joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f92c5b8
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x4f92c88e
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x73256533
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x7324d4f9
push 0xffffffffffffffff
call fcn.4f9237b8
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x4f92c622
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.4f92c63a
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x4f92c882
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x4f92c856
Function at 0x4f93c088
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f93c0aa
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f93c0aa
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f93c0aa
ret
cmp word [ebx + 4], 0x14c
jne 0x4f93c0aa
test word [ebx + 0x16], 2
je 0x4f93c0aa
test word [ebx + 0x16], 0x100
je 0x4f93c0aa
cmp word [ebx + 0x18], 0x10b
jne 0x4f93c0aa
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f93c0aa
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f93c136
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f93c0ca
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.4f923015
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f93c0aa
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x4f93c136
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x4f93c0aa
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x4f93c0aa
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x4f93c0aa
ret
cmp word [ebx + 4], 0x14c
jne 0x4f93c0aa
test word [ebx + 0x16], 2
je 0x4f93c0aa
test word [ebx + 0x16], 0x100
je 0x4f93c0aa
cmp word [ebx + 0x18], 0x10b
jne 0x4f93c0aa
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x4f93c0aa
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x4f93c136
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x4f93c0ca
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.4f923015
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4f93c0aa
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x4f93c1ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f93c246
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f93c1ed
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f93c1fc
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x4fd41e9f
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f93c24d
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.4f9230c3
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f93c2ec
add edi, 4
add eax, 2
dec ecx
jne 0x4f93c232
call 0x4f93c299
loope 0x4f93c28f
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f93c2e9
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f93c2fa
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f93c2ad
cmp eax, ecx
ja 0x4f93c2ad
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f93c337
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f93c32d
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.4f9235a2
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x4f93c1fc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x4f93c246
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x4f93c1ed
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x4f93c1fc
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x4fd41e9f
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x4f93c24d
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.4f9230c3
cmp eax, dword [ebp + 0xc]
pop eax
je 0x4f93c2ec
add edi, 4
add eax, 2
dec ecx
jne 0x4f93c232
call 0x4f93c299
loope 0x4f93c28f
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x4f93c2e9
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x4f93c2fa
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x4f93c2ad
cmp eax, ecx
ja 0x4f93c2ad
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x4f93c337
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x4f93c32d
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.4f9235a2
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x100011a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push 0x401000
call fcn.10001380
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
call fcn.10003a00
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x10001201
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x53ec8b55
jne 0x10001213
mov eax, 0x3e9
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x401000
call fcn.10003990
cmp eax, 0x16197be9
jne 0x1000122e
mov eax, 0x3ea
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8245bc
call fcn.10003990
cmp eax, 0x94bf
jne 0x10001249
mov eax, 0x3f3
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8252fc
call fcn.10003990
cmp eax, 0x94bf
jne 0x10001264
mov eax, 0x44d
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x82533c
call fcn.10003990
cmp eax, 0x94bf
jne 0x1000127f
mov eax, 0x457
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858d51
call fcn.10003990
cmp eax, 0x3539f633
jne 0x1000129a
mov eax, 0xc80
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858c61
call fcn.10003990
xor ecx, ecx
mov edx, 0xc8a
cmp eax, 0x3539f633
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x100032b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor ecx, ecx
mov dword [ebp - 0x10], 0
cmp byte [ebp + 0x14], cl
cmovne ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x100032cf
mov byte [ebp - 4], cl
jmp 0x100032ec
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000fea0
add esp, 0xc
cmp byte [ebp - 4], 0
je 0x1000331a
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x14]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x14], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x10003320
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor ecx, ecx
cmp byte [ebp + 0x14], cl
push ebx
cmovne ecx, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
test ecx, ecx
jne 0x1000333e
xor bl, bl
jmp 0x1000335d
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [ebp - 0x10]
test eax, eax
setne bl
push dword [ebp + 0x10]
mov byte [ebp - 4], bl
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.1000fea0
add esp, 0xc
test bl, bl
je 0x1000338a
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x14]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x14], eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003390
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub eax, 1
je 0x100033c4
sub eax, 1
je 0x1000341d
sub eax, 2
je 0x1000347d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
sub bl, al
mov bh, byte [ebp + 0x14]
dec bl
mov dword [ebp - 4], eax
movzx ecx, bh
mov dword [ebp - 0x18], 0
test bh, bh
jne 0x100033e9
mov byte [ebp - 0xc], bh
mov byte [eax], bl
jmp 0x10003420
lea edx, [ebp - 0x10]
mov dword [ebp - 0x14], ecx
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0x18], eax
call edi
mov ecx, dword [ebp - 4]
test eax, eax
setne byte [ebp - 0xc]
mov byte [ecx], bl
test eax, eax
je 0x10003420
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call edi
jmp 0x10003420
mov bh, byte [ebp + 0x14]
mov eax, dword [ebp - 8]
sub eax, esi
mov dword [ebp - 0x18], 0
mov esi, dword [ebp + 8]
sub eax, esi
movzx eax, ax
mov dword [ebp - 8], eax
movzx ecx, ax
movzx eax, bh
add eax, eax
jne 0x1000344a
mov byte [ebp - 0xc], 0
mov word [esi], cx
jmp 0x1000347d
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call edi
mov ecx, dword [ebp - 8]
test eax, eax
setne byte [ebp - 0xc]
mov word [esi], cx
test eax, eax
je 0x1000347d
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
add eax, esi
mov ebx, dword [ebp + 0xc]
sub ebx, eax
mov dword [ebp - 0x18], 0
movzx eax, byte [ebp + 0x14]
shl eax, 2
test eax, eax
jne 0x100034a8
mov byte [ebp - 0xc], al
mov dword [esi], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], ebx
test eax, eax
je 0x100034d7
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x18]
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100034e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
movzx ebx, byte [ebp + 0x10]
mov dword [ebp - 0x14], edx
push esi
mov esi, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test ebx, ebx
jne 0x10003505
xor cl, cl
jmp 0x10003520
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push ecx
push 0x40
push ebx
push eax
mov dword [ebp - 0x14], eax
call edi
mov edx, dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp + 0xc]
setne cl
mov byte [ebp - 8], cl
mov ch, byte [esi]
mov byte [ebp + 0x13], ch
test cl, cl
je 0x10003543
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edx
call edi
mov eax, dword [ebp + 0xc]
mov ch, byte [ebp + 0x13]
movzx ecx, ch
sub ecx, 0xe8
je 0x1000361c
sub ecx, 1
je 0x1000361c
sub ecx, 0x16
jne 0x1000360c
mov dword [ebp - 0x14], ecx
lea esi, [eax + 1]
test ebx, ebx
jne 0x10003572
xor cl, cl
jmp 0x1000358a
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x14], esi
call edi
test eax, eax
mov eax, dword [ebp + 0xc]
setne cl
mov byte [ebp - 8], cl
mov dl, byte [esi]
mov byte [ebp + 0x13], dl
test cl, cl
je 0x100035af
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
mov eax, dword [ebp + 0xc]
mov dl, byte [ebp + 0x13]
cmp dl, 0x15
je 0x100035b9
cmp dl, 0x25
jne 0x1000360c
shl ebx, 2
lea esi, [eax + 2]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test ebx, ebx
jne 0x100035cc
xor al, al
jmp 0x100035e4
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x14], esi
call edi
mov ecx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov esi, dword [esi]
test al, al
je 0x100035fe
mov eax, dword [ebp - 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0x10], eax
push ecx
call edi
mov eax, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl ebx, 2
lea esi, [eax + 1]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test ebx, ebx
jne 0x1000362f
xor al, al
jmp 0x10003647
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x14], esi
call edi
mov ecx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov ebx, dword [esi]
test al, al
je 0x10003661
mov eax, dword [ebp - 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0x10], eax
push ecx
call edi
mov eax, dword [ebp + 8]
lea ecx, [ebx + 4]
pop edi
add ecx, esi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003900
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push dword [ebp + 8]
call fcn.10001380
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
call fcn.10003a00
mov dword [ebp - 0x18], 0
mov esi, dword [eax]
xor eax, eax
cmp byte [ebp + 0x10], al
cmovne eax, dword [ebp + 0xc]
test eax, eax
jne 0x1000393c
mov byte [ebp - 0xc], al
jmp 0x10003956
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
push dword [ebp + 0xc]
push 0x90
push esi
call fcn.10010570
add esp, 0xc
cmp byte [ebp - 0xc], 0
je 0x10003984
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003990
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push ecx
call fcn.10001380
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
call fcn.10003a00
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x100039ed
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003a80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x10], edx
push ebx
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x10003a9c
xor al, al
jmp 0x10003ab8
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x10]
test eax, eax
setne al
mov byte [ebp - 4], al
mov bl, byte [esi]
test al, al
je 0x10003ad6
mov ecx, dword [ebp - 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp - 0xc]
mov dword [ebp + 0xc], ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c700
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002bb5d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x10039180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.1000e810
mov edi, eax
add esp, 4
test edi, edi
je 0x1000c79d
push 1
mov dword [ebp - 4], 0
call fcn.1000da70
add esp, 4
mov dword [edi + 4], eax
jmp 0x1000c79f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.10002af0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x1000c7fa
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x1000c7fa
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x1000c816
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1000c839
cmp byte [ebp + 0xc], 0
je 0x1000c825
push esi
call fcn.1000e176
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1000c845
mov esi, str.ios_base::badbit_set
jmp 0x1000c855
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.10001da0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10002750
push 0x10038538
lea eax, [ebp - 0x28]
push eax
call fcn.1000f9cb
int3
Function at 0x1000c9e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ecx]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov edx, dword [eax + 8]
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push ebx
push 5
push ecx
mov eax, esp
mov dword [eax], esi
call edx
push ebx
push ecx
mov eax, esp
push dword [ebp + 8]
mov dword [eax], esi
call fcn.100034e0
add esp, 0xc
movzx eax, bl
mov dword [ebp - 0x14], 0
test bl, bl
jne 0x1000ca28
mov byte [ebp - 8], bl
mov byte [esi], 0xe8
jmp 0x1000ca61
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
call ebx
test eax, eax
setne byte [ebp - 8]
mov byte [esi], 0xe8
test eax, eax
je 0x1000ca5e
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call ebx
mov ebx, dword [ebp + 0x14]
push ebx
push 4
push ecx
mov ecx, esp
inc esi
push ecx
mov dword [ecx], edi
mov ecx, esp
mov dword [ecx], esi
call fcn.10003390
mov eax, dword [ebp + 8]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10