joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001b80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [0x10039018]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
push edi
push 0x94
xor edi, edi
lea eax, [esp + 0x14]
push edi
push eax
mov esi, ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x20], 2
jne 0x10001c06
call fcn.100011e0
test eax, eax
jne 0x10001c1c
push esi
call fcn.10001920
test eax, eax
jne 0x10001c1c
push esi
call fcn.10001500
test eax, eax
jne 0x10001c1c
push esi
call fcn.10001070
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.10028cc0
mov esp, ebp
pop ebp
ret
xor ebx, ebx
test edi, edi
jne 0x10001c1a
push esi
call fcn.100017b0
inc ebx
mov edi, eax
cmp ebx, 0xa
jl 0x10001c08
mov eax, edi
mov ecx, dword [esp + 0xac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10028cc0
mov esp, ebp
pop ebp
ret

Function at 0x10001d40
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x10039018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10001dc2
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov edx, dword [ebp - 0xd0]
mov ecx, dword [esi]
push 0
push edx
push 4
push esi
mov dword [ebp - 0xcc], ecx
call edi
xor eax, eax
jmp 0x10001d90
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10001d90
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov edx, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xcc]
push 0
push edx
push 4
push esi
mov dword [esi], ecx
call edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10028cc0
mov esp, ebp
pop ebp
ret 4

Function at 0x10001de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x10039018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10001e27
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
xor eax, eax
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10001e04
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028cc0
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10028cc0
mov esp, ebp
pop ebp
ret 4
Function at 0x10001f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029cf8
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10039018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp + 8]
jae 0x10001f97
lea eax, [ebp + 8]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001fa0
sub eax, edx
mov esi, eax
push esi
call fcn.10028c7e
mov edi, eax
add esp, 4
xor eax, eax
test esi, esi
je 0x10001fc8
lea esp, [esp]
xor byte [eax + edi], al
inc eax
cmp eax, esi
jb 0x10001fc0
cmp dword [ebp + 0x1c], 0x10
jb 0x10001fdb
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10002e10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x10002e3a
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push 0x40
push 4
lea ecx, [esi + ebx]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, edi
jb 0x10002e22
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x10003130
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi]
lea eax, [ebp + 8]
push eax
push 0x40
push 4
push esi
call ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10006b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002a238
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10039018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov ecx, 0x61
xor eax, eax
mov dl, byte [eax + 0x1003357c]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x1c], dl
jns 0x10006bb1
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10006b94
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10006bd0
sub eax, edx
lea ecx, [ebp - 0x1c]
push ecx
mov edi, eax
lea esi, [ebp - 0x38]
call fcn.10022700
cmp dword [0x1003fe08], 0xffec67e2
mov esi, 0x10
jne 0x10006c39
mov eax, dword [0x10039928]
cmp dword [0x1003993c], esi
jae 0x10006c0a
mov eax, 0x10039928
mov edx, dword [0x10039938]
push edx
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.10021e00
cmp eax, 0xffffffff
je 0x10006c39
cmp dword [ebp - 0x24], esi
jb 0x10006c32
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, 1
jmp 0x10006c4d
cmp dword [ebp - 0x24], esi
jb 0x10006c4b
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10028cc0
mov esp, ebp
pop ebp
ret

Function at 0x10007670
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
test esi, esi
je 0x100076af
cmp dword [ebp + 8], 0
je 0x100076af
test edi, edi
je 0x100076af
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push edi
push esi
call ebx
mov ecx, dword [ebp + 8]
push edi
push ecx
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push edi
push esi
call ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100076c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [0x1003d688]
test esi, esi
je 0x100076fb
test ebx, ebx
je 0x100076fb
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call edi
mov eax, dword [ebp - 4]
mov cl, byte [ebx]
lea edx, [ebp - 4]
push edx
push eax
push 1
push esi
mov byte [esi], cl
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100078d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
call fcn.10028c7e
add esp, 4
mov esi, eax
lea eax, [ebp + 0xc]
push eax
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 8]
push edi
push ecx
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x10007910
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
push edi
call fcn.10028c7e
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push edi
push ebx
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test edi, edi
jle 0x10007962
push esi
mov esi, dword [ebp + 8]
sub ebx, esi
nop
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10007952
mov cl, byte [esi]
mov byte [ebx + esi], cl
inc esi
dec edi
jne 0x10007940
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10007970
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
call fcn.10028c7e
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 8]
lea ecx, [eax + edi]
mov dword [ebp + 8], ecx
push 0x1c
lea edx, [ebp - 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov edi, eax
mov ebx, ecx
test esi, esi
je 0x100079f4
test ecx, ecx
je 0x100079f4
test eax, eax
je 0x100079f4
lea ecx, [ebp + 0xc]
push ecx
push 0x40
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp + 0xc]
add esp, 0xc
lea edx, [ebp + 0xc]
push edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
add esi, eax
add eax, ecx
cmp eax, dword [ebp + 8]
jb 0x100079a1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10007a10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10007a3e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 1
push esi
call edi
mov edx, dword [ebp + 8]
lea ecx, [ebp + 8]
push ecx
push edx
push 1
push esi
mov byte [esi], 0xcc
call edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x10007a50
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x10039018]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 0
push 0xf
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x18], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10007af9
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x34]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10007ac0
test dl, dl
je 0x10007abc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10007ac0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10007aa0
xor eax, eax
jmp 0x10007ac5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10007ae9
mov ecx, dword [esp + 0x18]
push ecx
push eax
push 1
call ebx
mov esi, eax
test esi, esi
je 0x10007ae9
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10007a97
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10028cc0
mov esp, ebp
pop ebp
ret

Function at 0x10007b20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10035800
push 0x10029409
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10039018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], 0
test esi, esi
je 0x10007bad
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
sub edi, esi
sub edi, 5
mov byte [esi], 0xe9
mov dword [esi + 1], edi
mov eax, 5
mov dword [ebp - 0x1c], eax
mov ecx, 5
cmp eax, ecx
jae 0x10007b96
mov byte [eax + esi], 0x90
inc eax
jmp 0x10007b83
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x20]
push eax
push ecx
push esi
call ebx
jmp 0x10007bad
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007bd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100357e0
push 0x10029409
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x10039018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov dword [ebp - 4], 0
test edi, edi
je 0x10007c9b
mov eax, 0x1001ee70
test eax, eax
je 0x10007c9b
lea ecx, [ebp - 0x2c]
push ecx
push 0x40
push 5
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
push 0x14
call fcn.10028c7e
add esp, 4
mov esi, eax
mov dword [ebp - 0x1c], esi
lea edx, [ebp - 0x30]
push edx
push 0x40
push 0x14
push esi
call ebx
mov dword [esi], 0x1001ee70
lea esi, [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x20], eax
cmp eax, 3
jg 0x10007c65
mov cl, byte [eax + esi]
mov byte [ebp + eax - 0x24], cl
inc eax
jmp 0x10007c53
mov word [edi], 0x15ff
xor eax, eax
mov dword [ebp - 0x28], eax
cmp eax, 3
ja 0x10007c7f
mov dl, byte [ebp + eax - 0x24]
mov byte [eax + edi + 2], dl
inc eax
jmp 0x10007c6c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov eax, 5
push eax
push edi
call ebx
jmp 0x10007c9b
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10039018]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0xa7
xor eax, eax
mov dl, byte [eax + 0x100335c4]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x10007cf4
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1e
jl 0x10007cd7
mov ecx, 0x100335e4
sub ecx, 0x2e789121
lea eax, [ebp - 0x10]
mov byte [ebp - 0x12], 0
call fcn.10023140
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
push 0x1001faa0
push 1
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov word [ebp - 8], cx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], cx
mov byte [ebp - 0x12], cl
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
call fcn.10028cc0
mov esp, ebp
pop ebp
ret
Function at 0x10007d70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100357c0
push 0x10029409
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10039018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], 0
test esi, esi
je 0x10007e01
test edi, edi
je 0x10007e01
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
sub edi, esi
sub edi, 5
mov byte [esi], 0xe9
mov dword [esi + 1], edi
mov eax, 5
mov dword [ebp - 0x1c], eax
mov ecx, 6
cmp eax, ecx
jae 0x10007dea
mov byte [eax + esi], 0x90
inc eax
jmp 0x10007dd7
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x20]
push eax
push ecx
push esi
call ebx
jmp 0x10007e01
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007e20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100357a0
push 0x10029409
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x10039018]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], 0
test esi, esi
je 0x10007eb1
test edi, edi
je 0x10007eb1
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call ebx
sub edi, esi
sub edi, 5
mov byte [esi], 0xe8
mov dword [esi + 1], edi
mov eax, 5
mov dword [ebp - 0x1c], eax
mov ecx, 5
cmp eax, ecx
jae 0x10007e9a
mov byte [eax + esi], 0x90
inc eax
jmp 0x10007e87
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x20]
push eax
push ecx
push esi
call ebx
jmp 0x10007eb1
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007ed0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10007f1c
lea eax, [edi + 5]
push esi
push eax
call fcn.10028c7e
add esp, 4
mov esi, eax
lea eax, [ebp + 8]
push eax
push 0x40
lea eax, [edi + 5]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
push esi
call sub.MSVCR100.dll_memcpy
add esi, edi
sub ebx, esi
add esp, 0xc
lea ecx, [ebx + edi - 5]
mov eax, esi
mov byte [esi], 0xe9
mov dword [esi + 1], ecx
pop esi
sub eax, edi
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10007f30
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x10007f9b
push esi
cmp ecx, edx
jne 0x10007f91
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10007f53
mov esi, dword [eax]
mov dword [ecx], esi
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10007f5f
mov esi, dword [eax]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x10007f6b
mov esi, dword [eax + 0x10]
mov dword [ecx], esi
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10007f78
mov esi, dword [eax + 0x14]
mov dword [ecx + 4], esi
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10007f84
mov esi, dword [eax + 0xc]
mov dword [esi], ecx
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10007f91
mov esi, dword [eax + 0xc]
mov dword [ecx + 4], esi
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x10007f44
pop esi
ret

Function at 0x10007fa0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
call edi
push 0xc8
push 0
push esi
call sub.MSVCR100.dll_memset
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
push 0
push ecx
push edx
push eax
call edi
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10011e70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x1003ca5c]
mov edx, dword [0x1003fd54]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push esi
push edi
add edx, 0x1c
push edx
call eax
cmp dword [eax], 0
je 0x10011efd
cmp dword [0x1003ff08], 0
jne 0x10011ea4
cmp dword [0x1003ff90], 0
je 0x10011efd
mov ecx, dword [0x1003ca5c]
mov edx, dword [0x1003fd54]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, 0xf4
push edx
call eax
mov esi, eax
test esi, esi
je 0x10011f4a
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push esi
call edi
push 1
push 0x100335bc
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push 1
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1003fd54]
mov ecx, dword [0x1003ca5c]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, 0xf4
push eax
call edx
mov esi, eax
test esi, esi
je 0x10011f4a
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call edi
push 1
push 0x100335c0
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100120c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x1003feb8], 0
push esi
push edi
jle 0x10012187
mov ecx, dword [0x1003ca5c]
mov edx, dword [0x1003fd54]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, 0x1c
push edx
call eax
cmp dword [eax], 0
je 0x10012187
mov eax, dword [0x1003feb8]
cmp eax, 1
jne 0x10012105
fld dword [0x10039440]
jmp 0x1001212a
cmp eax, 2
jne 0x10012112
fld dword [0x10034aa8]
jmp 0x1001212a
cmp eax, 3
jne 0x1001211f
fld dword [0x10034aa4]
jmp 0x1001212a
cmp eax, 4
jne 0x10012130
fld dword [0x10034aa0]
fstp dword [0x1004003c]
mov ecx, dword [0x1003ca5c]
mov eax, dword [0x1003fd54]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, 0x134
push eax
call edx
mov esi, eax
test esi, esi
je 0x100121d6
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call edi
push 1
push 0x100335bc
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x1003ca5c]
mov edx, dword [0x1003fd54]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, 0x134
push edx
call eax
mov esi, eax
test esi, esi
je 0x100121d6
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push esi
call edi
push 1
push 0x100336d4
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push 1
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100121e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x1003feb4], 0
push esi
push edi
jle 0x10012262
mov ecx, dword [0x1003ca5c]
mov edx, dword [0x1003fd54]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, 0x1c
push edx
call eax
cmp dword [eax], 0
je 0x10012262
mov ecx, dword [0x1003ca5c]
mov eax, dword [0x1003fd54]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, 0x13c
push eax
call edx
mov esi, eax
test esi, esi
je 0x100122b1
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call edi
push 1
push 0x100335bc
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x1003ca5c]
mov edx, dword [0x1003fd54]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, 0x13c
push edx
call eax
mov esi, eax
test esi, esi
je 0x100122b1
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 1
push esi
call edi
push 1
push 0x100336d4
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push 1
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret