joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411698
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x4116e5
xor ebx, ebx
jmp 0x4116da
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00407f9c
test eax, eax
jne 0x4116d9
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x41178f
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x4116bb
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x4116f1
je 0x4116fa
jmp 0x411703
call 0x40ece8
mov esi, eax
jmp 0x411705
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x411705
xor esi, esi
test si, si
je 0x41178f
xor ebx, ebx
jmp 0x41172b
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x41172a
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x41178f
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x411712
xor ebx, ebx
jmp 0x411784
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, esi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x411783
mov eax, esi
and ax, 0x3ff
cmp ax, 4
jne 0x411778
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.0041166c
push eax
mov eax, esi
call fcn.0041166c
pop edx
cmp edx, eax
jne 0x411783
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x41178f
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x41173a
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x414f34
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x415009
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x415024
push ebx
push 0x415034
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405370
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403270
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f58
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x414fb4
mov al, 0x69
call fcn.00414bac
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00414f08
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x414fbd
call fcn.00414f08
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415010
lea eax, [ebp - 4]
call fcn.00404ebc
ret
Function at 0x401237
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x30], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41b2f8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b2fc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x24], eax
call fcn.00401230
mov ebx, dword [ebp - 0x10]
mov ecx, dword [0x41b300]
add ebx, 0x23f
mov edx, dword [0x41b304]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, edi
mov dword [ebp - 0x10], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0xec652c], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0xec6528]
cmove eax, dword [ebp - 0x10]
and dword [ebp - 0x10], 0
cmp dword [0xec652c], 0x3eb
mov dword [0xec6528], eax
mov eax, dword [0xec6480]
cmove eax, dword [ebp - 0x10]
mov dword [0xec6480], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add dword [ebp - 8], edx
and dword [ebp - 0xc], 0
mov dword [0xec6524], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + esi]
mov edx, esi
lea ebx, [ebx + 0x61c88647]
shr edx, cl
add edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
xor edx, eax
mov eax, dword [ebp - 4]
xor eax, edx
mov edx, dword [ebp - 0x2c]
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
jne 0x401291
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d3fe
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41af20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409c0e
mov dword [ebp - 0x14], eax
cmp dword [0x821d1c], esi
jne 0x40d4f1
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d47e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d5d1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d5d1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d5d1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x821d1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x821d20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x821d24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x821d2c], eax
test eax, eax
je 0x40d4ee
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x821d28], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d516
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d509
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d52b
push 4
pop eax
jmp 0x40d5d3
cmp dword [ebp - 0x14], esi
je 0x40d52b
push dword [0x821d1c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d510
mov eax, dword [0x821d28]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d589
cmp dword [0x821d2c], edi
je 0x40d589
push eax
call ebx
push dword [0x821d2c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d589
test eax, eax
je 0x40d589
call ecx
test eax, eax
je 0x40d57e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d57e
test byte [ebp - 8], 1
jne 0x40d589
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d5b9
mov eax, dword [0x821d20]
cmp eax, edi
je 0x40d5b6
push eax
call ebx
test eax, eax
je 0x40d5b6
call eax
mov esi, eax
test esi, esi
je 0x40d5b6
mov eax, dword [0x821d24]
cmp eax, edi
je 0x40d5b6
push eax
call ebx
test eax, eax
je 0x40d5b6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x821d1c]
call ebx
test eax, eax
je 0x40d5d1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d5d3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404247
mov esp, ebp
pop ebp
ret
Function at 0x10001040
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [0x10011a88]
xor eax, eax
push ebx
fstp dword [0x101da580]
fld dword [0x10011b74]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
fstp dword [0x101da584]
fld dword [0x10011b70]
mov dword [0x101da570], eax
mov dword [0x101da574], eax
fstp dword [0x101da590]
mov dword [0x101da578], eax
mov dword [0x101da57c], eax
mov dword [0x101da5c4], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push 0x60d9e4
mov dword [0x101da594], 0x626681
mov dword [0x101da598], 0x7d171a0
mov dword [0x101da59c], 0x6a9798
mov dword [0x101da5a0], 0x6a7770
mov dword [0x101da5a4], 0x6a9684
mov dword [0x101da5a8], 0x6a967c
mov dword [0x101da5ac], 0x5e9d4e
mov dword [0x101da5b0], 0x62696e
mov dword [0x101da5b4], 0x6a9694
mov dword [0x101da5b8], 0x6a9688
mov dword [0x101da5bc], 0x5e9cfe
mov dword [0x101da5c0], 0x62694f
call esi
mov eax, 0x90909090
mov ecx, 0x60d9e4
mov dword [ecx], eax
mov word [ecx + 4], ax
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 6
push 0x60d9e4
call esi
push 0x100019b0
push 0x60da50
mov bl, 0xe9
call fcn.1000ded0
add esp, 8
pop esi
mov eax, 0x101da570
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100024f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x100d872c], 0
mov eax, dword [0x100d9780]
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x100d8734], eax
jne 0x10002531
call edi
mov ecx, dword [0x100d8734]
push eax
push ecx
push 0x10002590
push 7
call esi
mov dword [0x100d872c], eax
test eax, eax
je 0x10002586
cmp dword [0x100d8730], 0
jne 0x10002556
call edi
mov edx, dword [0x100d8734]
push eax
push edx
push 0x100026b0
push 2
call esi
mov dword [0x100d8730], eax
test eax, eax
je 0x10002586
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x6a74fc
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x6a74fc], 0x100064f0
mov edx, dword [ebp - 4]
push edx
push 4
push 0x6a74fc
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10002ee0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10035ad4]
sub eax, dword [0x10035ad0]
sub esp, 0x10
test eax, 0xffffffe0
jne 0x10002f10
mov ecx, dword [0x100d70f8]
sub ecx, dword [0x100d70f4]
test ecx, 0xffffffe0
je 0x10002fc8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10002d40
push 5
sub edx, 0x500752
xor edi, edi
push 0x50074d
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10002f6a
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x50074d
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x50074d
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10002f70
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10002d40
push 5
sub edx, 0x5fa6c0
push 0x5fa6bb
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10002fc0
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x5fa6bb
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x5fa6bb
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10002fc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10002fd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x38
push 0x6a94d0
call esi
push 0x38
push 0x1005de08
push 0x6a94d0
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x38
push 0x6a94d0
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x38
push 0x6a9508
call esi
push 0x38
push 0x1005de40
push 0x6a9508
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x38
push 0x6a9508
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x30
push 0x6a9470
call esi
push 0x30
push 0x1005de78
push 0x6a9470
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x30
push 0x6a9470
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x30
push 0x6a94a0
call esi
push 0x30
push 0x1005dea8
push 0x6a94a0
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x30
push 0x6a94a0
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x30
push 0x6a9540
call esi
push 0x30
push 0x1005ded8
push 0x6a9540
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x30
push 0x6a9540
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x30
push 0x6a9570
call esi
push 0x30
push 0x1005df08
push 0x6a9570
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x30
push 0x6a9570
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x38
push 0x6a7acc
call esi
push 0x38
push 0x1005df38
push 0x6a7acc
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x38
push 0x6a7acc
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x38
push 0x6a7b04
call esi
push 0x38
push 0x1005df70
push 0x6a7b04
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x38
push 0x6a7b04
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x5a5e63
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x5a5e63], 0x270f
mov edx, dword [ebp - 4]
push edx
push 4
push 0x5a5e63
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x433148
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x433148], 0x270f
mov edx, dword [ebp - 4]
push edx
push 4
push 0x433148
call esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100035f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x60efbe
call esi
mov eax, 0x90909090
mov ecx, 0x60efbe
mov dword [ecx], eax
mov byte [ecx + 4], al
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 5
push 0x60efbe
call esi
push 0x100034a0
push 0x60f066
mov bl, 0xe8
call fcn.1000ded0
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call fcn.10003a40
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
add esp, 4
test al, al
je 0x10003b70
xor eax, eax
test edi, edi
jle 0x10003b70
mov cl, byte [0x100d8746]
mov dl, byte [0x100d8747]
push ebx
mov edi, edi
mov bl, byte [eax + esi]
add bl, cl
xor bl, dl
mov byte [eax + esi], bl
inc eax
cmp eax, edi
jl 0x10003b60
pop ebx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call dword [0x100d8754]
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x10003b90
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ecx, ecx
push edi
mov dword [ebp - 4], ecx
lea edi, [ecx + 1]
mov esi, 2
lea edx, [esi + 1]
mov eax, 0xf0f0f0f1
mul edx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x1005dcd9]
xor al, byte [esi + 0x1005dc8d]
movzx ebx, al
mov eax, 0xf0f0f0f1
mul esi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x1005dcd8]
xor al, byte [edi + 0x1005dc8d]
add esi, 4
movzx edx, al
add bx, dx
mov eax, 0xf0f0f0f1
mul edi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x1005dcd7]
xor al, byte [ecx + 0x1005dc8d]
add edi, 4
movzx edx, al
add bx, dx
mov eax, 0xf0f0f0f1
mul ecx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x1005dcd6]
xor al, byte [ecx + 0x1005dc8c]
add ecx, 4
movzx edx, al
add bx, dx
add word [ebp - 4], bx
cmp esi, 0x22
jb 0x10003ba4
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 4]
mov edx, dword [0x6a7574]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
shr ecx, 8
sub cl, 0x7d
mov byte [0x100d8746], cl
lea ecx, [ebp - 4]
push ecx
sub al, 0x5e
push 0x40
mov byte [0x100d8747], al
mov eax, dword [0x6a7584]
push 4
push 0x6a7574
mov dword [0x100d96fc], edx
mov dword [0x100d8754], eax
call esi
lea edx, [ebp - 4]
push edx
mov dword [0x6a7574], 0x10003ad0
mov eax, dword [ebp - 4]
push eax
push 4
push 0x6a7574
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 4
push 0x6a7584
call esi
lea edx, [ebp - 4]
push edx
mov dword [0x6a7584], 0x10003b30
mov eax, dword [ebp - 4]
push eax
push 4
push 0x6a7584
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004020
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x10003ff0
push 0x5a7420
mov bl, 0xe9
call fcn.1000ded0
push 0x3b
call fcn.1000e0ef
push 0x3b
mov edi, eax
push 0x90
push edi
call sub.MSVCR100.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x40
push 0x3b
xor ebx, ebx
push 0x5a50f6
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x10004099
push 0x3b
push edi
push 0x5a50f6
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push edx
push 0x3b
push 0x5a50f6
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1000409f
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10004100
push 5
sub eax, 0x5a50fb
push 0x5a50f6
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x100040ee
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x5a50f6
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x5a50f6
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x100040f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100042f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x10004370
push 0x540a50
mov bl, 0xe9
call fcn.1000ded0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x506fae
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x506fae], 0x8c
mov edx, dword [ebp - 4]
push edx
push 1
push 0x506fae
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5f9cc4
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x5f9cc4], 0x10
mov edx, dword [ebp - 4]
push edx
push 1
push 0x5f9cc4
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005500
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 7
call fcn.1000e0ef
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
mov eax, 0x90909090
mov dword [esi], eax
add esp, 4
mov word [esi + 4], ax
mov byte [esi + 6], al
lea eax, [ebp - 4]
push eax
push 0x40
push 7
xor ebx, ebx
push 0x5b8e6d
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x10005570
mov ecx, dword [esi]
mov eax, 0x5b8e6d
mov dword [eax], ecx
mov dx, word [esi + 4]
mov word [eax + 4], dx
mov cl, byte [esi + 6]
mov byte [eax + 6], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 7
push 0x5b8e6d
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x10005576
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10006120
push 5
sub ecx, 0x5b8e72
push 0x5b8e6d
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x100055c6
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x5b8e6d
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x5b8e6d
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x100055cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 7
call fcn.1000e0ef
add esp, 4
lea edx, [ebp - 4]
push edx
mov esi, eax
mov eax, 0x90909090
push 0x40
mov dword [esi], eax
push 7
mov word [esi + 4], ax
push 0x5c6cf2
mov byte [esi + 6], al
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x1000562b
mov ecx, dword [esi]
mov eax, 0x5c6cf2
mov dword [eax], ecx
mov dx, word [esi + 4]
mov word [eax + 4], dx
mov cl, byte [esi + 6]
mov byte [eax + 6], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 7
push 0x5c6cf2
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x10005631
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x100061b0
push 5
sub ecx, 0x5c6cf7
push 0x5c6cf2
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x10005681
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x5c6cf2
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x5c6cf2
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x10005687
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret