joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbb94b4
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xc8102b
call fcn.00be12c8
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0xc
push 0
push esi
mov dword [ebp - 0x10], esi
mov dword [esi], 0xc83450
call fcn.00be1770
add esp, 0xc
and dword [ebp - 4], 0
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.00541376
lea ebx, [esi + 0x18]
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.00541376
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00541376
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00b1e6ae
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 4
call fcn.00b1e6ae
fld1
push ecx
push ecx
mov ecx, edi
fstp qword [esp]
mov byte [ebp - 4], 5
mov dword [esi], 0xc94c14
call fcn.0054144b
fld1
push ecx
push ecx
mov ecx, ebx
fstp qword [esp]
call fcn.0054144b
fldz
push ecx
push ecx
lea ecx, [esi + 0x24]
fstp qword [esp]
call fcn.0054144b
push 0
lea ecx, [esi + 0x30]
call fcn.006afc2f
push 0
lea ecx, [esi + 0x3c]
call fcn.006afc2f
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0xbba35f
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0xc811b1
call fcn.00be12c8
push ecx
push esi
fld1
mov esi, ecx
push ecx
push ecx
fstp qword [esp]
mov dword [ebp - 0x10], esi
call fcn.00b10179
fld1
and dword [ebp - 4], 0
push ecx
push ecx
lea ecx, [esi + 0xc]
fstp qword [esp]
call fcn.00b10179
fld1
push ecx
push ecx
lea ecx, [esi + 0x18]
fstp qword [esp]
mov byte [ebp - 4], 1
call fcn.00b10179
fld1
push ecx
push ecx
lea ecx, [esi + 0x24]
fstp qword [esp]
mov byte [ebp - 4], 2
call fcn.00b10179
push 0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004d779a
and dword [esi + 0x3c], 0
lea ecx, [esi + 0x40]
call fcn.00bb7f51
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0xbba7c6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0xc811e6
call fcn.00be12c8
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0xc94c24
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x24], 0xc94c20
push eax
mov byte [ebp - 4], 1
mov dword [esi], 0xc94c1c
call fcn.00bbad8f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1c], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0xbc5584
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
mov dword [ebp - 4], 0xc65053f2
jne 0xbc559a
lea ebx, [ebp - 4]
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0xbc55e9
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, esi
mov dword [ebp + 0x14], eax
mov cl, byte [edi + esi]
mov al, cl
mov byte [ebp + 0x10], cl
push dword [ebp + 0x10]
shl cl, 4
shr al, 4
or al, cl
mov cl, al
and cl, 0xd5
shr al, 1
shl cl, 1
and al, 0x55
or cl, al
movzx eax, byte [ebx]
xor cl, byte [eax + 0xd76dec]
push ebx
mov byte [esi], cl
call fcn.00bc5527
pop ecx
inc esi
dec dword [ebp + 0x14]
pop ecx
jne 0xbc55ae
pop edi
pop esi
pop ebx
leave
ret

Function at 0xbc55ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
test ebx, ebx
mov dword [ebp - 4], 0xc65053f2
jne 0xbc5602
lea ebx, [ebp - 4]
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0xbc5651
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, esi
mov dword [ebp + 0x14], eax
movzx eax, byte [ebx]
mov al, byte [eax + 0xd76dec]
xor al, byte [edi + esi]
mov cl, al
shr al, 1
and cl, 0xd5
and al, 0x55
shl cl, 1
or cl, al
mov al, cl
shr al, 4
shl cl, 4
or al, cl
mov byte [ebp + 0x10], al
push dword [ebp + 0x10]
mov byte [esi], al
push ebx
call fcn.00bc5527
pop ecx
inc esi
dec dword [ebp + 0x14]
pop ecx
jne 0xbc5616
pop edi
pop esi
pop ebx
leave
ret

Function at 0xbc6b3c
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0xc81aed
call fcn.00be12c8
push ecx
push esi
mov esi, ecx
lea eax, [esi + 4]
mov ecx, eax
neg ecx
lea edx, [eax - 4]
sbb ecx, ecx
and ecx, edx
push edi
mov dword [ebp - 0x10], esi
mov dword [0xd80ebc], ecx
xor edi, edi
mov dword [ebp - 4], edi
mov dword [eax], edi
push edi
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi + 8], edi
call fcn.0072be40
push edi
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 2
call fcn.0072be40
push edi
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 3
call fcn.0072be40
push edi
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 4
call fcn.0072be40
push edi
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 5
call fcn.0072be40
push edi
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 6
mov dword [esi + 0x48], edi
call fcn.004d779a
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi], 0xc94c9c
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0xbc70c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
mov ebx, ecx
call fcn.00bd366d
test eax, eax
je 0xbc70ed
push eax
lea ecx, [ebp - 8]
call fcn.00bc71f1
push 0xd36da0
lea eax, [ebp - 8]
push eax
call fcn.00be12e7
call fcn.00bd4ccb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov dword [ebx + 0x5c], eax
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x11c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x10c], 2
jne 0xbc71e2
mov al, byte [0xd80c88]
push esi
push edi
mov byte [ebp - 0x88], al
push 0x1f
xor eax, eax
pop ecx
lea edi, [ebp - 0x87]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x88]
push eax
push 0xd76fcc
call fcn.00bc6a82
pop ecx
pop ecx
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
lea eax, [ebp - 0x88]
push eax
push 0xd76fac
call fcn.00bc6a82
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
pop ecx
pop ecx
push eax
push edi
call esi
mov dword [ebx + 0x64], eax
lea eax, [ebp - 0x88]
push eax
push 0xd76f98
call fcn.00bc6a82
pop ecx
pop ecx
push eax
push edi
call esi
mov dword [ebx + 0x68], eax
lea eax, [ebp - 0x88]
push eax
push 0xd76f84
call fcn.00bc6a82
pop ecx
pop ecx
push eax
push edi
call esi
mov dword [ebx + 0x6c], eax
lea eax, [ebp - 0x88]
push eax
push 0xd76f70
call fcn.00bc6a82
pop ecx
pop ecx
push eax
push edi
call esi
mov dword [ebx + 0x70], eax
lea eax, [ebp - 0x88]
push eax
push 0xd76f5c
call fcn.00bc6a82
pop ecx
pop ecx
push eax
push edi
call esi
pop edi
mov dword [ebx + 0x74], eax
pop esi
push 1
lea ecx, [ebx + 0x18]
call fcn.006afc2f
pop ebx
leave
ret 4

Function at 0xbc73ab
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
mov ecx, 0x10501
cmp eax, ecx
push edi
mov edi, dword [sym.imp.kernel32.dll_GetTickCount]
mov ebx, 0x10001
jg 0xbc740b
cmp eax, ecx
je 0xbc7455
cmp eax, ebx
je 0xbc7404
cmp eax, 0x10102
je 0xbc7455
cmp eax, 0x10104
je 0xbc7455
cmp eax, 0x10300
jle 0xbc742e
cmp eax, 0x10303
jle 0xbc7455
cmp eax, 0x10305
jle 0xbc742e
cmp eax, 0x10308
jle 0xbc7455
jmp 0xbc742e
call edi
mov dword [esi + 0x5c], eax
jmp 0xbc742e
cmp eax, 0x10601
je 0xbc7455
cmp eax, 0x10700
jle 0xbc742e
cmp eax, 0x10706
jle 0xbc7455
cmp eax, 0x10801
je 0xbc7455
cmp eax, 0x10a01
je 0xbc7455
and dword [esi + 0x48], 0
call edi
sub eax, dword [esi + 0x5c]
cmp eax, 0xea60
jbe 0xbc746c
push ebx
lea ecx, [ebp - 8]
call fcn.00bc7471
push 0xd36f18
lea eax, [ebp - 8]
push eax
call fcn.00be12e7
push eax
lea ecx, [ebp - 8]
call fcn.00bc7471
push 0xd36f18
lea eax, [ebp - 8]
push eax
call fcn.00be12e7
pop edi
pop esi
pop ebx
leave
ret
Function at 0xbd30d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xc82320
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 4]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x10], esp
je 0xbd3116
mov ecx, dword [ebx + 8]
push 0x4000
push ecx
push eax
call dword [sym.imp.kernel32.dll_VirtualFree]
mov dword [ebx + 4], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 8], edi
mov esi, dword [ebp + 0xc]
cmp esi, edi
jle 0xbd318d
push 0x40
push 0x1000
push esi
push edi
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp eax, edi
mov dword [ebx + 4], eax
je 0xbd318d
mov ecx, esi
mov esi, dword [ebp + 8]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, edx
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebx + 4]
mov dword [ebx + 8], eax
mov dword [ebp - 4], 0
call esi
push 2
mov dword [ebx + 0xc], eax
mov dword [ebp - 4], 2
call esi
mov dword [ebx + 0x10], eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0xbd32e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
cmp dword [ebp + 8], 0
jne 0xbd32fa
xor eax, eax
jmp 0xbd33c3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
cmp dword [eax], 0x4550
je 0xbd331e
xor eax, eax
jmp 0xbd33c3
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x78]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0xbd33c1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
add edx, dword [ecx + 0x24]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
jmp 0xbd3376
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x18]
jae 0xbd33c1
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor esi, esi
mov si, word [ecx + eax*2]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x10]
add ecx, esi
cmp edx, ecx
jne 0xbd33bf
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + edx*2]
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c]
jmp 0xbd33c3
jmp 0xbd336d
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xbd4579
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xc95600
push 0xbe2b14
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0xbd45e6
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0xbd4694
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x2c]
push edx
push 8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
jmp 0xbd462c
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.version.dll_GetFileVersionInfoA
cmp eax, 1
je 0xbd4651
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0xbd4694
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0xd77b94
mov ecx, dword [ebp - 0x20]
push ecx
call sub.version.dll_VerQueryValueA
cmp eax, 1
je 0xbd4677
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0xbd4694
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc]
mov dword [edx], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00bd46a2
jmp 0xbd46bc
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xbd51bf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push edi
mov dword [ebp - 4], 0
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x20c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x314], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x210], 0
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
jne 0xbd5247
mov dword [ebp - 4], 0x30000304
jmp 0xbd53b8
push 1
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x108]
push edx
push str.l_Kc_Ia_h8__..
call fcn.00bdabf9
cmp eax, 1
je 0xbd5272
mov dword [ebp - 4], 0x30000305
jmp 0xbd53b6
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0xd77bb0
push 0x104
lea edx, [ebp - 0x314]
push edx
call fcn.00bd8b10
add esp, 0x14
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [0xd8c684], eax
cmp dword [0xd8c684], 0
jne 0xbd52c0
mov dword [ebp - 4], 0x30000301
jmp 0xbd53b4
push 1
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x108]
push edx
push str.l_K_Lblu1_..
call fcn.00bdabf9
cmp eax, 1
je 0xbd52eb
mov dword [ebp - 4], 0x30000305
jmp 0xbd53b2
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [0xd8c684]
push ecx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0xd8c674], eax
cmp dword [0xd8c674], 0
jne 0xbd5319
mov dword [ebp - 4], 0x30000302
jmp 0xbd53b0
push 1
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x108]
push eax
push str.l_K__DL_lK_o_1:.
call fcn.00bdabf9
cmp eax, 1
je 0xbd5341
mov dword [ebp - 4], 0x30000305
jmp 0xbd53ae
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [0xd8c684]
push edx
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0xd8c67c], eax
cmp dword [0xd8c67c], 0
jne 0xbd536c
mov dword [ebp - 4], 0x30000302
jmp 0xbd53ac
push 0
push 0xbd53bf
mov eax, dword [0xd8c674]
push eax
call fcn.00bd9ee6
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0xbd5389
jmp 0xbd53aa
cmp dword [ebp - 4], 0
je 0xbd53a5
cmp dword [0xd8c684], 0
je 0xbd53a5
mov ecx, dword [0xd8c684]
push ecx
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
jmp 0xbd53ba
jmp 0xbd5389
jmp 0xbd5389
jmp 0xbd5389
jmp 0xbd5389
jmp 0xbd5389
jmp 0xbd5389
jmp 0xbd5389
jmp 0xbd5389
pop edi
mov esp, ebp
pop ebp
ret
Function at 0xbd5b58
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push 0x94
push 0
lea eax, [ebp - 0x94]
push eax
call fcn.00be1770
add esp, 0xc
mov dword [ebp - 0x94], 0x94
lea ecx, [ebp - 0x94]
push ecx
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
jne 0xbd5b9e
mov dword [ebp - 0x98], 0
jmp 0xbd5bf2
cmp dword [ebp - 0x84], 1
jne 0xbd5bae
mov eax, 1
jmp 0xbd5bf8
cmp dword [ebp - 0x84], 2
jne 0xbd5bf2
cmp dword [ebp - 0x90], 5
jne 0xbd5bd0
cmp dword [ebp - 0x8c], 0
jne 0xbd5bd0
mov eax, 2
jmp 0xbd5bf8
cmp dword [ebp - 0x90], 5
jne 0xbd5be2
cmp dword [ebp - 0x8c], 1
jae 0xbd5beb
cmp dword [ebp - 0x90], 6
jb 0xbd5bf2
mov eax, 3
jmp 0xbd5bf8
mov eax, dword [ebp - 0x98]
mov esp, ebp
pop ebp
ret
Function at 0xbd9e00
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
je 0xbd9e12
cmp dword [ebp + 0xc], 0
jne 0xbd9e16
xor eax, eax
jmp 0xbd9e77
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0xbd9e44
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 8], ecx
jae 0xbd9e75
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, dword [edx + 0xc]
jb 0xbd9e73
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 8]
cmp dword [ebp + 8], edx
jae 0xbd9e73
mov eax, dword [ebp - 4]
jmp 0xbd9e77
jmp 0xbd9e32
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0xbda3b9
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
je 0xbda3e0
cmp dword [ebp + 0xc], 0
jne 0xbda3ef
push 0x57
call dword [sym.imp.kernel32.dll_SetLastError]
xor eax, eax
jmp 0xbda4b5
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
and ecx, 0xfffff000
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x10]
push eax
push 0x40
push 0x1000
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.kernel32.dll_VirtualProtect]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0xbda430
mov eax, dword [ebp - 4]
jmp 0xbda4b5
mov dword [ebp - 0x18], 0
jmp 0xbda442
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x400
jae 0xbda496
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + eax*4]
xor edx, dword [ebp + 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + eax*4]
cmp edx, dword [ebp - 0xc]
je 0xbda494
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx*4]
push eax
call dword [sym.imp.kernel32.dll_InterlockedExchange]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
xor edx, edx
test edx, edx
je 0xbda494
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
jmp 0xbda439
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x1000
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
mov dword [ebp - 4], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10

Function at 0xbdb190
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xc95750
push 0xbe2b14
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0xbdb1e0
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
jmp 0xbdb209
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xbdb21f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xc95760
push 0xbe2b14
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0xbdb28a
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0xbdb2d0
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0xbdb2aa
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0xbdb2d0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 0x20], 0xffffffff
cmp dword [ebp - 0x24], 0x1f4000
jbe 0xbdb2d0
mov eax, dword [ebp + 8]
push eax
call fcn.00bdb190
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
jmp 0xbdb2f9
cmp dword [ebp - 0x20], 0xffffffff
je 0xbdb310
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0xbdb3ff
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xc95780
push 0xbe2b14
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffdc4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 4], 0
push 0xd8cddc
call fcn.00be1c90
add esp, 4
test eax, eax
jne 0xbdb453
jmp 0xbdb5ee
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push 0xd8cddc
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0xbdb487
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0xbdb5ee
mov dword [ebp - 0x244], 0
push 2
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xffffffff
jne 0xbdb4be
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0xbdb5ee
mov word [ebp - 0x23c], 0
xor ecx, ecx
mov dword [ebp - 0x23a], ecx
mov dword [ebp - 0x236], ecx
mov dword [ebp - 0x232], ecx
mov word [ebp - 0x22e], cx
lea edx, [ebp - 0x23c]
push edx
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov byte [ebp - 0x228], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x227]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x22e]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x230]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x232]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x234]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x236]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x23a]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x23c]
and ecx, 0xffff
push ecx
push str.__5d__2d__2d____2d:_2d:_2d:_3d___s__r_n
push 0x208
lea edx, [ebp - 0x228]
push edx
call fcn.00bd4da0
add esp, 0x2c
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x248], 0
lea eax, [ebp - 0x228]
push eax
call fcn.00be1c90
add esp, 4
mov dword [ebp - 0x240], eax
push 0
lea ecx, [ebp - 0x22c]
push ecx
mov edx, dword [ebp - 0x240]
push edx
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.kernel32.dll_WriteFile]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0xbdb5e5
mov edx, dword [ebp - 0x240]
cmp edx, dword [ebp - 0x22c]
je 0xbdb5ee
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
jmp 0xbdb61d
cmp dword [ebp - 0x20], 0xffffffff
je 0xbdb634
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4