joyce8/EMBER2024-capa huggingface dataset:
Function at 0x931d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x931d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x931d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x931d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x931d94
push eax
push esi
call fcn.0093420b
add esp, 8
pop esi
ret 0x10

Function at 0x931da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x931e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x931e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x94a320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00933dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x931dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x931e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x931ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x931eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x94a320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00933dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x931eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x931e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x932000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x932131
push esi
call fcn.00935145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00924080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x932131
push 0
push ebp
call fcn.009243a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00924260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x93208b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.009242f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x932121
push 0x94a918
push edi
call fcn.009333f0
push eax
push ebx
push esi
call fcn.00931f60
push 0x94a8f8
push edi
call fcn.009333f0
push eax
push ebx
push esi
call fcn.00931f60
push 0x94a8d8
push edi
call fcn.009333f0
push eax
push ebx
push esi
call fcn.00931f60
push 0x94a8c0
push edi
call fcn.009333f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00931f60
push 0x94a8a0
push edi
call fcn.009333f0
push eax
push ebx
push esi
call fcn.00931f60
push 0x94a888
push edi
call fcn.009333f0
push eax
push ebx
push esi
call fcn.00931f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x9331b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00933140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00933140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00933140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00933140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x933bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x933c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x94587c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x933c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x933c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10001210
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [0x10011988]
push ebx
fstp dword [0x10197534]
push esi
fld dword [0x10011b88]
xor esi, esi
fstp dword [0x10197538]
mov dword [0x10197520], 0x10011268
fld dword [0x10011a28]
mov dword [0x10197524], esi
fstp dword [0x10197544]
mov dword [0x10197528], esi
mov dword [0x1019752c], esi
mov dword [0x10197530], esi
mov dword [0x10197548], 0x5c67f1
mov dword [0x1019754c], 0x81b95a4
mov dword [0x10197550], 0x5fbd74
mov dword [0x10197554], 0x5fa5b8
mov dword [0x10197558], 0x593085
mov dword [0x1019755c], 0x593099
mov dword [0x10197560], 0x5930a7
mov dword [0x10197564], 0x5930b5
mov dword [0x10197568], 0x5fbcdc
mov dword [0x1019756c], 0x6105dc
call fcn.10001660
lea eax, [ebp - 4]
push eax
push 0x40
push 6
mov dword [0x10197570], esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x5b2214
call esi
mov eax, 0x90909090
mov ecx, 0x5b2214
mov dword [ecx], eax
mov word [ecx + 4], ax
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 6
push 0x5b2214
call esi
push 0x10001b30
push 0x5b2280
mov bl, 0xe9
call fcn.1000ed40
add esp, 8
pop esi
mov eax, 0x10197520
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001660
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [0x10197554]
fld dword [eax]
push esi
fsub qword [0x10011a88]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [0x10197558]
fstp dword [esp + 8]
lea ecx, [esp + 8]
fld dword [esp + 8]
push ecx
fabs
push 0x40
fstp dword [esp + 0x10]
push 4
fld dword [esp + 0x14]
push edi
fstp dword [esp + 0x1c]
call esi
fld dword [esp + 0xc]
mov eax, dword [esp + 8]
fmul qword [0x100119b8]
lea edx, [esp + 8]
push edx
push eax
fadd qword [0x10011a80]
push 4
push edi
fadd qword [0x10011a78]
fstp dword [edi]
call esi
mov ecx, dword [0x10197554]
fld dword [ecx]
mov edi, dword [0x1019755c]
fsub qword [0x10011a88]
lea edx, [esp + 8]
push edx
push 0x40
fstp dword [esp + 0x14]
push 4
fld dword [esp + 0x18]
push edi
fabs
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 0x1c]
call esi
fld dword [esp + 0xc]
mov ecx, dword [esp + 8]
fmul qword [0x100119b8]
lea eax, [esp + 8]
push eax
push ecx
fadd qword [0x10011a80]
push 4
push edi
fadd qword [0x10011a78]
fstp dword [edi]
call esi
mov edx, dword [0x10197554]
fld dword [edx]
mov edi, dword [0x10197560]
fsub qword [0x10011a88]
lea eax, [esp + 8]
push eax
push 0x40
fstp dword [esp + 0x14]
push 4
fld dword [esp + 0x18]
push edi
fabs
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 0x1c]
call esi
fld dword [esp + 0xc]
lea ecx, [esp + 8]
fmul qword [0x100119b8]
fsubr qword [0x10011a70]
fsub qword [0x10011a68]
fstp dword [edi]
mov edx, dword [esp + 8]
push ecx
push edx
push 4
push edi
call esi
mov eax, dword [0x10197554]
fld dword [eax]
mov edi, dword [0x10197564]
fsub qword [0x10011a88]
lea ecx, [esp + 8]
push ecx
push 0x40
fstp dword [esp + 0x14]
push 4
fld dword [esp + 0x18]
push edi
fabs
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 0x1c]
call esi
fld dword [esp + 0xc]
mov eax, dword [esp + 8]
fmul qword [0x100119b8]
lea edx, [esp + 8]
push edx
push eax
fsubr qword [0x10011a70]
push 4
push edi
fsub qword [0x10011a68]
fstp dword [edi]
call esi
mov ecx, dword [0x10197554]
fld dword [ecx]
mov edi, dword [0x10197568]
fsub qword [0x10011a88]
lea edx, [esp + 8]
push edx
push 0x40
fstp dword [esp + 0x14]
push 4
fld dword [esp + 0x18]
push edi
fabs
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 0x1c]
call esi
fld dword [esp + 0xc]
mov ecx, dword [esp + 8]
fmul qword [0x100119b8]
lea eax, [esp + 8]
push eax
push ecx
fadd qword [0x10011a60]
push 4
push edi
fadd qword [0x10011a68]
fstp dword [edi]
call esi
mov edx, dword [0x10197554]
fld dword [edx]
mov edi, dword [0x1019756c]
fsub qword [0x10011a88]
lea eax, [esp + 8]
push eax
push 0x40
fstp dword [esp + 0x14]
push 4
fld dword [esp + 0x18]
push edi
fabs
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 0x1c]
call esi
fld dword [esp + 0xc]
fmul qword [0x100119b8]
fadd qword [0x10011a58]
mov edx, dword [esp + 8]
fadd qword [0x10011a78]
lea ecx, [esp + 8]
push ecx
push edx
fstp dword [edi]
push 4
push edi
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100018b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x10197570], 0
je 0x10001a85
fld dword [0x10197574]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
fstp dword [ebp - 8]
push edi
mov edi, dword [0x10197548]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x10197578]
mov edi, dword [0x1019754c]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1019757c]
mov edi, dword [0x10197550]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x10197580]
mov edi, dword [0x10197554]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x10197584]
mov edi, dword [0x10197558]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x10197588]
mov edi, dword [0x1019755c]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1019758c]
mov edi, dword [0x10197560]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x10197590]
mov edi, dword [0x10197564]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x10197594]
mov edi, dword [0x10197568]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x10197598]
mov edi, dword [0x1019756c]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
pop edi
pop esi
mov ecx, 3
call fcn.10002840
test eax, eax
jne 0x10001aa9
mov eax, 0x1003e958
push 1
push eax
mov eax, 0x500570
call eax
add esp, 8
mov esp, ebp
pop ebp
ret
add eax, 4
push 1
push eax
mov eax, 0x500570
call eax
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x10001b50
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10001b60
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x10001b6c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001b76
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001b80
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x10001b8a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10001b94
or eax, 4
shr ecx, 1
test cl, 1
je 0x10001b9e
or eax, 2
test cl, 2
je 0x10001ba6
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10001c60
test al, 1
je 0x10001c6d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001c60
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10001b54
pop edi
pop ebx
ret

Function at 0x10001c90
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1001126c
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10001cc2
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10001cf0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10001d53
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x10001d39
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10001d18
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10001d10
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10002e50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x38
push 0x5fbb44
call esi
push 0x38
push 0x10080274
push 0x5fbb44
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x38
push 0x5fbb44
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x38
push 0x5fbb7c
call esi
push 0x38
push 0x100802ac
push 0x5fbb7c
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x38
push 0x5fbb7c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x20
push 0x5fbb04
call esi
push 0x20
push 0x100802e4
push 0x5fbb04
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x20
push 0x5fbb04
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x20
push 0x5fbb24
call esi
push 0x20
push 0x10080304
push 0x5fbb24
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x20
push 0x5fbb24
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x30
push 0x5fbbb4
call esi
push 0x30
push 0x10080324
push 0x5fbbb4
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x30
push 0x5fbbb4
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x30
push 0x5fbbe4
call esi
push 0x30
push 0x10080354
push 0x5fbbe4
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x30
push 0x5fbbe4
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x551ab1
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x551ab1], 0x270f
mov edx, dword [ebp - 4]
push edx
push 4
push 0x551ab1
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100031e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10003170
test eax, eax
je 0x100032a1
push ebx
push esi
push 0x10003380
push 0x4830c7
mov bl, 0xe8
call fcn.1000ed40
push 0x100033c0
push 0x483108
call fcn.1000ed40
push 0x10003400
push 0x48314b
call fcn.1000ed40
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4830cc
call esi
mov bl, 0x90
lea ecx, [ebp - 4]
push ecx
mov byte [0x4830cc], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4830cc
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x48310d
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x48310d], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x48310d
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x483150
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x483150], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x483150
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003440
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x10080271], 0
je 0x100034d6
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x58e55d
call esi
fld dword [0x10011b80]
lea ecx, [ebp - 4]
fstp dword [0x58e55d]
mov edx, dword [ebp - 4]
push ecx
push edx
push 4
push 0x58e55d
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x58e57d
call esi
fld dword [0x10011b80]
lea ecx, [ebp - 4]
fstp dword [0x58e57d]
mov edx, dword [ebp - 4]
push ecx
push edx
push 4
push 0x58e57d
call esi
push 0x100034e0
push 0x58d540
mov bl, 0xe9
call fcn.1000ed40
push 0x10003920
push 0x57d040
call fcn.1000ed40
add esp, 0x10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call fcn.10003bf0
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
add esp, 4
test al, al
je 0x10003d20
xor ecx, ecx
test edi, edi
jle 0x10003d20
mov dl, byte [0x100ece1d]
mov al, dl
imul byte [0x100ece1c]
push ebx
mov bl, byte [ecx + esi]
add bl, al
xor bl, dl
mov byte [ecx + esi], bl
inc ecx
cmp ecx, edi
jl 0x10003d10
pop ebx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call dword [0x100ece20]
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x10003d40
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ecx, ecx
mov edi, 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x14], edi
lea esi, [ecx + 1]
mov eax, 0xf0f0f0f1
mul ecx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x10080110]
mov byte [ebp - 1], al
mov eax, 0xf0f0f0f1
mul esi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x10080111]
movzx edx, byte [edi + 0x100800a3]
mov byte [ebp - 3], al
mov byte [ebp - 2], dl
mov eax, 0xf0f0f0f1
mul edi
mov edi, dword [ebp - 0xc]
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x10080112]
movzx edx, byte [edi + 0x100800a3]
mov byte [ebp - 5], al
mov byte [ebp - 4], dl
mov bl, byte [esi + 0x100800a3]
mov eax, 0xf0f0f0f1
mul edi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x10080113]
movzx edx, byte [ecx + 0x100800a7]
mov byte [ebp - 6], al
mov al, byte [ebp - 1]
mov byte [ebp - 7], dl
mov dl, bl
sub bl, al
xor dl, al
movzx eax, bl
movzx edi, dl
add di, word [ebp - 0x10]
mov dl, byte [ebp - 3]
xor di, ax
mov al, byte [ebp - 2]
mov bl, al
xor bl, dl
sub al, dl
movzx ebx, bl
add di, bx
movzx edx, al
mov al, byte [ebp - 4]
xor di, dx
mov dl, byte [ebp - 5]
mov bl, al
xor bl, dl
movzx ebx, bl
sub al, dl
mov dl, byte [ebp - 6]
add di, bx
movzx eax, al
xor di, ax
mov al, byte [ebp - 7]
mov bl, dl
xor bl, al
movzx ebx, bl
add di, bx
sub al, dl
add dword [ebp - 0xc], 4
movzx edx, al
xor di, dx
movzx eax, di
mov edi, dword [ebp - 0x14]
add esi, 4
add edi, 4
add ecx, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp esi, 0x21
jb 0x10003d60
mov edx, dword [0x5fa48c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [eax - 0x3c]
mov byte [0x100ece1d], cl
lea ecx, [ebp - 0x14]
push ecx
shr eax, 8
sub al, 0x46
push 0x40
mov byte [0x100ece1c], al
mov eax, dword [0x5fa460]
push 4
push 0x5fa48c
mov dword [0x100ece24], edx
mov dword [0x100ece20], eax
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0x5fa48c], 0x10003c80
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0x5fa48c
call esi
lea ecx, [ebp - 0x14]
push ecx
push 0x40
push 4
push 0x5fa460
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0x5fa460], 0x10003ce0
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0x5fa460
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x5613c0
call esi
mov edx, 0x5613c0
mov ecx, 0x90909090
lea eax, [ebp - 4]
push eax
mov word [edx], cx
mov ecx, dword [ebp - 4]
push ecx
push 2
push edx
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 2
push 0x561369
call esi
mov ecx, 0x561369
mov eax, 0x90909090
lea edx, [ebp - 4]
push edx
mov word [ecx], ax
mov eax, dword [ebp - 4]
push eax
push 2
push ecx
call esi
push 0x10004790
push 0x561387
mov bl, 0xe8
call fcn.1000ed40
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret