joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44cce4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44cd1c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44ccfd
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44cd0c
or bl, 4
test esi, 0x20000000
je 0x44cd17
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4533e0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4533f2
add esp, 0xfffffff0
call fcn.00403ac8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041e224
mov eax, dword [0x489f24]
mov dword [eax + 4], ebx
mov dword [eax], 0x453784
mov eax, dword [0x489f30]
mov dword [eax + 4], ebx
mov dword [eax], 0x453790
mov eax, ebx
call fcn.0045379c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x415648]
call fcn.00403760
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x415648]
call fcn.00403760
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x415648]
call fcn.00403760
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x415648]
call fcn.00403760
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x415648]
call fcn.00403760
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44fbb4
push eax
push 0
push 0
mov eax, dword [0x48a114]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41fc90]
call fcn.00421428
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41fc90]
call fcn.00421428
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41fc90]
call fcn.00421428
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00453bec
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x453ab4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x453ab4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x453ab4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45352f
call fcn.00403b20
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x453898
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453a43
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x453a24
mov dl, 1
mov eax, dword [0x415bf0]
call fcn.00403760
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004045c0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x453a13
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00441618
test al, al
je 0x453a06
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x453a54
lea eax, [ebp - 0x254]
call fcn.004095b4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x453a06
xor eax, eax
push ebp
push 0x4539ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x453a8c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4539e8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404830
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4539e8
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404830
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453a06
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x453909
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00419f0c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453a4a
lea eax, [ebp - 0x260]
call fcn.004045c0
ret

Function at 0x45438c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x48bbb8]
cmp byte [eax + 0xa5], 0
jne 0x4543fd
cmp dword [0x48bbd0], 0
jne 0x4543be
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x454348
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x48bbd0], eax
cmp dword [0x48bbcc], 0
jne 0x4543d9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x48bbcc], eax
cmp dword [0x48bbd4], 0
jne 0x4543fd
push esp
push 0
push 0
push 0x4542ec
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x48bbd4], eax
pop edx
ret
Function at 0x454a90
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48bbb8]
cmp dword [eax + 0x30], 0
je 0x454b3a
cmp dword [ebx + 0x94], 0
jne 0x454b34
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x454a20
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x454b34
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x454afa
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x454b34
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417b98
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x454b09
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x455698
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4556cd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004046b0
jmp 0x4556da
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404614
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4567ec
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45682d
mov eax, esi
call fcn.0043cc44
test al, al
je 0x45682d
mov eax, dword [ebx + 0x84]
call fcn.0043c940
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45682d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043c940
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4595a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004224c8
cmp ebx, dword [ebp - 8]
jge 0x459607
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004226e8
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004226e8
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00422714
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4595cd
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x459610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004224c8
cmp ebx, dword [ebp - 8]
jge 0x459673
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004226e8
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004226e8
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00422714
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x459639
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x46426c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x464299
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x464318
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00462ba8
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4642e6
mov cx, word [esp]
sub cx, si
jmp 0x4642e8
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4642cf
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x46430e
mov cx, word [esp]
sub cx, si
jmp 0x464310
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4642f7
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x464375
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00463f40
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x464360
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x464375
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x464276
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x467a80
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x414e44]
call fcn.00404f30
xor eax, eax
push ebp
push 0x467bc4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x489394], 0
jne 0x467ad3
mov ecx, dword [0x489e24]
mov dl, 1
mov eax, dword [0x407848]
call fcn.0040c00c
call fcn.00403f30
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403178
mov eax, ebx
call fcn.00404dfc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x467bd4
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405f70
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404e0c
test eax, eax
jle 0x467b6b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x467b64
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404848
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404830
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408738
test eax, eax
jne 0x467b64
mov ebx, 0x15
jmp 0x467b70
mov ebx, 0x10
jmp 0x467b70
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x489394]
call fcn.004679d8
mov eax, dword [ebp - 8]
call fcn.004679d8
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405f88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467bcb
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004045e4
lea eax, [ebp - 0x10]
mov edx, dword [0x414e44]
call fcn.00405000
ret

Function at 0x46f6d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x46f6fe
mov eax, ebx
call fcn.00470184
cmp dword [ebx + 0x40], 0
je 0x46f6f7
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x46f76f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x46f761
cmp dword [ebx + 8], 0
je 0x46f720
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x46f732
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46f761
cmp dword [ebx + 8], 0
je 0x46f713
cmp eax, 3
je 0x46f745
dec eax
jne 0x46f713
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46f713
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x46f713
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x46f78d
cmp dword [ebx + 0x14], 0xcc
je 0x46f78d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046f798
pop ebx
ret
Function at 0x404558
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404597
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404597
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404597
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404597
cmp dword [ecx + 0x74], 0xe
jbe 0x404597
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4081cb
Capabilities:
Create process on windows
Link many functions at runtime
Parse pe header
Resume thread

Disassembly:
push 0x8000
mov cx, si
movzx cx, bh
movzx ecx, cx
push 0
movsx ecx, cx
mov ecx, dword [ebp + 0xc]
jmp loc.00408477
push ebp
test si, si
adc ecx, 0x550e46f0
mov ebp, esp
movsx ecx, cx
lea esp, [esp - 0x1b4]
cwd
shr dl, cl
mov eax, dword [0x407040]
shr dh, cl
xor eax, ebp
mov dword [ebp - 4], eax
rol eax, cl
cwde
mov eax, dword [ebp + 0xc]
shl cl, cl
sal ecx, cl
rcl ecx, 0xb6
mov dword [ebp - 0x7c], eax
xor cx, di
bsf dx, ax
mov ecx, dword [ebp - 0x7c]
rcl dh, cl
movzx edx, word [ecx]
test ecx, esi
test eax, 0x56aa6b73
cmp edx, 0x5a4d
jne 0x4013ef
mov eax, dword [ebp - 0x7c]
cdq
btc ecx, esp
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x3c]
add edx, edi
cmp cl, 0xf5
inc dh
mov dword [ebp - 0x60], ecx
test ah, dh
shr dx, 0xbe
mov edx, dword [ebp - 0x60]
test esi, eax
test cx, 0x1151
cmc
cmp dword [edx], 0x4550
jmp 0x408b06
push edx
movzx ax, bl
not cl
lea eax, [ebp - 0x48]
xchg ecx, ecx
push eax
push 0
push 0
cmovns ecx, ebp
push 4
push 0
push 0
cmova cx, dx
xchg cx, cx
push 0
push 0
jmp 0x4088fa
push eax
jmp 0x40876b
push 0
setno ah
not ah
lea eax, [ebp - 0x48]
jmp 0x40842c
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add eax, 0x499078fe
mov edx, ecx
sub ecx, ecx
cmovg edx, esp
sets al
cbw
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
not dl
mov dh, 0x73
bswap ax
mov dword [ebp - 0x50], ecx
movzx eax, dx
seta ah
mov dword [ebp - 0x4c], ecx
lea edx, [ebp - 0x58]
jmp 0x408273
mov ecx, dword [ebp + 8]
push ecx
jmp loc.00401918
jne 0x4013ef
push 0x44
jmp 0x408717

Function at 0x408903
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0
jmp loc.00401897
push ebp
shld ebp, ebx, 0x2f
and eax, edx
movzx ebp, sp
mov ebp, esp
cbw
adc al, ah
ror ax, cl
sub esp, 0xc
push 0xa
cwde
setle ah
xchg ah, al
movzx eax, word [ebp + 8]
push eax
jmp 0x40870d
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x12232c88
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x42f314
nop
mov ecx, 0x3dae4fa0
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x100014b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, esp
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10056a3c
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x1001d9a8
mov edi, dword fs:[0]
mov dword [ebp - 0x1c], edi
mov dword fs:[0], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
mov esi, esp
mov dword [esi + 0xc], ecx
mov dword [esi], edx
mov dword [esi + 8], 0x40
mov dword [esi + 4], 0
call eax
mov dword [ebp - 0x44], eax
jmp 0x10001525
mov eax, dword [ebp - 0x44]
cmp eax, 0
jne 0x1000155d
mov dword [ebp - 0x28], 1
jmp 0x10001717
jmp 0x10001562
mov eax, dword [ebp - 0x34]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x10001580
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x3c], 0
jne 0x1000158c
mov dword [ebp - 0x28], 2
jmp 0x10001717
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
mov esi, dword [edx + 0x3c]
add edx, 0x40
mov dword [ebp - 0x10], 1
mov edi, esp
mov dword [edi + 0xc], ecx
mov dword [edi + 4], esi
mov dword [edi], edx
mov dword [edi + 8], 0xf8
call eax
mov dword [ebp - 0x48], eax
jmp 0x100015bd
mov eax, dword [ebp - 0x48]
cmp eax, 0
jne 0x100015f5
mov dword [ebp - 0x28], 1
jmp 0x10001717
jmp 0x100015fa
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x40], 0x4550
jne 0x1000162a
mov eax, dword [ebp - 0x34]
movzx eax, word [eax + 0x58]
cmp eax, 0x10b
jne 0x1000162a
mov eax, dword [ebp - 0x34]
cmp word [eax + 0x46], 0
jne 0x10001636
mov dword [ebp - 0x28], 2
jmp 0x10001717
mov eax, dword [ebp - 0x34]
movzx eax, word [eax + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 0x140], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x140]
mov dword [ebp - 0x10], 0xffffffff
mov dword [esp], eax
call fcn.1001daf9
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 0x138], eax
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x138], 0
jne 0x10001686
mov dword [ebp - 0x28], 3
jmp 0x10001717
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x3c]
movzx edx, word [eax + 0x54]
lea ecx, [ecx + edx + 0x18]
mov dword [eax + 0x13c], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
mov esi, dword [edx + 0x140]
mov edi, dword [edx + 0x138]
mov edx, dword [edx + 0x13c]
mov dword [ebp - 0x10], 2
mov ebx, esp
mov dword [ebx + 0xc], ecx
mov dword [ebx + 8], esi
mov dword [ebx + 4], edx
mov dword [ebx], edi
call eax
mov dword [ebp - 0x4c], eax
jmp 0x100016d3
mov eax, dword [ebp - 0x4c]
cmp eax, 0
jne 0x1000170b
mov dword [ebp - 0x28], 1
jmp 0x10001717
jmp 0x10001710
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov dword fs:[0], ecx
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001730
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, 0xffffffff
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0xc]
and eax, 2
cmp eax, 0
cmovne edx, esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x138]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
movzx ecx, word [ecx + 0x46]
cmp eax, ecx
jae 0x100017ef
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 0
jne 0x10001797
jmp 0x100017d8
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
cmp eax, dword [ebp - 0x14]
jae 0x100017af
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 8]
cmp eax, dword [ebp - 0x18]
jbe 0x100017d3
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 8]
mov dword [ebp - 0x18], eax
jmp 0x100017d8
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
add eax, 0x28
mov dword [ebp - 0x20], eax
jmp 0x10001773
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x74]
add ecx, dword [ebp - 0x14]
mov edx, esp
mov dword [edx + 4], eax
mov dword [edx], ecx
mov dword [edx + 0xc], 0x40
mov dword [edx + 8], 0x3000
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x148], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x74]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x144], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x148], 0
jne 0x100018ab
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0x56]
and eax, 1
cmp eax, 0
je 0x10001864
mov dword [ebp - 8], 4
jmp 0x100018ce
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
mov ecx, esp
mov dword [ecx + 4], eax
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x3000
mov dword [ecx], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x148], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x148]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x144], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x148], 0
jne 0x100018c7
mov dword [ebp - 8], 3
jmp 0x100018ce
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add esp, 0x2c
pop esi
pop ebp
ret
Function at 0x10001ff0
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x138]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
movzx ecx, word [ecx + 0x46]
cmp eax, ecx
jae 0x10002109
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x20
cmp eax, 0
je 0x10002044
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x24]
or ecx, 0x60000000
mov dword [eax + 0x24], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
shr eax, 0x1d
mov ecx, eax
sub ecx, 6
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
ja 0x1000209f
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax*4 + 0x1004c260]
jmp ecx
mov dword [ebp - 0x1c], 0x10
jmp 0x100020a6
mov dword [ebp - 0x1c], 2
jmp 0x100020a6
mov dword [ebp - 0x1c], 0x20
jmp 0x100020a6
mov dword [ebp - 0x1c], 4
jmp 0x100020a6
jmp 0x1000209f
mov dword [ebp - 0x1c], 0x40
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + 0x144]
mov esi, dword [ebp - 0x14]
add edx, dword [esi + 0xc]
mov esi, esp
lea edi, [ebp - 0x1c]
mov dword [esi + 0xc], edi
mov dword [esi + 8], eax
mov dword [esi + 4], ecx
mov dword [esi], edx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
cmp eax, 0
jne 0x100020ed
mov dword [ebp - 0xc], 9
jmp 0x10002110
jmp 0x100020f2
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
add eax, 0x28
mov dword [ebp - 0x14], eax
jmp 0x10002011
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
add esp, 0x2c
pop esi
pop edi
pop ebp
ret