joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10028107
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x10028107
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10028116
pop dword [ebp - 0x44]
mov eax, 0x2b5e045d
add eax, 0xe4a47cb9
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x408f0
push 0
mov eax, 0xf0a952c3
sub eax, 0xe0a66167
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xff49f0a6
sub ecx, 0xff49a76e
mov ebx, eax
mov edi, 0x1004ac00
add edi, dword [ebp - 0x44]
mov edx, 0xe02ecc78
sub edx, 0xd7906afd
add dword [ebp - 0xc], 0xcb9fd23b
mov esi, dword [edi]
mov dword [ebp - 0x24], 0x96adac7c
add esi, edx
xor dword [ebp - 0x18], 0x7f4209f8
mov dword [ebx], esi
xor dword [ebp - 0x30], edx
add ebx, 0xa4d6139c
add ebx, 0x5b29ec68
add edi, 0xda582a8b
sub edi, 0xda582a87
loop 0x1002816f
add eax, 0x2a43d564
add eax, 0xd5bd424f
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10001f40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x10002a30
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1004e670]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov dword [ebp - 0x18], 0x10050d20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 3
push 0
push 3
push 0
push str..PhysicalDrive0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x10002a8a
push 0x10050c74
mov esi, 0x10049a54
call fcn.100048e0
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x1000
push 0x10050d20
push 0xc
lea edx, [ebp - 0x14]
push edx
push 0x2d1400
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x10002ac2
push 0x10050c74
mov esi, 0x10049a54
call fcn.100048e0
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x18], 0
jbe 0x10002ae3
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 0x18]
add esi, 0x10050d20
push 0x10050c74
call fcn.100048e0
jmp 0x10002af2
push 0x10050c74
mov esi, 0x10049a54
call fcn.100048e0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10010580
mov esp, ebp
pop ebp
ret
Function at 0x10002ce0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0x288
push 0x12
call fcn.10013830
add esp, 4
mov dword [ebp - 8], eax
push 0x288
call fcn.10013830
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10002d23
mov eax, dword [ebp - 8]
push eax
call fcn.10013540
add esp, 4
xor eax, eax
jmp 0x10002df2
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x10002d6a
mov eax, dword [ebp - 4]
push eax
call fcn.10013540
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10013830
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10002d6a
mov edx, dword [ebp - 8]
push edx
call fcn.10013540
add esp, 4
xor eax, eax
jmp 0x10002df2
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x10002de3
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x199]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x198]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x197]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x196]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x195]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x194]
push edx
push str._02X:_02X:_02X:_02X:_02X:_02X
mov eax, dword [ebp - 8]
push eax
call fcn.100107f0
add esp, 0x20
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x10002d82
mov eax, dword [ebp - 4]
push eax
call fcn.10013540
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x10003870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0x10049bf0
mov dword [ebp - 4], str.xxxxxxxxxx_x
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push str.Conquer.exe
call fcn.10009ff0
add esp, 0xc
mov dword [0x10050b8c], eax
call fcn.1003aba0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1003b070
push 0x100020f0
push 0x10050b8c
call fcn.1003a630
call fcn.1003ac00
test eax, eax
je 0x100038d0
push 0
call fcn.10016e90
jmp 0x100038d5
call fcn.10003440
mov esp, ebp
pop ebp
ret
Function at 0x10003be0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x884
mov eax, dword [0x1004e670]
xor eax, ebp
mov dword [ebp - 8], eax
mov al, byte [0x10049a54]
mov byte [ebp - 0x808], al
push 0x7ff
push 0
lea ecx, [ebp - 0x807]
push ecx
call fcn.10018500
add esp, 0xc
mov dword [ebp - 0x80c], 0
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 0x808]
push edx
push 0x800
push str..._PlaySetting.ini
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x10003e0e
lea eax, [ebp - 0x808]
push eax
push 0
push str.unlockfps
push str.settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x80c], eax
lea ecx, [ebp - 0x808]
push ecx
push 0
push str.fullscreen
push str.settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x10003dc7
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x878], 0x48
lea edx, [ebp - 0x878]
push edx
mov eax, dword [ebp - 0x824]
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoA]
mov ecx, dword [ebp - 0x86c]
sub ecx, dword [ebp - 0x874]
mov dword [ebp - 0x87c], ecx
mov edx, dword [ebp - 0x868]
sub edx, dword [ebp - 0x870]
mov dword [ebp - 0x810], edx
push 0xa
lea eax, [ebp - 0x830]
push eax
mov ecx, dword [ebp - 0x87c]
push ecx
call fcn.100392d0
add esp, 0xc
push str..._ini_GameSetup.ini
lea edx, [ebp - 0x830]
push edx
push str.ScrWidth
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0xa
lea eax, [ebp - 0x820]
push eax
mov ecx, dword [ebp - 0x810]
push ecx
call fcn.100392d0
add esp, 0xc
push str..._ini_GameSetup.ini
lea edx, [ebp - 0x820]
push edx
push str.ScrHeight
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x814], 1
cmp dword [ebp - 0x814], 0
je 0x10003d93
push str..._ini_GameSetup.ini
push 0x10049c98
push str.FullScrType
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str..._ini_GameSetup.ini
push 0x10049ca8
push str.ScreenModeRecord
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x10003dc7
push str..._ini_GameSetup.ini
push 0x10049c98
push str.FullScrType
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str..._ini_GameSetup.ini
push 0x10049cc0
push str.ScreenModeRecord
push str.ScreenMode
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp - 0x80c], 0
jle 0x10003e0e
mov byte [ebp - 0x884], 0xeb
mov byte [ebp - 0x883], 0xd
push str.xxxxxxxxx____
push 0x10049cd4
call fcn.10001e30
add esp, 8
mov dword [ebp - 0x880], eax
push 2
lea eax, [ebp - 0x884]
push eax
mov ecx, dword [ebp - 0x880]
push ecx
call fcn.10001f40
add esp, 0xc
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10010580
mov esp, ebp
pop ebp
ret
Function at 0x10003e20
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c270
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x1b0
mov eax, dword [0x1004e670]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1a8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10003e77
or eax, 0xffffffff
jmp 0x10003f23
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xffffffff
jne 0x10003ea0
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
jmp 0x10003f23
mov ecx, 2
mov word [ebp - 0x1b8], cx
push 0xd3d
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1b6], ax
mov eax, 0x10050c00
call fcn.10004930
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1b4], eax
push 0x10
lea edx, [ebp - 0x1b8]
push edx
mov eax, dword [ebp - 0x1bc]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10003f08
mov ecx, dword [ebp - 0x1bc]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
jmp 0x10003f23
jmp 0x10003f17
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10010580
mov esp, ebp
pop ebp
ret

Function at 0x100040a0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100040c4
xor eax, eax
jmp 0x100040e0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x100040db
xor eax, eax
jmp 0x100040e0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x100040f0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1004e670]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 0
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], 0x1c
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x100041a6
mov eax, dword [ebp - 0x24]
cmp eax, dword [0x10050ab8]
jne 0x1000416a
mov ecx, dword [0x10050ab8]
push ecx
call fcn.100040a0
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x24]
cmp edx, dword [0x10050ad4]
jne 0x10004186
mov eax, dword [0x10050ad4]
push eax
call fcn.100040a0
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
je 0x10004194
cmp dword [ebp - 4], 0
je 0x10004194
jmp 0x100041a6
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1000414d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
je 0x100041bc
cmp dword [ebp - 4], 0
jne 0x100041c6
mov dword [0x10050bc8], 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10010580
mov esp, ebp
pop ebp
ret

Function at 0x100041e0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1004e670]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], 0
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], 0x1c
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10004281
mov eax, dword [ebp - 0x24]
cmp eax, dword [0x10050ab8]
jne 0x1000424f
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [0x10050ad4]
jne 0x10004261
mov dword [ebp - 4], 1
cmp dword [ebp - 8], 0
je 0x1000426f
cmp dword [ebp - 4], 0
je 0x1000426f
jmp 0x10004281
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1000423d
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], 0
je 0x10004297
cmp dword [ebp - 4], 0
jne 0x100042a1
mov dword [0x10050bcc], 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10010580
mov esp, ebp
pop ebp
ret
Function at 0x100042f0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x1004e670]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003e20
cmp eax, 1
je 0x1000431c
mov eax, 0x10050c94
mov ecx, 0x10050cb4
call fcn.100048d0
call fcn.10003be0
xor eax, eax
mov dword [0x10050b28], eax
mov dword [0x10050b2c], eax
mov dword [0x10050b30], eax
mov dword [0x10050b34], eax
mov dword [0x10050b38], eax
mov dword [0x10050b3c], eax
mov dword [0x10050b40], eax
mov dword [0x10050b44], eax
xor ecx, ecx
mov dword [0x10050afc], ecx
mov dword [0x10050b00], ecx
mov dword [0x10050b04], ecx
mov dword [0x10050b08], ecx
mov dword [0x10050b0c], ecx
mov dword [0x10050b10], ecx
mov dword [0x10050b14], ecx
mov dword [0x10050b18], ecx
xor edx, edx
mov dword [0x10050b4c], edx
mov dword [0x10050b50], edx
mov dword [0x10050b54], edx
mov dword [0x10050b58], edx
mov dword [0x10050b5c], edx
mov dword [0x10050b60], edx
mov dword [0x10050b64], edx
mov dword [0x10050b68], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x10050b1c], eax
push 0x105
lea eax, [ebp - 0xd0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, str.Conquer.exe
lea ecx, [ebp - 0xd0]
call fcn.10001020
neg eax
sbb eax, eax
add eax, 1
je 0x10004407
push 0
push 0x10049ce4
push str.Invalid_Conquer.exe
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.10016e90
jmp 0x100044f8
call fcn.10002ce0
mov dword [0x10050abc], eax
mov ecx, dword [0x10050abc]
mov dword [ebp - 0xe0], ecx
mov edx, dword [ebp - 0xe0]
add edx, 1
mov dword [ebp - 0xe4], edx
mov eax, dword [ebp - 0xe0]
mov cl, byte [eax]
mov byte [ebp - 0xe5], cl
add dword [ebp - 0xe0], 1
cmp byte [ebp - 0xe5], 0
jne 0x1000442c
mov edx, dword [ebp - 0xe0]
sub edx, dword [ebp - 0xe4]
mov dword [ebp - 0xec], edx
mov eax, dword [ebp - 0xec]
mov dword [0x10050b80], eax
call fcn.10001fa0
call fcn.10003870
call fcn.10003910
call fcn.10003980
push 0x10050ab8
push 0
push 0
push 0x100039f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10050aac], eax
push 0x10050ad4
push 0
push 0
push 0x10004020
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10050af8], eax
push 0x10050b48
push 0
push 0
push 0x100042b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10050ac0], eax
mov ecx, dword [0x10050aac]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x10050af8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10050ac0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010580
mov esp, ebp
pop ebp
ret
Function at 0x10006de0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1003c819
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x1004e670]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x1004e670]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ecx
cmp dword [ecx + 0x44], esi
je 0x10006ff4
cmp byte [ecx + 0x49], 0
je 0x10006ff4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x10006fdc
push esi
push 8
lea ecx, [esp + 0x58]
call fcn.100063f0
mov dword [esp + 0x80], esi
lea esp, [esp]
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x54]
call fcn.100068d0
mov esi, eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x54]
mov byte [esp + 0x84], 1
call fcn.100068d0
mov edi, eax
mov ecx, esi
mov byte [esp + 0x80], 2
call fcn.10007a00
mov ebx, dword [esp + 0x64]
mov ecx, edi
mov esi, eax
call fcn.10007a00
mov edx, dword [esp + 0x18]
mov ecx, dword [edx + 0x44]
mov edx, dword [ecx]
lea edi, [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
add ebx, esi
push ebx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [edx + 0x18]
call eax
lea ecx, [esp + 0x20]
mov esi, eax
mov byte [esp + 0x80], 1
call fcn.100011e0
lea ecx, [esp + 0x44]
mov byte [esp + 0x80], 0
call fcn.100011e0
mov eax, esi
sub eax, 0
je 0x10006f0e
dec eax
je 0x10006f12
sub eax, 2
mov dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x50]
jne 0x10006fd7
jmp 0x10006fef
mov byte [edi + 0x49], 0
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x54]
call fcn.100068d0
mov ecx, eax
mov byte [esp + 0x80], 3
call fcn.10007a00
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
sub esi, eax
mov byte [esp + 0x80], 0
call fcn.100011e0
test esi, esi
je 0x10006f84
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x54]
call fcn.100068d0
mov byte [esp + 0x80], 4
or dword [esp + 0x14], 1
mov ecx, eax
call fcn.10007a00
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.10016200
add esp, 0x10
cmp esi, eax
je 0x10006f84
mov bl, 1
jmp 0x10006f86
xor bl, bl
mov dword [esp + 0x80], 0
test byte [esp + 0x14], 1
je 0x10006fa6
and dword [esp + 0x14], 0xfffffffe
lea ecx, [esp + 0x38]
call fcn.100011e0
test bl, bl
jne 0x10006fc8
cmp byte [edi + 0x49], bl
je 0x10006fe0
test esi, esi
jne 0x10006e60
push esi
push 8
lea ecx, [esp + 0x58]
call fcn.100064a0
jmp 0x10006e60
mov dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x50]
call fcn.100048a0
xor al, al
jmp 0x10006ff6
mov dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x50]
call fcn.100048a0
mov al, 1
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.10010580
mov esp, ebp
pop ebp
ret
Function at 0x100078c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c49b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1004e670]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1000bdd0
push 0x18
push 0x1004a350
mov dword [ebp - 4], 0
call fcn.1000b0b0
push eax
push 4
call fcn.1000afe0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1000794d
call fcn.1000b580
mov dword [edi], eax
call fcn.1000b390
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.1000bd60
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10007943
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.1000bda0
jmp 0x1000794f
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009e40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push edi
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push 0x1004f62c
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x1004f634
call esi
mov eax, dword [edi]
pop esi
cmp eax, dword [0x1004f62c]
jne 0x10009e93
mov cl, byte [0x1004f630]
cmp cl, byte [edi + 4]
jne 0x10009e93
mov eax, 0xb
mov esp, ebp
pop ebp
ret
cmp eax, dword [0x1004f634]
jne 0x10009eab
mov dl, byte [0x1004f638]
mov eax, 5
cmp dl, byte [edi + 4]
je 0x10009eae
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x10009ec0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [esi + 4]
push ebx
push edi
mov edi, dword [0x10050bd8]
push eax
call fcn.10009e40
mov dword [esi + 4], eax
add eax, 5
push eax
call fcn.100173f0
mov edx, dword [esi + 4]
add esp, 8
lea ecx, [ebp - 8]
push ecx
push 0x40
add edx, 5
mov ebx, eax
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 4]
push eax
push edi
push ebx
call fcn.10018190
mov ecx, dword [esi + 4]
mov byte [ebx + ecx], 0xe9
mov eax, dword [esi + 4]
mov edx, edi
sub edx, ebx
sub edx, 5
mov dword [ebx + eax + 1], edx
mov eax, dword [ebp + 8]
add esp, 0xc
sub eax, edi
sub eax, 5
mov dword [ebp - 7], eax
mov dl, byte [ebp - 4]
mov byte [ebp - 8], 0xe9
mov ecx, dword [ebp - 8]
mov dword [edi], ecx
mov byte [edi + 4], dl
pop edi
mov dword [esi], ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009f50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
lea ecx, [ebp - 8]
push ecx
push 0x40
push eax
push ebx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esi + 4]
add edx, 5
push edx
call fcn.100173f0
mov ecx, dword [esi + 4]
add esp, 4
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x40
add ecx, 5
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esi + 4]
push edx
push ebx
push edi
call fcn.10018190
mov eax, dword [esi + 4]
mov byte [edi + eax], 0xe9
mov eax, dword [ebp + 8]
mov edx, dword [esi + 4]
mov ecx, ebx
sub ecx, edi
sub ecx, 5
mov dword [edi + edx + 1], ecx
sub eax, ebx
add esp, 0xc
sub eax, 5
mov dword [ebp - 7], eax
mov cl, byte [ebp - 4]
mov byte [ebp - 8], 0xe9
mov eax, dword [ebp - 8]
mov dword [ebx], eax
mov byte [ebx + 4], cl
mov dword [esi], edi
pop edi
mov esp, ebp
pop ebp
ret