joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008b40
Capabilities:
Extract resource via kernel32 functions
Read file on windows
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x1010bfb4
mov esi, eax
push 0x65
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
call fcn.100925f4
mov ebp, eax
mov eax, dword [esp + 0x14]
push esi
push eax
push ebp
call fcn.10095e10
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0x1010b7ec
push str..XNovaXNova1.acv
call fcn.10093a54
mov esi, eax
add esp, 8
xor edi, edi
test esi, esi
je 0x10008bef
push 2
push edi
push esi
call fcn.10094cc8
push esi
call fcn.10094bd0
push 0
push 0
push esi
mov edi, eax
call fcn.10094cc8
push edi
call fcn.100925f4
push esi
push 1
push edi
push eax
mov dword [0x10174d9c], eax
call fcn.10093e84
push esi
mov dword [0x1014e014], edi
call fcn.10094ea0
add esp, 0x34
jmp 0x10008c0f
push 0
push 0
push str.ACV_ERROR
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
xor eax, eax
test edi, edi
jle 0x10008c38
mov esi, dword [0x10174d9c]
lea ecx, [ecx]
cmp ecx, 4
jne 0x10008c2c
mov ecx, 1
jmp 0x10008c2d
inc ecx
mov dl, byte [ecx + ebp]
sub byte [esi + eax], dl
inc eax
cmp eax, edi
jl 0x10008c20
push ebp
call fcn.1009249d
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10009320
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
xor eax, eax
push ebx
xor ebx, ebx
push esi
push edi
mov dword [0x10220518], eax
mov word [0x1022051c], ax
mov dword [0x10220620], eax
mov dword [0x10220624], eax
mov dword [0x10220628], eax
mov dword [0x1022062c], eax
mov dword [0x10220630], eax
mov dword [0x10220634], eax
mov dword [0x10220638], eax
mov dword [0x1022063c], eax
mov dword [0x10220640], eax
mov dword [0x10220644], eax
mov dword [0x10220648], eax
mov dword [0x1022064c], eax
mov dword [0x10220590], eax
mov dword [0x10220594], eax
mov dword [0x10220598], eax
mov dword [0x1022059c], eax
mov dword [0x102205a0], eax
mov dword [0x102205a4], eax
mov dword [0x102205a8], eax
mov dword [0x102205ac], eax
mov dword [0x102205b0], eax
mov dword [0x102205b4], eax
mov dword [0x102205b8], eax
mov dword [0x102205bc], eax
mov dword [0x102205c0], eax
mov dword [0x102205c4], eax
mov dword [0x102205c8], eax
mov dword [0x102205cc], eax
mov dword [0x102205d0], eax
mov dword [0x102205d4], eax
mov dword [0x102205d8], eax
mov dword [0x102205dc], eax
mov dword [0x102205e0], eax
mov dword [0x102205e4], eax
mov dword [0x102205e8], eax
mov dword [0x102205ec], eax
mov dword [0x102205f0], eax
mov dword [0x102205f4], eax
mov dword [0x102205f8], eax
mov dword [0x102205fc], eax
mov dword [0x10220600], eax
mov dword [0x10220604], eax
mov dword [0x10220608], eax
mov dword [0x1022060c], eax
mov dword [0x10220610], eax
mov dword [0x10220614], eax
mov dword [0x10220618], eax
mov dword [0x1022061c], eax
mov byte [0x10131f86], bl
mov byte [0x1022044d], bl
mov dword [0x102204cc], ebx
mov dword [0x102204b8], ebx
mov dword [0x102204bc], ebx
mov dword [0x102204c0], ebx
mov dword [0x102204c8], ebx
mov dword [0x102204d8], ebx
mov dword [0x10175f6c], ebx
mov byte [0x102204a3], bl
call fcn.1000b350
call fcn.1000a910
call fcn.10006360
mov eax, dword [0x10220a94]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 6
push eax
mov dword [0x102077c4], ebx
mov esi, eax
call edi
test eax, eax
je 0x100094b2
mov edx, dword [str.normal]
mov dword [esi], edx
mov edx, dword [esp + 0xc]
mov ax, word [0x1010bc18]
lea ecx, [esp + 0xc]
push ecx
push edx
push 6
push esi
mov word [esi + 4], ax
call edi
pop edi
pop esi
mov dword [0x10220510], ebx
mov dword [0x102077c4], ebx
mov dword [0x1012cbb4], ebx
mov dword [0x10176364], ebx
mov dword [0x1020f7e4], ebx
mov dword [0x1012cb4c], ebx
mov dword [0x102097ac], ebx
mov dword [0x10217b34], ebx
mov dword [0x101fa810], ebx
pop ebx
pop ecx
ret
Function at 0x1000e580
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov ecx, dword [0x1022073c]
push str.B__t_Chance_S___1_:_Fade_Out
mov dword [0x102204d8], 1
call fcn.10008360
ret
mov ecx, dword [0x1022073c]
xor eax, eax
push str.B__t_Chance_S___2_:_Fade_In
mov dword [0x10175f6c], eax
mov dword [0x102204d0], eax
mov dword [0x102204d4], eax
call fcn.10008360
ret
push 0x5f
push 0x9b
xor eax, eax
push 0xff
push 0x1c7
mov dword [0x10175f6c], eax
mov dword [0x102204d0], eax
mov dword [0x102204d4], eax
call fcn.1000efd0
mov ecx, dword [0x1022073c]
push str.B__t_Chance_S___3_:_Chance_4_6
call fcn.10008360
ret
push 0x5a
push 0x96
xor eax, eax
push 0xfa
push 0x1c2
mov dword [0x10175f6c], eax
mov dword [0x102204d0], eax
mov dword [0x102204d4], eax
call fcn.1000efd0
mov ecx, dword [0x1022073c]
push str.B__t_Chance_S___4_:__a_o_Ng___c_Tr_n_D___i
call fcn.10008360
ret
push 0x5a
push 0x96
xor eax, eax
push 0xfa
push 0x1c2
mov dword [0x10175f6c], eax
mov dword [0x102204d0], eax
mov dword [0x102204d4], eax
call fcn.1000efd0
mov ecx, dword [0x1022073c]
push str.B__t_Chance_S___5_:__a_o_Ng___c_7_9_1_3
call fcn.10008360
ret
push 0x5f
push 0x9b
xor eax, eax
push 0xff
push 0x1c7
mov dword [0x10175f6c], eax
mov dword [0x102204d0], eax
mov dword [0x102204d4], eax
call fcn.1000efd0
mov ecx, dword [0x1022073c]
push str.B__t_Chance_S___6_:_Multi_Speed
call fcn.10008360
ret
push 0x64
push 0xa0
xor eax, eax
push 0x104
push 0x1cc
mov dword [0x10175f6c], eax
mov dword [0x102204d0], eax
mov dword [0x102204d4], eax
call fcn.1000efd0
mov ecx, dword [0x1022073c]
push str.B__t_Chance_S___7_:__a_o_Ng___c_Tr_n_D___i_Tra_i_Pha_i
call fcn.10008360
ret
mov eax, dword [0x102204d8]
cmp eax, 7
ja case.default.0x1000e58a
jmp dword [eax*4 + 0x1000e5bc]
jmp fcn.1000b350
jmp 0x1000b630
jmp 0x1000b650
jmp 0x1000b680
jmp 0x1000b6c0
jmp 0x1000b700
jmp 0x1000b740
jmp 0x1000b780
ret
Function at 0x1000efd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
test ebx, ebx
jle 0x1000f01e
mov edi, dword [0x10220964]
push ebp
lea eax, [esp + 0x18]
push eax
push 4
push 4
push edi
mov ebp, edi
call esi
test eax, eax
jne 0x1000f00b
lea eax, [esp + 0x18]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x1000f01d
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push edx
push 4
push edi
mov dword [ebp], ebx
call esi
pop ebp
mov ebx, dword [esp + 0x18]
test ebx, ebx
jle 0x1000f060
mov edi, dword [0x10220964]
lea eax, [esp + 0x14]
push eax
push 4
push 4
add edi, 4
push edi
call esi
test eax, eax
jne 0x1000f04f
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x1000f060
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
push 4
push edi
mov dword [edi], ebx
call esi
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jle 0x1000f0a2
mov edi, dword [0x10220964]
lea eax, [esp + 0x14]
push eax
push 4
push 4
add edi, 8
push edi
call esi
test eax, eax
jne 0x1000f091
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x1000f0a2
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
push 4
push edi
mov dword [edi], ebx
call esi
mov ebx, dword [esp + 0x20]
test ebx, ebx
jle 0x1000f0e4
mov edi, dword [0x10220964]
lea eax, [esp + 0x14]
push eax
push 4
push 4
add edi, 0xc
push edi
call esi
test eax, eax
jne 0x1000f0d3
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x1000f0e4
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
push 4
push edi
mov dword [edi], ebx
call esi
pop edi
pop esi
pop ebx
pop ecx
ret 0x10
Function at 0x1000f0f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x10220650]
cmp eax, 0x64
jg 0x1000f104
call fcn.1000f800
mov eax, dword [0x10220650]
cmp eax, 0x320
jl 0x1000f11c
cmp eax, 0x4b0
jge 0x1000f123
call fcn.1000f5d0
mov eax, dword [0x10220650]
cmp eax, 0x4b0
jl 0x1000f134
cmp eax, 0x640
jge 0x1000f13b
call fcn.1000f6f0
mov eax, dword [0x10220650]
cmp eax, 0x640
jl 0x1000f14c
cmp eax, 0x898
jge 0x1000f153
call fcn.1000f4c0
mov eax, dword [0x10220650]
cmp eax, 0x898
jl 0x1000f164
cmp eax, 0xa28
jge 0x1000f16b
call fcn.1000f3b0
mov eax, dword [0x10220650]
cmp eax, 0xa28
jl 0x1000f17c
cmp eax, 0xbb8
jge 0x1000f183
call fcn.1000f2a0
mov eax, dword [0x10220650]
cmp eax, 0xbb8
jl 0x1000f188
jmp 0x1000f190
ret
mov eax, dword [0x102204cc]
sub esp, 8
push ebx
push ebp
add eax, 0x29b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov dword [0x102204b0], eax
mov ebp, eax
test eax, eax
jle 0x1000f1eb
mov edi, dword [0x10220964]
lea eax, [esp + 0x10]
push eax
push 4
push 4
push edi
mov ebx, edi
call esi
test eax, eax
jne 0x1000f1da
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x1000f1eb
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
push 4
push edi
mov dword [ebx], ebp
call esi
mov edi, dword [0x1022077c]
lea eax, [esp + 0x10]
push eax
push 4
push 9
mov ebx, edi
push ebx
call esi
test eax, eax
jne 0x1000f213
lea eax, [esp + 0x10]
push eax
push 0x40
push 9
push ebx
call esi
test eax, eax
je 0x1000f23b
mov ecx, dword [str.text3000]
mov dword [edi], ecx
mov edx, dword [0x1010c310]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x10]
mov al, byte [0x1010c314]
lea ecx, [esp + 0x14]
push ecx
push edx
push 9
push ebx
mov byte [edi + 8], al
call esi
mov edi, dword [0x102208f4]
lea eax, [esp + 0x10]
push eax
push 4
push 0xa
mov ebx, edi
push ebx
call esi
test eax, eax
jne 0x1000f263
lea eax, [esp + 0x10]
push eax
push 0x40
push 0xa
push ebx
call esi
test eax, eax
je 0x1000f28d
mov ecx, dword [str.space3000]
mov dword [edi], ecx
mov edx, dword [0x1010c31c]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x10]
mov ax, word [0x1010c320]
lea ecx, [esp + 0x14]
push ecx
push edx
push 0xa
push ebx
mov word [edi + 8], ax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1000f2a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x102204cc]
sub esp, 8
push ebx
push ebp
add eax, 0x216
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov dword [0x102204b4], eax
mov ebp, eax
test eax, eax
jle 0x1000f2fb
mov edi, dword [0x10220964]
lea eax, [esp + 0x10]
push eax
push 4
push 4
push edi
mov ebx, edi
call esi
test eax, eax
jne 0x1000f2ea
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x1000f2fb
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
push 4
push edi
mov dword [ebx], ebp
call esi
mov edi, dword [0x1022077c]
lea eax, [esp + 0x10]
push eax
push 4
push 9
mov ebx, edi
push ebx
call esi
test eax, eax
jne 0x1000f323
lea eax, [esp + 0x10]
push eax
push 0x40
push 9
push ebx
call esi
test eax, eax
je 0x1000f34b
mov ecx, dword [str.text2600]
mov dword [edi], ecx
mov edx, dword [0x1010c328]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x10]
mov al, byte [0x1010c32c]
lea ecx, [esp + 0x14]
push ecx
push edx
push 9
push ebx
mov byte [edi + 8], al
call esi
mov edi, dword [0x102208f4]
lea eax, [esp + 0x10]
push eax
push 4
push 0xa
mov ebx, edi
push ebx
call esi
test eax, eax
jne 0x1000f373
lea eax, [esp + 0x10]
push eax
push 0x40
push 0xa
push ebx
call esi
test eax, eax
je 0x1000f39d
mov ecx, dword [str.space2600]
mov dword [edi], ecx
mov edx, dword [0x1010c334]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x10]
mov ax, word [0x1010c338]
lea ecx, [esp + 0x14]
push ecx
push edx
push 0xa
push ebx
mov word [edi + 8], ax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1000f3b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x102204cc]
sub esp, 8
push ebx
push ebp
add eax, 0x190
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov dword [0x102204b8], eax
mov ebp, eax
test eax, eax
jle 0x1000f40b
mov edi, dword [0x10220964]
lea eax, [esp + 0x10]
push eax
push 4
push 4
push edi
mov ebx, edi
call esi
test eax, eax
jne 0x1000f3fa
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x1000f40b
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
push 4
push edi
mov dword [ebx], ebp
call esi
mov edi, dword [0x1022077c]
lea eax, [esp + 0x10]
push eax
push 4
push 9
mov ebx, edi
push ebx
call esi
test eax, eax
jne 0x1000f433
lea eax, [esp + 0x10]
push eax
push 0x40
push 9
push ebx
call esi
test eax, eax
je 0x1000f45b
mov ecx, dword [str.text2200]
mov dword [edi], ecx
mov edx, dword [0x1010c340]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x10]
mov al, byte [0x1010c344]
lea ecx, [esp + 0x14]
push ecx
push edx
push 9
push ebx
mov byte [edi + 8], al
call esi
mov edi, dword [0x102208f4]
lea eax, [esp + 0x10]
push eax
push 4
push 0xa
mov ebx, edi
push ebx
call esi
test eax, eax
jne 0x1000f483
lea eax, [esp + 0x10]
push eax
push 0x40
push 0xa
push ebx
call esi
test eax, eax
je 0x1000f4ad
mov ecx, dword [str.space2200]
mov dword [edi], ecx
mov edx, dword [0x1010c34c]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x10]
mov ax, word [0x1010c350]
lea ecx, [esp + 0x14]
push ecx
push edx
push 0xa
push ebx
mov word [edi + 8], ax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1000f4c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x102204cc]
sub esp, 8
push ebx
push ebp
add eax, 0x12c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov dword [0x102204bc], eax
mov ebp, eax
test eax, eax
jle 0x1000f51b
mov edi, dword [0x10220964]
lea eax, [esp + 0x10]
push eax
push 4
push 4
push edi
mov ebx, edi
call esi
test eax, eax
jne 0x1000f50a
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x1000f51b
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
push 4
push edi
mov dword [ebx], ebp
call esi
mov edi, dword [0x1022077c]
lea eax, [esp + 0x10]
push eax
push 4
push 9
mov ebx, edi
push ebx
call esi
test eax, eax
jne 0x1000f543
lea eax, [esp + 0x10]
push eax
push 0x40
push 9
push ebx
call esi
test eax, eax
je 0x1000f56b
mov ecx, dword [str.text1600]
mov dword [edi], ecx
mov edx, dword [0x1010c358]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x10]
mov al, byte [0x1010c35c]
lea ecx, [esp + 0x14]
push ecx
push edx
push 9
push ebx
mov byte [edi + 8], al
call esi
mov edi, dword [0x102208f4]
lea eax, [esp + 0x10]
push eax
push 4
push 0xa
mov ebx, edi
push ebx
call esi
test eax, eax
jne 0x1000f593
lea eax, [esp + 0x10]
push eax
push 0x40
push 0xa
push ebx
call esi
test eax, eax
je 0x1000f5bd
mov ecx, dword [str.space1600]
mov dword [edi], ecx
mov edx, dword [0x1010c364]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x10]
mov ax, word [0x1010c368]
lea ecx, [esp + 0x14]
push ecx
push edx
push 0xa
push ebx
mov word [edi + 8], ax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1000f5d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x102204cc]
sub esp, 8
push ebx
push ebp
add eax, 0x32
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov dword [0x102204c0], eax
mov ebp, eax
test eax, eax
jle 0x1000f629
mov edi, dword [0x10220964]
lea eax, [esp + 0x10]
push eax
push 4
push 4
push edi
mov ebx, edi
call esi
test eax, eax
jne 0x1000f618
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x1000f629
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
push 4
push edi
mov dword [ebx], ebp
call esi
mov edi, dword [0x1022077c]
lea eax, [esp + 0x10]
push eax
push 4
push 8
push edi
mov ebx, edi
call esi
test eax, eax
je 0x1000f65e
mov ecx, dword [str.text800]
mov dword [ebx], ecx
mov edx, dword [0x1010c370]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
mov dword [ebx + 4], edx
push ecx
jmp 0x1000f688
lea edx, [esp + 0x10]
push edx
push 0x40
push 8
push edi
call esi
test eax, eax
je 0x1000f68d
mov eax, dword [str.text800]
mov dword [ebx], eax
mov ecx, dword [0x1010c370]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
mov dword [ebx + 4], ecx
push eax
push 8
push edi
call esi
mov edi, dword [0x102208f4]
lea ecx, [esp + 0x10]
push ecx
push 4
push 9
mov ebx, edi
push ebx
call esi
test eax, eax
jne 0x1000f6b5
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 9
push ebx
call esi
test eax, eax
je 0x1000f6dd
mov edx, dword [str.space800]
mov dword [edi], edx
mov eax, dword [0x1010c378]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x10]
mov cl, byte [0x1010c37c]
lea edx, [esp + 0x14]
push edx
push eax
push 9
push ebx
mov byte [edi + 8], cl
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1000f6f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x102204cc]
sub esp, 8
push ebx
push ebp
add eax, 0xc8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov dword [0x102204c8], eax
mov ebp, eax
test eax, eax
jle 0x1000f74b
mov edi, dword [0x10220964]
lea eax, [esp + 0x10]
push eax
push 4
push 4
push edi
mov ebx, edi
call esi
test eax, eax
jne 0x1000f73a
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x1000f74b
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
push 4
push edi
mov dword [ebx], ebp
call esi
mov edi, dword [0x1022077c]
lea eax, [esp + 0x10]
push eax
push 4
push 9
mov ebx, edi
push ebx
call esi
test eax, eax
jne 0x1000f773
lea eax, [esp + 0x10]
push eax
push 0x40
push 9
push ebx
call esi
test eax, eax
je 0x1000f79b
mov ecx, dword [str.text1200]
mov dword [edi], ecx
mov edx, dword [0x1010c384]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x10]
mov al, byte [0x1010c388]
lea ecx, [esp + 0x14]
push ecx
push edx
push 9
push ebx
mov byte [edi + 8], al
call esi
mov edi, dword [0x102208f4]
lea eax, [esp + 0x10]
push eax
push 4
push 0xa
mov ebx, edi
push ebx
call esi
test eax, eax
jne 0x1000f7c3
lea eax, [esp + 0x10]
push eax
push 0x40
push 0xa
push ebx
call esi
test eax, eax
je 0x1000f7ed
mov ecx, dword [str.space1200]
mov dword [edi], ecx
mov edx, dword [0x1010c390]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x10]
mov ax, word [0x1010c394]
lea ecx, [esp + 0x14]
push ecx
push edx
push 0xa
push ebx
mov word [edi + 8], ax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x1000f800
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [0x10220964]
lea eax, [esp + 0xc]
push eax
push 4
push 4
push edi
mov ebx, edi
call esi
test eax, eax
je 0x1000f838
mov ecx, dword [0x102204cc]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
mov dword [ebx], ecx
push eax
jmp 0x1000f85a
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x1000f85f
mov edx, dword [0x102204cc]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov dword [ebx], edx
push ecx
push 4
push edi
call esi
mov edi, dword [0x1022077c]
lea edx, [esp + 0xc]
push edx
push 4
push 0x1e
push edi
mov ebx, edi
call esi
test eax, eax
jne 0x1000f887
lea edx, [esp + 0xc]
push edx
push 0x40
push 0x1e
push edi
call esi
test eax, eax
je 0x1000f8a6
push 0x1e
push 0x10220080
push ebx
call fcn.10095e10
mov ecx, dword [esp + 0x18]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
push 0x1e
push edi
call esi
mov edi, dword [0x102208f4]
lea edx, [esp + 0xc]
push edx
push 4
push 0x1e
push edi
mov ebx, edi
call esi
test eax, eax
jne 0x1000f8ce
lea edx, [esp + 0xc]
push edx
push 0x40
push 0x1e
push edi
call esi
test eax, eax
je 0x1000f8ed
push 0x1e
push 0x10209a00
push ebx
call fcn.10095e10
mov ecx, dword [esp + 0x18]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ecx
push 0x1e
push edi
call esi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x1000fc30
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x100c8c2b
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x101252d0]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
push str.XNovaLog.txt
lea eax, [esp + 8]
push eax
call fcn.10016af0
mov ecx, dword [esp + 0xa4]
push ecx
lea edx, [esp + 8]
push edx
mov dword [esp + 0xa4], 0
call fcn.100191e0
push eax
call fcn.10002130
add esp, 0xc
push 5
push 0
push 0
push str.XNovaLog.txt
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10013d50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x10220a04]
sub esp, 0xc
cmp dword [eax], 3
jne 0x10013e03
mov ecx, dword [0x10220a10]
push ebx
mov ebx, dword [0x102208dc]
push ebp
mov ebp, dword [ecx]
add ebp, dword [esp + 0x1c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [ebx]
add edi, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
push 4
push 4
push ebx
call esi
test eax, eax
je 0x10013da3
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
mov eax, ebx
push ecx
mov dword [eax], edi
push edx
jmp 0x10013dc1
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push ebx
call esi
test eax, eax
je 0x10013dc6
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
mov ecx, ebx
push edx
mov dword [ecx], edi
push eax
push 4
push ebx
call esi
mov edi, dword [0x10220a10]
lea ecx, [esp + 0x10]
push ecx
push 4
push 4
push edi
mov ebx, edi
call esi
test eax, eax
jne 0x10013dee
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 4
push edi
call esi
test eax, eax
je 0x10013dff
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
push 4
push edi
mov dword [ebx], ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret