joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68cb0a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x68cb1a
xor eax, eax
jmp 0x68cce3
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x68cc9b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x6bcf9c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x6bcf9c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x6bcf9c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x6bcf9c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x6bcf9c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x6bcf9c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x6bcf9c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x6bcf9c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x68cb23
cmp dword [ebp + 0x10], 0
je 0x68ccdd
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x6bcf9c]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x68cca1
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x100015c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, 0x10009138
jmp 0x100043a0
push 0xffffffffffffffff
push 0x1000670e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 4]
mov ecx, edi
call fcn.10005da6
push 0
push 0
push 0
push 0
push 1
push 0
lea ecx, [esi + 8]
mov dword [esp + 0x30], 0
call fcn.10005e2a
lea eax, [esp + 8]
mov ecx, esi
push eax
mov byte [esp + 0x1c], 1
mov dword [esi], 0x10007168
call fcn.10004a80
push eax
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.10005dac
lea ecx, [esp + 8]
mov byte [esp + 0x18], 1
call sub.MFC42.DLL_CString::CString
mov ecx, dword [edi]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x1000442d
push str.88888888
mov ecx, edi
call fcn.10005d88
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x10001650
Capabilities:
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10006068
push eax
mov dword fs:[0], esp
lea eax, [esp + 0x10]
mov ecx, 0x10009130
push eax
mov dword [esp + 0xc], 0
call fcn.10005dac
push 0
push 0
push 0
push 0x10001630
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esp + 0x10]
mov dword [esp + 8], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0xc
ret
Function at 0x10001d30
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10001d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
ret

Function at 0x10001e70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100061c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x2c]
mov ebx, 1
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ebx
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x1c], 2
push ecx
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 3
call fcn.10005da6
push str._HTTP
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CString::Find
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001f5a
push 0x3f
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::Find_3
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001f0f
mov esi, dword [esp + 0x24]
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0xc], ebx
jmp 0x10001fb1
inc esi
push 0x100081a4
push esi
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Insert
lea eax, [esp + 0x2c]
lea ecx, [esp + 8]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
lea ecx, [esp + 0x28]
push eax
push esi
mov byte [esp + 0x24], 5
call sub.MFC42.DLL_CString::Insert
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x28]
push eax
jmp 0x10001fa2
lea ecx, [esp + 0x2c]
lea edx, [esp + 8]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
lea ecx, [esp + 0x28]
push eax
push esi
mov byte [esp + 0x24], 6
call sub.MFC42.DLL_CString::Insert
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CString::CString
push 0x100081a4
push esi
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Insert
lea ecx, [esp + 0x28]
push ecx
mov esi, dword [esp + 0x28]
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
Function at 0x10002000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1000621f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov dword [esp + 0x10], 0
push str.HTTP_
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 2
call sub.MFC42.DLL_CString::Find
push 0x100081b0
lea ecx, [esp + 0x2c]
mov esi, eax
call sub.MFC42.DLL_CString::Find
mov edi, eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x10]
push 0x100081b0
push ecx
call sub.MFC42.DLL_operator
push 0x100081b0
lea edx, [esp + 0xc]
push eax
push edx
mov byte [esp + 0x28], 3
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x20], 4
call fcn.10005dac
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
sub esi, edi
lea eax, [esp + 0xc]
push esi
push edi
push eax
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::Mid
mov ecx, dword [esp + 0x2c]
mov eax, dword [eax]
push ecx
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 5
call sub.MFC42.DLL_CString::Replace
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x24]
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov eax, 1
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], al
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0xc
Function at 0x100032e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10006538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, ecx
push edi
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::CString_2
push str.Host:_www.tao123.com
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::Find
test eax, eax
jle 0x10003458
push str.GET___
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Find
test eax, eax
jne 0x1000334d
push str.GET___4462
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Find
test eax, eax
jne 0x10003363
push str.GET___HTTP
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Find
test eax, eax
jne 0x10003458
push str.__4462_8001
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
push ecx
lea eax, [esp + 0x10]
mov bl, 1
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov byte [esp + 0x2c], bl
call sub.MFC42.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x18]
mov ecx, esi
push eax
mov byte [esp + 0x30], bl
call fcn.10002000
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 3
call fcn.10005dac
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call sub.MFC42.DLL_CString::CString
push str.User_Agent:
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.10002b30
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 4
call fcn.10005dac
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call sub.MFC42.DLL_CString::CString
push edi
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, esi
call fcn.10002a10
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 4
Function at 0x10003480
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10006578
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, ecx
push edi
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::CString_2
push str.Host:_www.hao123.com
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::Find
test eax, eax
jle 0x100035f8
push str.GET___
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Find
test eax, eax
jne 0x100034ed
push str.GET___tn32044076_1_hao_pg
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Find
test eax, eax
jne 0x10003503
push str.GET___HTTP
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::Find
test eax, eax
jne 0x100035f8
push str.__tn32044076_1_hao_pg
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
push ecx
lea eax, [esp + 0x10]
mov bl, 1
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
mov byte [esp + 0x2c], bl
call sub.MFC42.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x30], 2
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x18]
mov ecx, esi
push eax
mov byte [esp + 0x30], bl
call fcn.10002000
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 3
call fcn.10005dac
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call sub.MFC42.DLL_CString::CString
push str.User_Agent:
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.10002b30
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 4
call fcn.10005dac
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], bl
call sub.MFC42.DLL_CString::CString
push edi
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call sub.MFC42.DLL_CString::CString_1
mov ecx, esi
call fcn.10002a10
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 4
Function at 0x10003f10
Capabilities:
Read file via mapping

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
test ebp, ebp
jne 0x10003f23
pop edi
pop ebp
xor eax, eax
pop ebx
ret 8
mov ecx, dword [esp + 0x14]
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push str.JTWZHOMEPAGESharedData
and ecx, 3
push 0
rep stosb byte es:[edi], al
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0
mov ebx, eax
push 0
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x10003f66
pop edi
pop ebp
pop ebx
ret 8
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
ret 8
Function at 0x10004350
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10001d70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
ret

Function at 0x10004370
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10001d50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
ret

Function at 0x10004a80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x208
lea eax, [esp]
push esi
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push SysStringLen
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10004abe
push 0x10009128
jmp 0x10004aec
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push str.WHBarId
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10004ae7
push 0x10009128
jmp 0x10004aec
lea ecx, [esp + 0xc]
push ecx
mov esi, dword [esp + 0x214]
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov eax, esi
pop esi
add esp, 0x208
ret 4

Function at 0x10004b50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push ebp
push esi
push edi
mov edi, dword [esp + 0x40]
mov ebp, ecx
push 0x40
push edi
mov dword [esp + 0x18], ebp
call ebx
test eax, eax
jne 0x10004bf6
mov esi, dword [edi + 0x3c]
push 0xf8
add esi, edi
push esi
call ebx
test eax, eax
jne 0x10004bf6
mov esi, dword [esi + 0x80]
add esi, edi
je 0x10004bf6
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10004bf6
mov ebx, dword [esp + 0x34]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x14
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10004bf6
mov eax, dword [esi + 0xc]
push ebx
add eax, edi
push eax
call ebp
test eax, eax
je 0x10004bc4
mov eax, dword [esi + 0x20]
add esi, 0x14
test eax, eax
jne 0x10004ba0
mov eax, dword [esi + 0xc]
mov ebp, dword [esp + 0x10]
test eax, eax
je 0x10004bf6
mov esi, dword [esi + 0x10]
add esi, edi
mov eax, dword [esi]
test eax, eax
je 0x10004bf6
mov ebx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov dword [ebp + 4], eax
mov dword [ebp + 8], ebx
cmp dword [esi], ecx
je 0x10004c02
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x10004be2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0x10
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x14]
push 0x1c
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0x28]
push ecx
push 4
push edx
push eax
call edi
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x40]
mov dword [esi], ebx
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
push ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret 0x10
Function at 0x10004cd0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x30
push ebx
push esi
mov esi, dword [esp + 0x3c]
xor ecx, ecx
mov bl, 4
push edi
mov ax, word [esi]
mov byte [esp + 0x11], bl
test ax, ax
mov byte [esp + 0x10], bl
jne 0x10004cf7
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x30
ret
cmp ax, 0xffff
jne 0x10004d06
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x30
ret
mov dl, byte [esi]
inc esi
mov byte [esp + 0xc], dl
mov eax, dword [esp + 0xc]
and eax, 0xff
mov eax, dword [eax*4 + 0x1000877c]
test al, 0xf8
je 0x10004d58
test ecx, eax
jne 0x10004d84
or ecx, eax
test al, 0x10
je 0x10004d30
xor bl, 6
jmp 0x10004d39
test al, 0x20
je 0x10004d39
xor byte [esp + 0x11], 6
mov dl, byte [esi]
inc esi
mov byte [esp + 0xc], dl
mov eax, dword [esp + 0xc]
and eax, 0xff
mov eax, dword [eax*4 + 0x1000877c]
test al, 0xf8
jne 0x10004d21
mov byte [esp + 0x10], bl
or ecx, eax
cmp dl, 0xf
jne 0x10004d91
mov al, byte [esi]
inc esi
mov byte [esp + 0xc], al
mov eax, dword [esp + 0xc]
and eax, 0xff
or ecx, dword [eax*4 + 0x10008b7c]
cmp ecx, 0xffffffff
jne 0x10004dad
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x30
ret
pop edi
mov byte [esp + 0xc], bl
pop esi
xor eax, eax
pop ebx
add esp, 0x30
ret
cmp dl, 0xf7
jne 0x10004da0
test byte [esi], 0x38
jne 0x10004dad
or ch, 0x20
jmp 0x10004dad
cmp dl, 0xf6
jne 0x10004dad
test byte [esi], 0x38
jne 0x10004dad
or ch, 1
test ch, 0x40
je 0x10004e1c
mov al, byte [esi]
inc esi
mov bl, al
and bl, 0x38
cmp bl, 0x20
jne 0x10004dca
cmp dl, 0xff
jne 0x10004dca
or ecx, 0x40000
mov dl, al
and al, 7
and dl, 0xc0
cmp dl, 0xc0
je 0x10004e1c
cmp byte [esp + 0x10], 4
jne 0x10004e06
cmp al, 4
jne 0x10004de9
mov al, byte [esi]
or ch, 8
inc esi
and al, 7
cmp dl, 0x40
jne 0x10004df3
or ecx, 1
jmp 0x10004e1c
cmp dl, 0x80
jne 0x10004dfd
or ecx, 4
jmp 0x10004e1c
cmp al, 5
jne 0x10004e1c
or ecx, 4
jmp 0x10004e1c
cmp dl, 0x40
jne 0x10004e10
or ecx, 1
jmp 0x10004e1c
cmp dl, 0x80
je 0x10004e19
cmp al, 6
jne 0x10004e1c
or ecx, 2
push ebp
mov ebp, ecx
mov ebx, ecx
shr ebp, 8
and ebx, 7
and ebp, 7
test ch, 0x10
je 0x10004e3b
mov edx, dword [esp + 0x14]
and edx, 0xff
add ebx, edx
test ch, 0x20
je 0x10004e4b
mov eax, dword [esp + 0x15]
and eax, 0xff
add ebp, eax
xor edi, edi
test ebx, ebx
jbe 0x10004e68
push 0x10009128
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov cl, byte [esi]
inc esi
mov byte [esp + edi + 0x30], cl
inc edi
cmp edi, ebx
jb 0x10004e51
xor edi, edi
test ebp, ebp
jbe 0x10004e85
push 0x10009128
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dl, byte [esi]
inc esi
mov byte [esp + edi + 0x38], dl
inc edi
cmp edi, ebp
jb 0x10004e6e
mov eax, dword [esp + 0x44]
pop ebp
sub esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x30
ret
Function at 0x10004ec0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
push 5
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], 0
push ebx
call fcn.10004c90
mov esi, eax
mov eax, dword [ebp + 0xc]
add esp, 8
mov dword [ebp + 4], esi
test eax, eax
je 0x10005065
test ebx, ebx
je 0x10005065
test esi, esi
je 0x10005065
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x14], edi
jne 0x10004f22
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
add esp, 0xc
ret
lea eax, [esi + 5]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp], eax
test eax, eax
jne 0x10004f54
push edi
mov dword [esp + 0x14], 3
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, esi
mov eax, 0x90909090
mov edx, ecx
push ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call fcn.10005080
mov edx, dword [ebp]
lea ecx, [esi + ebx]
lea eax, [edx + esi]
push eax
push ecx
push eax
call fcn.10005080
mov eax, dword [ebp]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x18
lea edx, [esp + 0x18]
push edx
push 0x40
push esi
push eax
call edi
test eax, eax
jne 0x10004fb1
mov dword [esp + 0x10], 4
jmp 0x1000503e
lea ecx, [esp + 0x18]
push ecx
push 0x40
push esi
push ebx
call edi
test eax, eax
jne 0x10004fca
mov dword [esp + 0x10], 4
jmp 0x1000503e
mov eax, dword [ebp]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x20]
push edx
push esi
push eax
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10005036
cmp dword [esp + 0x20], esi
jne 0x10005036
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push esi
push edx
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1000502c
cmp dword [esp + 0x20], esi
jne 0x1000502c
push esi
push ebx
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000504b
mov dword [esp + 0x10], 6
jmp 0x1000503e
mov dword [esp + 0x10], 5
mov edx, dword [ebp]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x468a51
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
add ecx, eax
push ebx
push edi
mov edi, dword [ecx]
add eax, 4
mov dword [esi], eax
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004af507
mov ecx, dword [esi]
add ecx, dword [ebp + 8]
lea ebx, [edi + edi]
push ebx
push ecx
push eax
mov dword [ebp - 4], eax
call fcn.004af930
mov eax, dword [ebp - 4]
add dword [esi], ebx
xor ecx, ecx
add esp, 0x10
cmp edi, ecx
mov word [ebx + eax], cx
jle 0x468aaa
xor word [eax + ecx*2], di
inc ecx
cmp ecx, edi
jl 0x468aa1
pop edi
pop ebx
leave
ret 4