joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413bc0
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x4142b0
call fcn.00413ef8
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x416688
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x4139e8
cmp eax, esi
jne 0x4139db
xor esi, esi
inc esi
mov edi, esi
jmp 0x4139eb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4139bf
xor esi, esi
inc esi
cmp dword [0x41668c], esi
jne 0x4139fd
push 0x1f
call fcn.004a7000
pop ecx
jmp 0x413a37
cmp dword [0x41668c], ebx
jne 0x413a31
mov dword [0x41668c], esi
push 0x4010cc
push 0x4010c0
call fcn.00413b1c
pop ecx
pop ecx
test eax, eax
je 0x413a37
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x413b0c
mov dword [0x415894], esi
cmp dword [0x41668c], esi
jne 0x413a5a
push 0x4010bc
push 0x4010b4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x41668c], 2
test edi, edi
jne 0x413a67
xor eax, eax
mov ecx, 0x416688
xchg dword [ecx], eax
cmp dword [0x416690], 0
je 0x413a93
push 0x416690
call fcn.00413d50
pop ecx
test eax, eax
je 0x413a93
push ebx
push 2
push ebx
mov esi, dword [0x416690]
mov ecx, esi
call dword [0x4171a0]
call esi
push dword [0x4158a0]
push dword [0x41589c]
push dword [0x415898]
call fcn.0040fe42
add esp, 0xc
mov dword [0x415890], eax
cmp dword [0x4158a8], 0
jne 0x413af1
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x415894], 0
jne 0x413b05
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x415890]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.00413e45
jmp 0x4139a3

Function at 0x413c34
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4142d0
call fcn.00413ef8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x413c94
cmp eax, 0xffffffff
je 0x413c94
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x413c8d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x413c8d
cmp edx, 0x10000000
jae 0x413c8d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x413c8a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x413d00
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x413d3e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x413d36
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x413d40
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x413d26
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xb461b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00b46140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00b46140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00b46140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00b46140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xb46bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xb46c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xb5887c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xb46c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xb46c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x7c4714
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7c471e
pushal
call 0x7c4724
pop ebp
sub ebp, 0x10
sub ebp, 0x3c4714
jmp 0x7c473a
mov eax, 0x3c4714
add eax, ebp
add eax, 0x4c
mov ecx, 0x5be
mov edx, 0x45d4390f
xor byte [eax], dl
inc eax
dec ecx
jne 0x7c4751
jmp 0x7c4764
test dl, al
test byte [esi + 0xf0f0f33], al
mov cs, esi
test dword [edi], 0xc20c0f0f
mov bh, 0xb
invalid
Function at 0x100030a7
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1005047a
call fcn.1004f148
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], edi
push 0x48
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.1001e98c
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 4], eax
lea ecx, [edi + 0x10]
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
and dword [ebp - 0x10], ebx
push eax
call fcn.100056c2
mov byte [ebp - 4], 1
lea esi, [edi + 0x30]
mov dword [ebp - 0x10], esi
and dword [esi], ebx
push 0x1c
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.1001e98c
pop ecx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 4], eax
lea ecx, [esi + 0xc]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov byte [ebp - 4], 3
mov dword [esi + 0x18], 7
mov dword [esi + 0x1c], 8
mov dword [esi], 0x3f800000
push dword [esi + 4]
push 0x10
call fcn.1000581b
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 4
push ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ecx
and dword [ebp - 0x10], ebx
push eax
call fcn.100053be
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.100031aa
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x100032c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x100032de
mov edx, dword [edi + 0xc]
lea eax, [edx + 1]
mov dword [edi + 0xc], eax
mov dword [ecx + 4], edx
xor ecx, ecx
mov dword [ebp + 0xc], edx
mov ebx, 0x811c9dc5
mov esi, ecx
movzx eax, byte [ebp + esi + 0xc]
xor eax, ebx
imul ebx, eax, 0x1000193
inc esi
cmp esi, 4
jb 0x100032ea
mov esi, dword [edi + 0x28]
and esi, ebx
mov ebx, dword [edi + 0x1c]
mov eax, dword [ebx + esi*8 + 4]
cmp eax, dword [edi + 0x14]
je 0x10003321
mov esi, dword [ebx + esi*8]
jmp 0x1000331a
cmp eax, esi
je 0x10003321
mov eax, dword [eax + 4]
cmp edx, dword [eax + 8]
jne 0x10003313
jmp 0x10003323
mov eax, ecx
test eax, eax
cmove eax, dword [edi + 0x14]
cmp eax, dword [edi + 0x14]
pop edi
pop esi
pop ebx
je 0x1000333b
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov cl, 1
mov al, cl
pop ebp
ret 8

Function at 0x100068f8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov ebx, ecx
push eax
push 0x40
push 5
mov ebp, dword [ebx]
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x10]
call fcn.10008100
mov esi, dword [ebx + 0xc]
mov edi, eax
sub esi, dword [ebx + 8]
push esi
push dword [ebx + 8]
push dword [ebx]
call fcn.10020160
push edi
push 5
pop edx
mov ecx, ebp
call fcn.10007a9a
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10006941
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
mov esi, ecx
push eax
push 0x40
push 5
mov edi, dword [esi]
pop ebp
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x10]
call fcn.10008100
mov ecx, dword [esi + 0x14]
mov ebx, eax
mov byte [esp + 0x14], 0xe9
lea eax, [esp + 0x14]
push ebp
push eax
mov ecx, dword [ecx + 0x1c]
sub ecx, dword [esi]
push dword [esi]
sub ecx, ebp
mov dword [esp + 0x21], ecx
call fcn.10020160
mov ecx, dword [esi + 0xc]
add esp, 0xc
sub ecx, dword [esi + 8]
cmp ecx, ebp
jbe 0x100069ae
mov eax, dword [esi]
lea esi, [eax + 5]
sub eax, esi
add eax, ecx
push eax
push 0x90
push esi
call fcn.100206f0
add esp, 0xc
push ebx
mov edx, ebp
mov ecx, edi
call fcn.10007a9a
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x100098c8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
lea eax, [esp + 0x14]
push esi
mov esi, ecx
push eax
push 0x202
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, eax
test ecx, ecx
jne 0x10009928
mov eax, dword [esp + 0x18]
cmp al, 2
jne 0x10009909
shr eax, 8
cmp al, 2
jne 0x10009909
mov byte [esi], 1
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Invalid_WinSock_version
lea ecx, [esp + 8]
call fcn.10009789
push 0x1006a388
lea eax, [esp + 8]
jmp 0x10009946
push str.WSAStartup_failed
call fcn.100098ac
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.100021d6
push 0x1006a334
lea eax, [esp + 8]
push eax
call fcn.100200f2
int3

Function at 0x100099db
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push esi
mov esi, ecx
mov cl, byte [ebp + 8]
push 6
push 1
call fcn.1000995f
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x10009a56
lea ecx, [esp + 8]
mov dword [esp + 8], 1
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x10009a4d
mov ecx, esi
call fcn.10009d8f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.Failed_to_get_socket_flags
mov ecx, eax
call fcn.100098ac
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.100021d6
push 0x1006a334
lea eax, [esp + 0x10]
jmp 0x10009a7b
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
call sub.WS2_32.dll_WSAGetLastError
push str.Failed_to_create_socket
mov ecx, eax
call fcn.100098ac
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.100021d6
push 0x1006a334
lea eax, [esp + 0x10]
push eax
call fcn.100200f2
int3
Function at 0x10009a90
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
push edi
push dword [ebp + 0xc]
mov edi, ecx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10009ad2
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x10009ada
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10009ab6
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
call esi
cmp eax, 0x2733
jne 0x10009b45
push dword [ebp + 0x14]
mov ecx, edi
push dword [ebp + 0x10]
push 1
call fcn.10009c74
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 4
push eax
lea eax, [esp + 0x10]
push eax
push 0x1007
push 0xffff
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x10009b69
cmp dword [esp + 0xc], 0
je 0x10009ad2
push str.Failed_to_connect
call fcn.100098ac
push eax
push dword [esp + 0x14]
lea ecx, [esp + 0x20]
call fcn.100021d6
push 0x1006a334
lea eax, [esp + 0x18]
jmp 0x10009b8b
call esi
push str.Failed_to_connect
mov ecx, eax
call fcn.100098ac
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.100021d6
push 0x1006a334
lea eax, [esp + 0x18]
jmp 0x10009b8b
call esi
push str.Failed_to_get_socket_option
mov ecx, eax
call fcn.100098ac
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.100021d6
push 0x1006a334
lea eax, [esp + 0x18]
push eax
call fcn.100200f2
int3

Function at 0x10009c74
Capabilities:
Get socket status

Disassembly:
sub esp, 0x128
mov eax, dword [ecx]
push ebx
push ebp
mov ebp, dword [esp + 0x13c]
push esi
push edi
mov edi, dword [esp + 0x140]
xor esi, esi
push esi
push 0x3e8
push ebp
push edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], 1
call fcn.1004ecb0
mov dword [esp + 0x10], eax
imul eax, ecx, 0x3e8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x14], eax
cmp ebp, esi
jl 0x10009ccf
jg 0x10009cc9
cmp edi, esi
jb 0x10009ccf
lea eax, [esp + 0x10]
jmp 0x10009cd1
mov eax, esi
xor ecx, ecx
lea ebx, [esp + 0x30]
cmp dword [esp + 0x13c], 1
push eax
cmovne ebx, ecx
lea ecx, [esp + 0x34]
xor edx, edx
cmp dword [esp + 0x140], edx
push esi
cmovne ecx, edx
push ebx
push ecx
push esi
mov dword [esp + 0x2c], ecx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x10009d3c
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2714
jne 0x10009d66
test ebp, ebp
jl 0x10009d25
jg 0x10009d1f
test edi, edi
jb 0x10009d25
lea eax, [esp + 0x10]
jmp 0x10009d27
xor eax, eax
push eax
push 0
push ebx
push dword [esp + 0x24]
push 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x10009d0c
test eax, eax
je 0x10009d4d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x128
ret 0xc
push str.Request_timed_out
lea ecx, [esp + 0x20]
call fcn.10009d98
push 0x1006a4ac
lea eax, [esp + 0x20]
jmp 0x10009d88
call esi
push str.Failed_to_select_socket
mov ecx, eax
call fcn.100098ac
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.100021d6
push 0x1006a334
lea eax, [esp + 0x20]
push eax
call fcn.100200f2
int3
Function at 0x1000fe95
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x10], ecx
push edi
test esi, esi
jg 0x1000febe
jl 0x1000feb5
test ebx, ebx
jne 0x1000febe
xor eax, eax
xor edx, edx
jmp 0x1000ff88
cmp dword [ecx + 0x38], 0
je 0x1000fed3
push esi
push ebx
push dword [ebp + 8]
call fcn.10010a36
jmp 0x1000ff88
mov eax, dword [ecx + 0x1c]
mov edi, ebx
mov edx, dword [eax]
test edx, edx
je 0x1000ff18
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x1000ff18
cmp dword [eax], ebx
mov esi, ebx
mov edi, dword [ebp + 8]
cmovb esi, dword [eax]
push esi
push edx
push edi
call fcn.10020160
mov ecx, dword [esp + 0x20]
add edi, esi
mov dword [esp + 0x1c], edi
add esp, 0xc
mov edi, ebx
sub edi, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
jmp 0x1000ff1f
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
cmp dword [ecx + 0x4c], 0
je 0x1000ff7f
call fcn.10011315
mov ecx, dword [esp + 0x10]
mov edx, edi
cmp edi, 0xfff
jbe 0x1000ff66
mov eax, dword [esp + 0x14]
push dword [eax + 0x4c]
push 0xfff
push 1
push ecx
call fcn.10034666
mov ecx, dword [esp + 0x20]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [esp + 0x10], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x1000ff7f
jmp 0x1000ff30
test edx, edx
je 0x1000ff7f
mov eax, dword [esp + 0x14]
push dword [eax + 0x4c]
push edi
push 1
push ecx
call fcn.10034666
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011c4d
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x1005131b
call fcn.1004f148
sub esp, 0x54
mov edx, ecx
xor eax, eax
mov dword [ebp - 0x18], edx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
movaps xmm0, xmmword [0x10064150]
push ebx
push esi
push edi
mov edi, edx
movups xmmword [ebp - 0x60], xmm0
movaps xmm0, xmmword [0x10064160]
stosd dword es:[edi], eax
movups xmmword [ebp - 0x50], xmm0
movaps xmm0, xmmword [0x10064170]
stosd dword es:[edi], eax
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [str.wxyz0123456789_]
stosd dword es:[edi], eax
movups xmmword [ebp - 0x30], xmm0
stosd dword es:[edi], eax
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], 0xf
mov byte [edx], cl
mov dword [ebp - 4], ecx
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 1
cmp esi, eax
je 0x10011dd3
mov cl, byte [esi]
mov byte [ebp + edi - 0x14], cl
inc edi
mov bl, byte [ebp - 0x13]
mov bh, byte [ebp - 0x14]
mov byte [ebp - 0xd], bl
cmp edi, 3
jne 0x10011d47
movzx eax, bh
mov ecx, edx
shr eax, 2
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.1001183e
mov edi, dword [ebp - 0x18]
mov cl, bh
and cl, 3
mov al, bl
shr al, 4
shl cl, 4
add cl, al
movzx eax, cl
mov ecx, edi
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.1001183e
mov al, byte [ebp - 0x12]
mov cl, bl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
movzx eax, cl
mov ecx, edi
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.1001183e
movzx eax, byte [ebp - 0x12]
mov ecx, edi
and eax, 0x3f
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.1001183e
mov eax, dword [ebp + 0xc]
xor edi, edi
mov edx, dword [ebp - 0x18]
inc esi
cmp esi, eax
jne 0x10011cc1
test edi, edi
je 0x10011dd3
movzx eax, bh
mov ecx, edx
shr eax, 2
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.1001183e
mov esi, dword [ebp - 0x18]
and bh, 3
mov ecx, esi
cmp edi, 1
jne 0x10011d8b
shl bh, 4
movzx eax, bh
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.1001183e
push 4
inc edi
pop ebx
jmp 0x10011dc1
mov al, bl
shl bh, 4
shr al, 4
add bh, al
movzx eax, bh
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.1001183e
and bl, 0xf
mov ecx, esi
shl bl, 2
movzx eax, bl
movzx eax, byte [ebp + eax - 0x60]
push eax
call fcn.1001183e
push 4
inc edi
pop ebx
cmp edi, ebx
jae 0x10011dd6
sub ebx, edi
push 0x3d
mov ecx, esi
call fcn.1001183e
sub ebx, 1
jne 0x10011dc3
jmp 0x10011dd6
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1001cd68
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1006c048]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 4
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001ce48
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1001ce41
push ebx
cmp dword [ebp - 0x20], 0x10
jb 0x1001ce26
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1001ce26
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1001ce26
mov edx, dword [esi]
test edx, edx
jne 0x1001cdf4
push 0x200
push edx
push dword [0x100714ac]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1001ce40
lea ebx, [esi + 8]
jmp 0x1001ce1c
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x1001ce1c
shl eax, 3
push eax
push edx
push 0
push dword [0x100714ac]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1001ce40
shl dword [esi + 4], 1
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1001cdac
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001f1ae
leave
ret

Function at 0x1001ce56
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.1001cd68
cmp dword [esi], ebx
je 0x1001ceb6
push edi
mov edi, ebx
cmp dword [esi + 8], ebx
jbe 0x1001ceb5
mov eax, dword [esi]
push dword [eax + edi*4]
push ebx
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1001ceac
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.1001cc15
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
push 0
pop ebx
cmp edi, dword [esi + 8]
jb 0x1001ce7c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001ceba
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x1001cf06
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1001cef5
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1001ceee
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1001cecb
pop ebx
push dword [esi]
push 0
push dword [0x100714ac]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret
Function at 0x1001cf08
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
imul edi, ecx, 0x2c
add edi, dword [0x1007b440]
mov al, byte [edi + 0x14]
mov esi, dword [edi]
and al, 1
je 0x1001cf24
sub esi, 5
movzx eax, al
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1001cf45
push 0xa
pop eax
jmp 0x1001cf84
mov byte [esi], 0xe9
mov eax, dword [edi + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [edi + 0x14], 1
je 0x1001cf60
mov eax, dword [edi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [edi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001d42d
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x1007b430]
push esi
xor esi, esi
jmp 0x1001d43f
cmp dword [edx + 4], esi
jne 0x1001d493
mov edx, dword [edx]
test edx, edx
jne 0x1001d438
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x1001d48f
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x1001d466
mov eax, dword [0x1007b430]
mov dword [edx], eax
mov dword [0x1007b430], edx
pop edi
test edx, edx
jne 0x1001d493
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret

Function at 0x1001dfc3
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1001df9f
pop esi
leave
ret 8

Function at 0x1003f018
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003ef9a

Function at 0x1003f811
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10058200
push 0x100581f8
push str.FlsAlloc
push 0x1e
call fcn.1003f5fe
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003f845
push dword [ebp + 8]
mov ecx, esi
call dword [0x100531f0]
call esi
jmp 0x1003f84b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x1003f88f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10058210
push 0x10058208
push str.FlsGetValue
push 0x20
call fcn.1003f5fe
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003f8c6
push dword [ebp + 8]
mov ecx, esi
call dword [0x100531f0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]