joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10089920
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, 4
mov ebx, 0x7e7827
call fcn.100b6570
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10088660
push 5
sub eax, 0x7e782c
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x10089984
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x1008998a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xa
mov ebx, 0x5f479e
call fcn.100b6570
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x100890b0
push 5
sub ecx, 0x5f47a3
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x100899e0
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x100899e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1008e2a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x103a659c]
test eax, eax
je 0x1008e313
mov ecx, dword [eax]
cmp ecx, dword [0x103a65b0]
jne 0x1008e2bf
mov dl, byte [0x103a65b4]
cmp dl, byte [eax + 4]
je 0x1008e313
push 0x100
push 0
push 0x103e4c78
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x1008e2e0
mov cl, byte [eax + 0x100c6a30]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x103e4c78], cl
inc eax
cmp eax, 0x100
jb 0x1008e2e0
push 0x103e4c78
push 0
mov ecx, 0x1027c400
call fcn.10090540
add esp, 8
call fcn.100b6650
mov eax, dword [0x103a6598]
test eax, eax
je 0x1008e350
mov edx, dword [eax]
cmp edx, dword [0x103a65a8]
jne 0x1008e331
mov cl, byte [0x103a65ac]
cmp cl, byte [eax + 4]
je 0x1008e350
mov eax, 0x10
call fcn.100b6dc0
push eax
push 0
mov ecx, 0x1027c400
call fcn.10090540
add esp, 8
call fcn.100b6650
mov eax, dword [0x103a6594]
test eax, eax
je 0x1008e375
mov edx, dword [eax]
cmp edx, dword [0x103a65a0]
jne 0x1008e36e
mov cl, byte [0x103a65a4]
cmp cl, byte [eax + 4]
je 0x1008e375
mov eax, 0x11
jmp 0x1008e336
pop ecx
ret
Function at 0x10090010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [0x1027c3b4]
mov dword [ebp - 0x48], eax
xor al, al
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x25], al
cmp edi, dword [0x1027c3b8]
je 0x1009012e
mov ebx, dword [ebp - 0x38]
mov ecx, 4
lea edx, [ebp - 0x24]
sub ecx, edx
mov dword [ebp - 0x44], ecx
cmp byte [edi], 0
jne 0x100900ff
test al, al
jne 0x10090085
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x38]
push eax
push ecx
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x30]
lea ebx, [ebp - 0x2c]
call fcn.10090190
test al, al
je 0x1009012e
mov ebx, dword [ebp - 0x38]
mov byte [ebp - 0x25], 1
mov esi, dword [edi + 4]
mov eax, dword [ebx + 0x34]
mov edx, esi
sub edx, eax
push edx
push eax
push ebx
call dword [sym.imp.dbghelp.dll_ImageRvaToSection]
test eax, eax
je 0x100900fc
mov ecx, dword [eax + 0x14]
sub ecx, dword [eax + 0xc]
push 0
sub ecx, dword [ebx + 0x34]
push 0
add ecx, esi
mov esi, dword [ebp - 0x2c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x100900fc
push 0
lea edx, [ebp - 0x3c]
push edx
push 0x20
lea eax, [ebp - 0x24]
push eax
push esi
mov dword [ebp - 0x3c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100900fc
mov edx, dword [ebp - 0x44]
mov ecx, 0x20
lea eax, [ebp - 0x24]
lea edx, [edx + edi + 4]
cmp ecx, 4
jb 0x10090143
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x100900fc
sub ecx, 4
add eax, 4
jmp 0x100900e8
mov al, byte [ebp - 0x25]
add edi, 0x48
cmp edi, dword [0x1027c3b8]
jne 0x10090053
test al, al
je 0x1009012e
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x2c]
push edx
call esi
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x34]
lea esi, [edi + 0x28]
mov edi, dword [ebp - 0x40]
mov ecx, 8
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0x2c]
push edx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 4
Function at 0x10090190
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0
push 0
push 3
push 0
push 1
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp + 0xc]
push closesocket
push eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100901e3
lea edx, [ebp - 0x38]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x100901f6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
push edi
push 0
push eax
push ecx
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
jne 0x1009022d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x14]
push edx
push 0
push 0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x1009026b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10090264
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10090264
mov edx, 0x14c
cmp word [ecx + 4], dx
je 0x1009028b
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp - 0x44]
mov dword [ebx], esi
mov dword [edx], edi
mov edx, dword [ebp - 0x3c]
mov dword [edx], eax
mov eax, dword [ebp - 0x40]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 8
Function at 0x10090420
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1027c618]
push ebx
push esi
push edi
test eax, eax
js 0x1009052d
cmp eax, 1
jge 0x1009052d
mov esi, eax
imul esi, esi, 0x214
add esi, 0x1027c404
push str.DataLogs
inc eax
lea ebx, [esi + 4]
push 0x100
mov dword [0x1027c618], eax
push ebx
mov dword [esi], 1
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
cmp dword [esi], 0
je 0x1009052d
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
movzx ecx, word [ebp - 0x12]
movzx edx, word [ebp - 0x14]
push eax
push ecx
push edx
push ebx
lea edi, [esi + 0x110]
push str.._s_04d__02d__02d.log
push edi
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
mov dword [esi + 0x10c], edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x10090508
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1009052d
mov ecx, dword [esi + 0x210]
push ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
Function at 0x10090540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
js 0x10090737
cmp eax, dword [ecx + 0x218]
jge 0x10090737
imul eax, eax, 0x214
cmp dword [eax + ecx + 4], 0
lea esi, [eax + ecx + 4]
je 0x10090737
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x812]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
cmp ecx, dword [esi + 0x104]
jne 0x100905c6
movzx edx, word [ebp - 0x816]
cmp edx, dword [esi + 0x108]
jne 0x100905c6
movzx eax, word [ebp - 0x818]
cmp eax, dword [esi + 0x10c]
je 0x10090683
mov ecx, dword [esi + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, word [ebp - 0x812]
movzx ecx, word [ebp - 0x816]
movzx edx, word [ebp - 0x818]
push eax
push ecx
push edx
mov dword [esi + 0x10c], edx
lea edx, [esi + 4]
push edx
lea edi, [esi + 0x110]
push str.._s_04d__02d__02d.log
push edi
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
call ebx
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x1009064d
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x10090683
mov eax, dword [esi + 0x210]
push eax
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
push 0x3ff
lea ecx, [ebp - 0x807]
push 0
push ecx
mov byte [ebp - 0x808], 0
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
lea ecx, [ebp - 0x808]
push 0x400
push ecx
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
push 0x3ff
lea edx, [ebp - 0x407]
push 0
push edx
mov byte [ebp - 0x408], 0
call sub.MSVCR100.dll_memset
movzx ecx, word [ebp - 0x80c]
movzx edx, word [ebp - 0x80e]
lea eax, [ebp - 0x808]
push eax
movzx eax, word [ebp - 0x810]
push ecx
push edx
push eax
lea ecx, [ebp - 0x408]
push str._02d:_02d:_02d__s_r_n
push ecx
call ebx
lea eax, [ebp - 0x408]
add esp, 0x40
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10090710
mov ecx, dword [esi + 0x210]
sub eax, edx
push 0
lea edx, [ebp - 0x81c]
push edx
push eax
lea eax, [ebp - 0x408]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
Function at 0x10090b20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x40c98c
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x40c98c], 2
mov edx, dword [ebp - 4]
push edx
push 4
push 0x40c98c
call esi
push 0x10090a80
push 0x4d7602
mov bl, 0xe8
call fcn.100b6700
push 0x100908a0
push 0x40b331
call fcn.100b6700
push 0x10090780
push 0x40ada2
call fcn.100b6700
push 0x10090830
push 0x40b2e2
call fcn.100b6700
push 0x100909b0
push 0x40c3af
call fcn.100b6700
push 0x100909b0
push 0x40c40b
call fcn.100b6700
push 0x100909b0
push 0x40c45f
call fcn.100b6700
push 0x10090970
push 0x40b422
call fcn.100b6700
add esp, 0x40
push 0x10090970
push 0x40b47c
call fcn.100b6700
push 0x100908d0
push 0x40b3f1
call fcn.100b6700
push 0x10090950
push 0x40b515
call fcn.100b6700
push 0x10090a60
push 0x40ab50
call fcn.100b6700
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10090cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREWebzenMuConfig
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10090d33
lea ecx, [ebp - 8]
push ecx
push 0x1027c644
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 4]
push str.LangSelection
push eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10090d29
push 0x100ca4ec
push 0x10
push 0x1027c644
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x10091020
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x64
push 0
push 0x103a66c8
call sub.MSVCR100.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x63e7e4
call esi
mov edx, 0x63e7e4
mov ecx, 0x90909090
lea eax, [ebp - 4]
push eax
mov word [edx], cx
mov ecx, dword [ebp - 4]
push ecx
push 2
push edx
call esi
push 0x100910c0
push 0x62eb26
or bl, 0xff
call fcn.100b6700
push 0x100910d0
push 0x888d5f
mov bl, 0xe8
call fcn.100b6700
push 0x10091150
push 0x886cd7
or bl, 0xff
call fcn.100b6700
push 0x10091150
push 0x7d3cbd
or bl, 0xff
call fcn.100b6700
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10092430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10092050
push 5
sub eax, 0x55a2e2
push 0x55a2dd
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x10092495
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x55a2dd
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x55a2dd
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x1009249b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x559b85
call esi
mov bl, 0xff
lea edx, [ebp - 4]
push edx
mov byte [0x559b85], bl
mov eax, dword [ebp - 4]
push eax
push 1
push 0x559b85
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push 0x559b86
call esi
lea edx, [ebp - 4]
push edx
mov byte [0x559b86], bl
mov eax, dword [ebp - 4]
push eax
push 1
push 0x559b86
call esi
push 0x10092640
push 0x58103a
mov bl, 0xe8
call fcn.100b6700
push 0x10092800
push 0x58105b
call fcn.100b6700
push 0x100928a0
push 0x58101a
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x58109c
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x5810dd
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x58111e
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x58115f
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x5811a0
or bl, 0xff
call fcn.100b6700
add esp, 0x40
push 0x100928a0
push 0x5811e1
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x581222
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x581263
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x5812a8
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x5812ed
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x58132e
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x58136f
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x5813b4
or bl, 0xff
call fcn.100b6700
add esp, 0x40
push 0x100928a0
push 0x5813f9
or bl, 0xff
call fcn.100b6700
push 0x100928a0
push 0x586859
or bl, 0xff
call fcn.100b6700
add esp, 0x10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10093ef0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x100932c0
push 0x900de9
mov bl, 0xe8
call fcn.100b6700
push 0x10092bf0
push 0x8c5bb5
call fcn.100b6700
add esp, 0x10
mov esi, 0xa
mov ebx, 0x56fc5e
call fcn.100b6570
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x100931a0
push 5
sub eax, 0x56fc63
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x10093f77
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x10093f7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xa
mov ebx, 0x56fd1a
call fcn.100b6570
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10093240
push 5
sub ecx, 0x56fd1f
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x10093fd3
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x10093fd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10094020
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, 0xf
mov ebx, 0x47e1c4
call fcn.100b6570
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10093fe0
push 5
sub eax, 0x47e1c9
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x10094084
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x1009408a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xf
mov ebx, 0x6339e7
call fcn.100b6570
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10094000
push 5
sub ecx, 0x6339ec
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x100940e0
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x100940e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100940f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str..Config.ini
push 0xc8
push 0x103a7430
push str.Tahoma
push str.FontName1
push str.Font
call esi
push str..Config.ini
push 0xc8
push 0x103a7368
push str.Tahoma
push str.FontName2
push str.Font
call esi
push str..Config.ini
push 0xc8
push 0x103a72a0
push str.Tahoma
push str.FontName3
push str.Font
call esi
push str..Config.ini
push 0xc8
push 0x103a71d8
push str.Tahoma
push str.FontName4
push str.Font
call esi
push str..Config.ini
push 0xc8
push 0x103a7110
push str.Tahoma
push str.FontName5
push str.Font
call esi
push 0x100942c0
push 0x4060d0
mov bl, 0xe8
call fcn.100b6700
push 0x100942c0
push 0x4d2882
call fcn.100b6700
push 0x100942c0
push 0x4d28eb
call fcn.100b6700
push 0x100942c0
push 0x4d2957
call fcn.100b6700
push 0x100942c0
push 0x4d29c1
call fcn.100b6700
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x28
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4060d5
call esi
mov bl, 0x90
lea ecx, [ebp - 4]
push ecx
mov byte [0x4060d5], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4060d5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d2887
call esi
lea ecx, [ebp - 4]
mov byte [0x4d2887], bl
mov edx, dword [ebp - 4]
push ecx
push edx
push 1
push 0x4d2887
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d28f0
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d28f0], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d28f0
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d295c
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d295c], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d295c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d29c6
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d29c6], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d29c6
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10097430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10097477
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x18]
push eax
push 6
lea ecx, [ebp - 0x20]
push ecx
push edi
call ebx
mov edx, 0x1112
cmp word [ebp - 0x20], dx
jne 0x1009758c
cmp dword [ebp - 0x1e], 0x36
jne 0x1009758c
cmp byte [ebp + 0xc], 0
push esi
mov esi, 0x1027ed9c
je 0x100974b7
mov esi, 0x1027edcc
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
call ebx
mov edx, dword [0x1027edfc]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi], edx
mov eax, dword [0x1027ee00]
xor eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov ecx, dword [0x1027ee04]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 8], ecx
mov edx, dword [0x1027ee08]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0xc], edx
call ebx
mov edx, dword [0x1027edfc]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi + 0x10], edx
mov eax, dword [0x1027ee00]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [0x1027ee04]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x18], ecx
mov edx, dword [0x1027ee08]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0x1c], edx
call ebx
mov edx, dword [0x1027edfc]
xor edx, dword [ebp - 0x14]
push edi
mov dword [esi + 0x20], edx
mov eax, dword [0x1027ee00]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov ecx, dword [0x1027ee04]
xor ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ecx
mov edx, dword [0x1027ee08]
xor edx, dword [ebp - 8]
mov dword [esi + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.100c06a6
mov esp, ebp
pop ebp
ret 8