x558a0c], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x558a0b
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x5caeec
call esi
mov byte [0x5caeec], 0xe9
mov eax, 0x10024280
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffa3510f
mov dword [0x5caeed], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x5caeec
call esi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push 0x5cbacd
call esi
mov byte [0x5cbacd], 0xe9
mov eax, 0x100242a0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 0xffa3452e
mov dword [0x5cbace], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x5cbacd
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10029840
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10059898]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x28]
push esi
push edi
push eax
push 0x40
push 5
push 0x4e4a80
call ebx
mov byte [0x4e4a80], 0xe9
mov eax, 0x100297b0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, 0xffb1b57b
mov dword [0x4e4a81], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
push 5
push 0x4e4a80
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0xc]
push 0
push 6
push eax
push 0x4dd8e4
mov dword [ebp - 0xc], 0x5489f28b
mov word [ebp - 8], 0x1424
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
push 0
push 2
lea eax, [ebp - 0x2c]
mov word [ebp - 0x2c], 0xf633
push eax
push 0x4dd8f3
call edi
push eax
call esi
push 0
push 4
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0xe933f933
push eax
push 0x4e4ad3
call edi
push eax
call esi
push 0
push 7
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x1bdff33
push eax
push 0x4e4adc
mov word [ebp - 0x10], 0
mov byte [ebp - 0xe], 0
call edi
push eax
call esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x15], 0xe8
push eax
push 1
lea eax, [ebp - 0x15]
push eax
push 0x5d7451
call edi
push eax
call esi
mov eax, 0x10029570
sub eax, 0x5d7456
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1c]
push eax
push 4
lea eax, [ebp - 0x24]
push eax
push 0x5d7452
call edi
push eax
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x5c4925
call ebx
mov byte [0x5c4925], 0xe9
mov eax, 0x10029800
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, 0xffa3b6d6
mov dword [0x5c4926], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push 5
push 0x5c4925
call ebx
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x5d1e6f
call ebx
mov byte [0x5d1e6f], 0xe9
mov eax, 0x10029820
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, 0xffa2e18c
mov dword [0x5d1e70], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push 5
push 0x5d1e6f
call ebx
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4de3b5
call ebx
mov byte [0x4de3b5], 0xe9
mov eax, 0x10029790
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, 0xffb21c46
mov dword [0x4de3b6], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push 5
push 0x4de3b5
call ebx
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4f6e68
call ebx
mov byte [0x4f6e68], 0xe9
mov eax, 0x10029530
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, 0xffb09193
mov dword [0x4f6e69], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
push 5
push 0x4f6e68
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f2fb
mov esp, ebp
pop ebp
ret
Function at 0x10029a50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
cmp ebx, 5
jge 0x10029a64
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push 0x90
push edi
call fcn.100311f0
mov eax, dword [ebp + 0xc]
add esp, 0xc
sub eax, edi
mov byte [edi], 0xe9
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029f70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10059898]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0x18]
push esi
push edi
push 0
push 1
push eax
push 0x448067
mov byte [ebp - 0x18], 0x6e
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call edi
push 0
push 1
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0x4b
push eax
push 0x448096
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0x66
push eax
push 0x448f6b
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0x90
push eax
push 0x448f6c
call ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 5
push 0x448551
mov dword [0x1013dff4], 0x6645c4
call esi
mov byte [0x448551], 0xe9
mov eax, 0x1002e790
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, 0xffbb7aaa
mov dword [0x448552], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push 5
push 0x448551
call esi
lea eax, [ebp - 0x24]
mov dword [0x1013dfd8], 0x448925
push eax
push 0x40
push 5
push 0x448ee8
mov dword [0x1013dfdc], 0x4a5230
mov dword [0x1013dfe8], 0x44869c
mov dword [0x1013e000], 0x4bcf90
mov dword [0x1013e004], 0x4bceb0
mov dword [0x1013e008], 0x5fce14
mov dword [0x1013e00c], 0x4bbf20
mov dword [0x1013dfe4], 0x4a55f0
mov dword [0x1013dff0], 0x4bd5e0
mov dword [0x1013dfe0], 0x1002e7f0
mov dword [0x1013dff8], 0x1002e850
mov dword [0x1013e010], 0x4bd5a0
mov dword [0x1013e014], 0x448f37
call esi
mov byte [0x448ee8], 0xe9
mov eax, 0x1002ea70
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, 0xffbb7113
mov dword [0x448ee9], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push 5
push 0x448ee8
call esi
lea eax, [ebp - 0x24]
push eax
push 0x40
push 5
push 0x4e1c0e
call esi
mov byte [0x4e1c0e], 0xe9
mov eax, 0x1002ead0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, 0xffb1e3ed
mov dword [0x4e1c0f], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push 5
push 0x4e1c0e
call esi
push 0
push 5
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x4e1c2068
push eax
push 0x4e1c09
mov byte [ebp - 8], 0
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0x90
push eax
push 0x4e1c13
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0xeb
push eax
push 0x4df521
call ebx
push eax
call edi
push 0
push 6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x352e9
push eax
push 0x4da6f5
mov word [ebp - 0x10], 0x9000
call ebx
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f2fb
mov esp, ebp
pop ebp
ret
Function at 0x1002d540
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push 0x40
push 5
push 0x58d0f0
mov dword [0x1013e3b8], 0x58d0f7
call ebx
mov byte [0x58d0f0], 0xe9
mov eax, 0x10029ae0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0xffa72f0b
mov dword [0x58d0f1], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 5
push 0x58d0f0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0
push 2
push 0x10058654
push 0x58d0f5
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
push 0
push 2
push 0x10058574
push 0x5c3f12
mov dword [0x1013e3bc], 0x5c3f26
call edi
push eax
call esi
lea eax, [ebp - 8]
mov byte [ebp - 1], 0xf
push eax
push 1
lea eax, [ebp - 1]
mov byte [ebp - 2], 0x84
push eax
push 0x5c3f14
call edi
push eax
call esi
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 2]
push eax
push 0x5c3f15
call edi
push eax
call esi
mov eax, 0x10029b00
sub eax, 0x5c3f1a
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x5c3f16
call edi
push eax
call esi
push 0
push 0x11
push 0x100585dc
push 0x5c3f1a
call edi
push eax
call esi
lea eax, [ebp - 0xc]
mov dword [0x1013e3c0], 0x461227
push eax
push 0x40
push 5
push 0x461222
call ebx
mov byte [0x461222], 0xe9
mov eax, 0x10029ab0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xffb9edd9
mov dword [0x461223], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x461222
call ebx
lea eax, [ebp - 0xc]
mov dword [0x1013e3c4], 0x461241
push eax
push 0x40
push 5
push 0x46123c
call ebx
mov byte [0x46123c], 0xe9
mov eax, 0x10029ac0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xffb9edbf
mov dword [0x46123d], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x46123c
call ebx
lea eax, [ebp - 0xc]
mov dword [0x1013e3c8], 0x46124e
push eax
push 0x40
push 5
push 0x461249
call ebx
mov byte [0x461249], 0xe9
mov eax, 0x10029ad0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xffb9edb2
mov dword [0x46124a], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x461249
call ebx
push 0
push 0x8b
push 0x10058860
push 0x4612e0
call edi
push eax
call esi
push 0
push 2
push 0x1005848c
push 0x5c3f29
call edi
push eax
call esi
push 0
push 6
push 0x100588ec
push 0x5c5233
call edi
push eax
call esi
lea eax, [ebp - 0xc]
mov dword [0x1013e3cc], 0x5fca14
push eax
push 0x40
push 5
push 0x5c3f3d
mov dword [0x1013e3d0], 0x4611d0
mov dword [0x1013e3d4], 0x5c3f42
call ebx
mov byte [0x5c3f3d], 0xe8
mov eax, 0x10029b30
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0xffa3c0be
mov dword [0x5c3f3e], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 5
push 0x5c3f3d
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002eda0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x10059898]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0xc]
push 0
push 5
push eax
push 0x600305
mov dword [ebp - 0xc], 0x1b676e9
mov byte [ebp - 8], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call esi
push 0
push 0xaf
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], 0x772790a3
push eax
push 0x61b980
mov dword [ebp - 0xc0], 0xb9a36800
mov dword [ebp - 0xbc], 0x15ff0061
mov dword [ebp - 0xb8], 0x61c110
mov dword [ebp - 0xb4], 0x909026eb
mov dword [ebp - 0xb0], 0x90
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0x70000000
mov dword [ebp - 0xa0], 0x68637461
mov dword [ebp - 0x9c], 0x6c6c642e
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0xf168036a
mov dword [ebp - 0x88], 0x680061b9
mov dword [ebp - 0x84], 0x61ba06
mov dword [ebp - 0x80], 0x15ff006a
mov dword [ebp - 0x7c], 0x61c37c
mov dword [ebp - 0x78], 0x7506f883
mov dword [ebp - 0x74], 0xac05c60c
mov dword [ebp - 0x70], 0x40064d4
mov dword [ebp - 0x6c], 0xfe492de9
mov dword [ebp - 0x68], 0xac05c6ff
mov dword [ebp - 0x64], 0x10064d4
mov dword [ebp - 0x60], 0xfe4921e9
mov dword [ebp - 0x5c], 0x909090ff
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0x6f686300
mov dword [ebp - 0x50], 0x76206573
mov dword [ebp - 0x4c], 0x69737265
mov dword [ebp - 0x48], 0x6e6f
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0x6f640000
mov dword [ebp - 0x3c], 0x756f7920
mov dword [ebp - 0x38], 0x6e617720
mov dword [ebp - 0x34], 0x2e322074
mov dword [ebp - 0x30], 0x203f4330
mov dword [ebp - 0x2c], 0x20666928
mov dword [ebp - 0x28], 0x20756f79
mov dword [ebp - 0x24], 0x74736f68
mov dword [ebp - 0x20], 0x6f686320
mov dword [ebp - 0x1c], 0x6e206573
mov word [ebp - 0x18], 0x296f
mov byte [ebp - 0x16], 0
call edi
push eax
call esi
push 0
push 6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x90909090
push eax
push 0x4f00de
mov word [ebp - 0x10], 0x9090
call edi
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
call fcn.1002f2fb
mov esp, ebp
pop ebp
ret
Function at 0x1002ef90
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10059898]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x1c]
push edi
push eax
push 0x40
push 2
push 0x4510eb
call esi
mov eax, 0x4510eb
mov edi, 0x90909090
mov word [eax], di
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
push 2
push 0x4510eb
call esi
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 2
push 0x4577b1
call esi
mov eax, 0x4577b1
mov word [eax], di
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
push 2
push 0x4577b1
call esi
mov bl, byte [ebp + 8]
lea eax, [ebp - 0x14]
push 0
push 0x10
push eax
push 0x65d410
mov byte [0x1013df5c], bl
mov dword [ebp - 0x14], 0x65746e69
mov dword [ebp - 0x10], 0x63616672
mov dword [ebp - 0xc], 0x7372642e
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.10029f70
test bl, bl
je 0x1002f04b
mov byte [0x1013df5c], 0
lea eax, [ebp - 0x24]
push eax
push 0x40
push 5
push 0x41bcc5
call esi
mov byte [0x41bcc5], 0xe9
mov eax, 0x1002e750
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 0xffbe4336
mov dword [0x41bcc6], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push 5
push 0x41bcc5
call esi
lea eax, [ebp - 0x24]
mov dword [0x1013df64], 0x45fd90
push eax
push 0x40
push 5
push 0x4da6e5
mov dword [0x1013df70], 0x4580a4
mov dword [0x1013df68], 0x4db740
mov dword [0x1013df6c], 0x4580bd
mov dword [0x1013df80], 0x6645c4
mov dword [0x1013df78], 0x51eff0
mov dword [0x1013df74], 0x4580a9
mov dword [0x1013df84], 0x4a23e0
mov dword [0x1013df88], 0x4e1c45
mov dword [0x1013df8c], 0x1002e910
mov dword [0x1013df98], 0x619c48
mov dword [0x1013df90], 0x1002ea40
mov dword [0x1013df94], 0x619bc0
mov dword [0x1013dfac], 0x4da6ea
mov dword [0x1013dfb0], 0x4da6cc
call esi
mov byte [0x4da6e5], 0xe9
mov eax, 0x1002ea90
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, 0xffb25916
mov dword [0x4da6e6], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push 5
push 0x4da6e5
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f2fb
mov esp, ebp
pop ebp
ret

Function at 0x10040d06
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10040b85

Function at 0x100414ad
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100413b2

Function at 0x10042e96
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10042b56

Function at 0x1004a120
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004a14d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004a14d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40324c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40325b
pop dword [ebp - 0xc]
mov eax, 0x51ad189c
add eax, 0xae9319bf
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xd6b060fc
sub dword [ebp - 0x1c], 0x885e1bb1
mov dword [ebp - 0x18], 0xd4cbeda9
add dword [ebp - 0x18], 0x5d675e9c
mov dword [ebp - 0x14], 0x46c11488
add dword [ebp - 0x14], 0x58b2fa6
mov dword [ebp - 0x10], 0x8018d61e
add dword [ebp - 0x10], 0x7fe729e2
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xeeadedc2
add dword [ebp - 0x1c], 0x85c47b94
mov dword [ebp - 0x18], 0x8f0a9672
sub dword [ebp - 0x18], 0x4d9e34fd
mov dword [ebp - 0x14], 0x7f41f0a7
sub dword [ebp - 0x14], 0x1bd2843b
mov dword [ebp - 0x10], 0x3f3e5646
sub dword [ebp - 0x10], 0x3f3e5646
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x8759a8bd
add eax, 0x78e6d7bf
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x33418
push 0
call eax
mov ecx, 0x8379cc71
sub ecx, 0x8379938b
mov esi, eax
mov edx, 0x55fcdfe
add edx, 0xfae54602
add edx, dword [ebp - 0xc]
mov edi, 0xe7bf7a09
mov ebx, dword [edx]
mov dword [ebp - 4], 0xbc95d2fb
add ebx, edi
xor dword [ebp - 8], 0x40e4f9f1
mov dword [esi], ebx
sub dword [ebp - 4], ebx
add esi, 0x6ebcd9bf
sub esi, 0x6ebcd9bb
add edx, 0x5ac6e2a
add edx, 0xfa5391da
loop 0x403372
add eax, 0x365b7e86
add eax, 0xc9a557e5
xor ebx, ebx
add ebx, eax
add eax, 0x9f608b01
add eax, 0x609f7504
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x3023700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0302378f
jae 0x302370e
xor ecx, ecx
call fcn.0302378f
jae 0x302373d
xor eax, eax
call fcn.0302378f
jae 0x302374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0302378f
adc al, al
jae 0x302372f
jne 0x3023779
stosb byte es:[edi], al
jmp 0x3023711
call fcn.0302379b
sub ecx, ebx
jne 0x3023756
call fcn.03023799
jmp 0x3023775
lodsb al, byte [esi]
shr eax, 1
je 0x3023783
adc ecx, ecx
jmp 0x3023772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03023799
cmp eax, 0x7d00
jae 0x3023772
cmp ah, 5
jae 0x3023773
cmp eax, 0x7f
ja 0x3023774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3023711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x408e40
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47d2bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004721ce
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x408ec2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004700e0
mov eax, dword [eax]
push 0xb97c70
push eax
call fcn.00462dd4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00472459
test bl, bl
je 0x408ec2
push 0xb97c70
lea ecx, [esp + 0xc]
call fcn.004727e9
push 0xb97c7c
lea ecx, [esp + 0xc]
call fcn.004727e9
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x408efe
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00472459
jmp 0x408fc9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x408f82
lea edx, [esp + 0x7c]
push 0xb97c78
push edx
call fcn.00462dd4
add esp, 8
test eax, eax
je 0x408f82
lea eax, [esp + 0x7c]
push 0xb97c74
push eax
call fcn.00462dd4
add esp, 8
test eax, eax
je 0x408f82
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408f12
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00472459
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4097d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x409832
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc