joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001020
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x100296e0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1003b030]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x1004130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x1004130c
xor esi, esi
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
push str.c__s__s__s
lea edi, [esp + 0x1c]
mov dword [esp + 0x2c], esi
call fcn.100016d0
mov edx, dword [esp + 0x1c]
push esi
lea ecx, [esp + 0x24]
call fcn.10016490
add esp, 0x14
mov byte [esp + 0x1c], 1
call fcn.10001360
mov byte [esp + 0x1c], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100010be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0xc]
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x10041e4c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100010e8
cmp dword [0x10041e4c], 0
jne 0x100010ed
mov esi, 1
lea eax, [edi - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10001111
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x10001130
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100296b0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1003b030]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x1004130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x1004130c
xor ebx, ebx
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
push 0x1002cdf0
lea edi, [esp + 0x24]
mov dword [esp + 0x34], ebx
call fcn.100016d0
mov edx, dword [esp + 0x24]
push ebx
lea ecx, [esp + 0x2c]
call fcn.10016490
add esp, 0x14
mov byte [esp + 0x24], 1
call fcn.10001360
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100011ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x18]
push 0x1002ce04
push ecx
lea ecx, [esp + 0x1c]
call fcn.10001270
mov eax, dword [eax]
add esp, 8
push eax
push ebx
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10001215
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebx
je 0x10001225
push esi
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000124d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x10001790
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x24
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100017cc
lea ecx, [esp + 8]
push ecx
push 0x1002cee4
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x100017d2
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x24
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0x10
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
push 0
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1000181f
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x24
ret
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add esp, 0x24
ret
Function at 0x10002e70
Capabilities:
Create thread

Disassembly:
cmp dword [0x1004210c], 0
jne 0x10002e98
push 0
push 0
push 0
push 0x10002e50
push 0
push 0
mov dword [0x1004210c], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
ret 0xc

Function at 0x10004cb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10004cc7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10004cf8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x10004cf4
cmp esi, eax
jae 0x10004cf8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x10004ce4
cmp esi, eax
jb 0x10004cfe
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x100052f0
Capabilities:
Reference 114dns dns server
Reference alidns dns server

Disassembly:
push 0xffffffffffffffff
push 0x100293c9
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003b030]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x20], ebx
mov eax, dword [0x1004130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x1004130c
call edx
mov ecx, dword [esp + 0x68]
add eax, 0x10
mov dword [ecx], eax
mov ecx, dword [esp + 0x6c]
lea edx, [esp + 0x24]
mov dword [esp + 0x60], ebx
mov esi, 1
push edx
mov dword [esp + 0x24], esi
call fcn.100054a0
mov dword [esp + 0x60], esi
mov dword [esp + 0x28], str.114.114.114.114
mov dword [esp + 0x2c], str.223.5.5.5
xor ebp, ebp
mov eax, dword [0x1004130c]
mov edx, dword [eax + 0xc]
mov ecx, 0x1004130c
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x60], 2
mov ecx, dword [esp + ebp*4 + 0x28]
cmp ecx, ebx
jne 0x10005391
xor eax, eax
jmp 0x1000539f
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10005396
sub eax, esi
mov edi, eax
push ecx
lea eax, [esp + 0x1c]
call fcn.10003880
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0x30]
push eax
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], ebx
call fcn.10004fb0
mov ecx, dword [esp + 0x24]
add esp, 8
shr ecx, 2
cmp eax, ebx
je 0x100053d8
cmp ecx, ebx
jg 0x10005409
lea eax, [esi - 0x10]
mov byte [esp + 0x60], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100053f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc ebp
cmp ebp, 2
jb 0x1000536a
mov ebp, dword [esp + 0x68]
jmp 0x10005459
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
cmp eax, ebx
jne 0x1000541c
xor ecx, ecx
jmp 0x1000542a
mov ecx, eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x10005421
sub ecx, edi
mov ebp, dword [esp + 0x68]
push eax
mov edi, ecx
mov eax, ebp
call fcn.10003880
lea eax, [esi - 0x10]
mov byte [esp + 0x60], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10005459
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x60], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000547d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x10005e90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10029848
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1003b030]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 4]
push eax
call fcn.10006e20
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov byte [esi + 0x20], al
lea eax, [esi + 0x40]
push eax
mov byte [esp + 0x18], 1
call fcn.10006e20
fldz
fstp qword [esi + 0x38]
mov dword [esi], 5
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x10008f60
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x1003b030]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
push 0x228
lea eax, [esp + 0x10]
push 0
push eax
mov edi, ecx
mov dword [esp + 0x14], 0
call fcn.1001a120
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1000907b
cmp esi, 0xffffffff
je 0x1000907b
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10009059
jmp 0x10008fd0
lea edx, [esp + 0x2c]
push str.EXPLORER.EXE
push edx
call fcn.100191a9
add esp, 8
test eax, eax
je 0x10009018
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10008fd0
push esi
lea edi, [eax + 1]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.100186a4
add esp, 0x230
ret
mov ecx, dword [esp + 0x10]
push ecx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push edi
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.100186a4
add esp, 0x230
ret
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.100186a4
add esp, 0x230
ret
mov ecx, dword [esp + 0x234]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.100186a4
add esp, 0x230
ret
Function at 0x10009e50
Capabilities:
Get token membership

Disassembly:
sub esp, 0x14
mov eax, dword [0x1003b030]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
xor ebx, ebx
lea eax, [esp + 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x10009ead
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100186a4
add esp, 0x14
ret
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x10009ec6
mov dword [esp + 4], ebx
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 4]
pop ebx
xor ecx, esp
call fcn.100186a4
add esp, 0x14
ret
Function at 0x1000b200
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100297b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1003b030]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x40]
mov edi, dword [eax + 8]
mov ebp, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, dword [0x1004130c]
xor ebx, ebx
mov dword [esp + 0x28], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x1004130c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], edi
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0x44]
lea eax, [esp + 0x40]
call fcn.100035c0
mov edx, dword [esp + 0x40]
cmp dword [edx - 4], 1
jle 0x1000b28b
mov ecx, dword [edx - 0xc]
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.10003650
mov edx, dword [esp + 0x40]
push ebp
lea ebx, [esp + 0x20]
mov ecx, edi
call fcn.10012080
add esp, 4
test eax, eax
je 0x1000b3c0
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x1000b3c0
push ebx
call fcn.1001861e
add esp, 4
push ebx
mov edi, eax
push 0
push edi
call fcn.1001a120
mov edx, dword [esp + 0x4c]
add esp, 0xc
cmp dword [edx - 4], 1
jle 0x1000b2e1
mov eax, dword [edx - 0xc]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.10003650
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x24]
push edi
push ebp
call fcn.10012120
add esp, 8
test eax, eax
jne 0x1000b34a
mov esi, str._ustr
call fcn.10001970
test edi, edi
je 0x1000b30a
push edi
call fcn.10018699
add esp, 4
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000b332
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
lea edx, [esp + 0x20]
push edx
push ebx
xor ebp, ebp
push edi
mov dword [esp + 0x2c], ebp
call fcn.100102c0
add esp, 0xc
test eax, eax
jne 0x1000b36a
mov esi, str._u6pf
jmp 0x1000b2f8
cmp edi, ebp
je 0x1000b3b3
cmp ebx, ebp
jne 0x1000b376
cmp ebp, ebp
je 0x1000b3b3
mov eax, dword [esi]
cmp eax, ebp
jne 0x1000b387
push ebx
call fcn.10018790
add esp, 4
jmp 0x1000b396
mov ecx, dword [esi + 8]
add ecx, ebx
push ecx
push eax
call fcn.1001885a
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x1000b3b3
mov edx, dword [esi + 8]
push ebx
push edi
add edx, eax
push ebx
push edx
call fcn.10018a75
add esp, 0x10
add dword [esi + 8], ebx
adc dword [esi + 0xc], ebp
mov dword [esp + 0x18], 1
jmp 0x1000b2fd
push 0x1002cf54
push 0x10041fd8
mov edx, 1
call fcn.10003c10
push str._ulen
push 0x10041fd8
mov edx, 5
call fcn.10003c10
jmp 0x1000b30a
Function at 0x1000fe40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10029198
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1003b030]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov eax, ebx
mov edi, edx
mov dword [esp + 0x18], 0
call fcn.10001360
mov eax, dword [esp + 0x20]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x10], esp
mov edi, esp
call fcn.100014f0
sub esi, ebx
sar esi, 2
push esi
add eax, 0x10
push 0
push ebx
mov dword [edi], eax
call fcn.1000f940
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000fec7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x1000fee0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push edi
lea ecx, [esp + 8]
push ecx
push ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
ja 0x1000ff0c
xor eax, eax
pop edi
add esp, 0x10
ret
push ebp
push esi
lea ebp, [edi + 1]
push ebp
call fcn.1001861e
push ebp
xor ebp, ebp
mov esi, eax
push ebp
push esi
call fcn.1001a120
add esp, 0x10
push esi
push edi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1000ff54
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x10]
push eax
push 0x10037750
push esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1000ff5d
pop esi
pop ebp
xor eax, eax
pop edi
add esp, 0x10
ret
mov eax, dword [esp + 0xc]
mov cx, word [eax + 0xa]
mov dx, word [eax + 8]
mov di, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
movzx eax, di
push eax
movzx edx, dx
movzx eax, cx
mov ecx, dword [esp + 0x20]
push edx
push eax
push 0x10037754
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
cmp esi, ebp
je 0x1000ff9e
push esi
call fcn.10018fbc
add esp, 4
pop esi
pop ebp
mov eax, 1
pop edi
add esp, 0x10
ret

Function at 0x100102c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0xc], 0x1000
jae 0x100102d3
xor eax, eax
jmp 0x10010328
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100102ed
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x100102f1
xor eax, eax
jmp 0x10010328
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0x4550
je 0x1001030c
xor eax, eax
jmp 0x10010328
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 4]
xor edx, edx
cmp ecx, 0x14c
sete dl
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x100103c0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
je 0x100103d2
cmp dword [ebp + 0x10], 0
jne 0x100103d9
xor eax, eax
jmp 0x10010508
cmp dword [ebp + 8], 0
jne 0x100103e6
xor eax, eax
jmp 0x10010508
mov dword [ebp - 0x14], 0
push 0x10032e1c
call fcn.10010170
call fcn.10010260
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
jne 0x10010430
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10010510
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x10010508
push 0x10032e40
push 0x10032e50
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10010457
xor eax, eax
jmp 0x10010508
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 8]
test eax, eax
jne 0x10010474
xor eax, eax
jmp 0x10010508
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100102c0
add esp, 0xc
test eax, eax
jne 0x10010497
xor eax, eax
jmp 0x10010508
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0xc]
je 0x100104a3
xor eax, eax
jmp 0x10010508
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jne 0x100104b7
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
je 0x100104e2
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10010900
add esp, 0x18
mov dword [ebp - 0x14], eax
jmp 0x10010505
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10010510
add esp, 0x18
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x100113b0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x10], 0
jle 0x100113e6
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x50], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x4c], edx
jmp 0x100113f4
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x34], ecx
cmp dword [ebp + 0x10], 0
jle 0x10011429
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x1c]
add eax, 8
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x58], edx
mov eax, dword [ecx - 4]
mov dword [ebp - 0x54], eax
jmp 0x10011437
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0xc], edx
cmp dword [ebp + 0x10], 0
jle 0x1001146c
mov eax, dword [ebp + 0x10]
sub eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 8
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx - 8]
mov dword [ebp - 0x60], eax
mov ecx, dword [edx - 4]
mov dword [ebp - 0x5c], ecx
jmp 0x1001147a
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0x10], 0
jle 0x100114af
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x68], ecx
mov edx, dword [eax - 4]
mov dword [ebp - 0x64], edx
jmp 0x100114bd
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
add edx, 8
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 8
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp + 0x10]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x48], 0
xor eax, eax
mov word [ebp - 0x44], ax
mov word [ebp - 0x44], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 0x48], esp
and esp, 0xfffffff0
push 0x33
call 0x1001151d
add dword [esp], 5
retf

Function at 0x100115b0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
cmp dword [ebp + 8], 0
je 0x100115d0
cmp dword [ebp + 0xc], 0
jne 0x100115ca
cmp dword [ebp + 0x10], 0
je 0x100115d0
cmp dword [ebp + 0x14], 0
jne 0x100115d2
jmp 0x10011625
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.100115e5
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10011630
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
cmp dword [ebp + 8], 0
je 0x10011650
cmp dword [ebp + 0xc], 0
jne 0x1001164a
cmp dword [ebp + 0x10], 0
je 0x10011650
cmp dword [ebp + 0x14], 0
jne 0x10011654
xor al, al
jmp 0x100116b8
mov byte [ebp - 9], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push 0x33
call fcn.1001166b
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100116c0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x33
call fcn.100116db