joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100932d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [0x108c93d8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call edi
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0x100930e0
push 2
call esi
cmp dword [0x108c81c4], 0
mov dword [0x108c78b4], eax
jne 0x10093320
call edi
push eax
mov eax, dword [0x108c81bc]
push eax
push 0x10092ca0
push 7
call esi
mov dword [0x108c81c4], eax
test eax, eax
je 0x10093384
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10092c60
push 5
sub ecx, 0x4d0e34
push 0x4d0e2f
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x1009337e
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x4d0e2f
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x4d0e2f
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x10093384
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100946b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x10093e50
push 0x5914ab
mov bl, 0xe8
call fcn.10110d60
push 0x10093e50
push 0x5914c7
call fcn.10110d60
push 0x10093e50
push 0x5a0652
call fcn.10110d60
push 0x10093e50
push 0x5a0775
call fcn.10110d60
push 0x10093e50
push 0x5b6cf4
call fcn.10110d60
push 0x10093e50
push 0x7e05a8
call fcn.10110d60
push 0x10093eb0
push 0x6f2ddc
call fcn.10110d60
push 0x10093eb0
push 0x74a6c3
call fcn.10110d60
add esp, 0x40
push 0x10093eb0
push 0x74a791
call fcn.10110d60
push 0x10093eb0
push 0x74a7cc
call fcn.10110d60
push 0x10093eb0
push 0x74a807
call fcn.10110d60
push 0x10093eb0
push 0x74a842
call fcn.10110d60
push 0x10093eb0
push 0x74a87d
call fcn.10110d60
push 0x10093eb0
push 0x74a8d7
call fcn.10110d60
push 0x10093eb0
push 0x74a912
call fcn.10110d60
push 0x10093eb0
push 0x74a94d
call fcn.10110d60
add esp, 0x40
push 0x10093eb0
push 0x74a988
call fcn.10110d60
push 0x10093eb0
push 0x74aa05
call fcn.10110d60
push 0x10093eb0
push 0x74aa40
call fcn.10110d60
push 0x10093eb0
push 0x74aa7b
call fcn.10110d60
push 0x10093eb0
push 0x74aab6
call fcn.10110d60
push 0x10093eb0
push 0x74aaf8
call fcn.10110d60
push 0x10093eb0
push 0x74ab33
call fcn.10110d60
push 0x10093eb0
push 0x74ab6e
call fcn.10110d60
add esp, 0x40
push 0x10093eb0
push 0x74abad
call fcn.10110d60
add esp, 8
mov esi, 7
mov ebx, 0x566178
call fcn.1010cff0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10093d50
push 5
sub eax, 0x56617d
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x10094899
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x1009489f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 6
mov ebx, 0x56595e
call fcn.1010cff0
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10093dd0
push 5
sub ecx, 0x565963
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x100948f5
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x100948fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10097020
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp byte [0x118cf3a9], bl
je 0x1009733f
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x10173f14]
mov esi, eax
cmp byte [0x118cf3a9], bl
je 0x1009733d
mov eax, 0x1f6
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10097093
cmp dword [ebp + 8], 0x201
je 0x10097106
mov dword [0xe8cb3c], ebx
cmp esi, 0x12c
jb 0x1009733d
mov dword [0x10173f00], 1
call edi
mov dword [0x10173f14], eax
cmp byte [0x118cf3a9], bl
je 0x1009733d
mov eax, 0x1f7
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x100970de
cmp dword [ebp + 8], 0x201
je 0x10097106
mov dword [0xe8cb3c], ebx
cmp esi, 0x12c
jb 0x1009733d
mov dword [0x10173f00], 2
call edi
mov dword [0x10173f14], eax
cmp byte [0x118cf3a9], bl
je 0x1009733d
mov eax, 0x1f8
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10097172
cmp dword [ebp + 8], 0x201
jne 0x10097117
pop edi
pop esi
mov dword [0xe8cb3c], 1
pop ebx
pop ebp
ret 4
mov dword [0xe8cb3c], ebx
cmp esi, 0x12c
jb 0x1009733d
mov dword [0x10173f00], 3
call edi
mov edx, 1
mov dword [0x10173f14], eax
mov byte [0x118c7b3d], 1
mov dword [0xe8cb3c], edx
mov byte [0x118c77f5], dl
mov dword [0xe8cb3c], edx
mov byte [0x118c7999], dl
mov dword [0xe8cb3c], edx
mov byte [0x118cf3a9], bl
mov dword [0xe8cb3c], ebx
jmp 0x10097177
mov edx, 1
cmp byte [0x118cf3a9], bl
je 0x1009733d
mov eax, 0x1f9
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x100971f9
cmp dword [ebp + 8], 0x201
je 0x10097311
mov dword [0xe8cb3c], ebx
cmp esi, 0x12c
jb 0x1009733d
mov dword [0x10173f00], 4
call edi
mov dword [0x10173f14], eax
mov eax, 1
mov byte [0x118c7b3d], 1
mov dword [0xe8cb3c], eax
mov byte [0x118c77f5], al
mov dword [0xe8cb3c], eax
mov byte [0x118c7999], al
mov dword [0xe8cb3c], eax
mov byte [0x118cf3a9], bl
mov dword [0xe8cb3c], ebx
mov edx, eax
cmp byte [0x118cf3a9], bl
je 0x1009733d
mov eax, 0x1fa
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x1009724d
cmp dword [ebp + 8], 0x201
je 0x10097311
mov dword [0xe8cb3c], ebx
cmp esi, 0x12c
jb 0x1009733d
mov dword [0x10173f00], 5
call edi
mov dword [0x10173f14], eax
mov edx, 1
cmp byte [0x118cf3a9], bl
je 0x1009733d
mov eax, 0x1fb
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x100972a1
cmp dword [ebp + 8], 0x201
je 0x10097311
mov dword [0xe8cb3c], ebx
cmp esi, 0x12c
jb 0x1009733d
mov dword [0x10173f00], 6
call edi
mov dword [0x10173f14], eax
mov edx, 1
cmp byte [0x118cf3a9], bl
je 0x1009733d
mov eax, 0x1fc
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x100972ed
cmp dword [ebp + 8], 0x201
je 0x10097311
mov dword [0xe8cb3c], ebx
cmp esi, 0x12c
jb 0x1009733d
mov dword [0x10173f00], 7
call edi
mov dword [0x10173f14], eax
mov edx, 1
cmp byte [0x118cf3a9], bl
je 0x1009733d
mov eax, 0x1fd
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x1009733d
cmp dword [ebp + 8], 0x201
jne 0x1009731e
pop edi
pop esi
mov dword [0xe8cb3c], edx
pop ebx
pop ebp
ret 4
mov dword [0xe8cb3c], ebx
cmp esi, 0x12c
jb 0x1009733d
mov dword [0x10173f00], 8
call edi
mov dword [0x10173f14], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100978c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push edi
call fcn.10097a60
xor ebx, ebx
cmp byte [0x118cf3a9], bl
je 0x10097a55
mov eax, 0x203
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10097955
cmp dword [0x10173f00], 1
jne 0x10097955
call esi
sub eax, dword [0x118cf890]
cmp edi, 0x201
jne 0x10097920
pop esi
mov byte [0x118cf894], 1
mov dword [0xe8cb3c], 1
mov al, 1
pop ebx
ret
mov byte [0x118cf894], bl
mov dword [0xe8cb3c], ebx
cmp eax, 0x1f4
jae 0x10097938
pop esi
xor al, al
pop ebx
ret
call esi
mov dword [0x118cf890], eax
mov eax, 1
call fcn.10095350
mov byte [0x118cf3a9], bl
mov dword [0xe8cb3c], ebx
cmp byte [0x118cf3a9], bl
je 0x10097a55
mov eax, 0x204
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x100979d7
cmp dword [0x10173f00], 1
jne 0x100979d7
call esi
sub eax, dword [0x118cf8e4]
cmp edi, 0x201
jne 0x100979a3
pop esi
mov byte [0x118cf8e8], 1
mov dword [0xe8cb3c], 1
mov al, 1
pop ebx
ret
mov byte [0x118cf8e8], bl
mov dword [0xe8cb3c], ebx
cmp eax, 0x1f4
jb 0x10097933
call esi
mov dword [0x118cf8e4], eax
mov eax, 2
call fcn.10095350
mov byte [0x118cf3a9], bl
mov dword [0xe8cb3c], ebx
cmp byte [0x118cf3a9], bl
je 0x10097a55
mov eax, 0x205
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10097a55
cmp dword [0x10173f00], 1
jne 0x10097a55
call esi
sub eax, dword [0x118cf938]
cmp edi, 0x201
jne 0x10097a21
pop esi
mov byte [0x118cf93c], 1
mov dword [0xe8cb3c], 1
mov al, 1
pop ebx
ret
mov byte [0x118cf93c], bl
mov dword [0xe8cb3c], ebx
cmp eax, 0x1f4
jb 0x10097933
call esi
mov dword [0x118cf938], eax
mov eax, 3
call fcn.10095350
mov byte [0x118cf3a9], bl
mov dword [0xe8cb3c], ebx
pop esi
mov al, 1
pop ebx
ret

Function at 0x10097a60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x118cf3a9], 0
mov edx, eax
je 0x10097acc
mov eax, 0x1f5
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10097acc
cmp dword [ebp + 8], 0x201
jne 0x10097a9f
mov al, 1
mov byte [0x118cf3fc], al
pop esi
pop ebp
ret 4
sub edx, dword [0x118cf3f8]
mov byte [0x118cf3fc], 0
cmp edx, 0x1f4
jb 0x10097acc
call esi
mov dword [0x118cf3f8], eax
mov byte [0x118cf3a9], 0
mov dword [0xe8cb3c], 0
xor al, al
pop esi
pop ebp
ret 4
Function at 0x10099700
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebx
cmp byte [0x118ceebd], 0
mov esi, eax
je 0x100997f5
mov eax, 0x1e6
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x1009979a
mov eax, esi
sub eax, dword [0x118cef0c]
cmp edi, 0x201
jne 0x10099755
mov eax, 1
pop esi
mov byte [0x118cef10], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x118cef10], 0
mov dword [0xe8cb3c], 0
cmp eax, 0x1770
jb 0x100997f5
call ebx
mov dword [0x118cef0c], eax
lea eax, [ebp - 4]
mov ecx, 4
push eax
mov dword [0x10173f48], 0xffffffff
mov dword [ebp - 4], 0x16fc04c1
call fcn.10100800
add esp, 4
mov eax, 0x1e7
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x100997f5
sub esi, dword [0x118cef60]
cmp edi, 0x201
jne 0x100997d0
mov eax, 1
pop esi
mov byte [0x118cef64], al
mov dword [0xe8cb3c], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x118cef64], 0
mov dword [0xe8cb3c], 0
cmp esi, 0x1f4
jb 0x100997f5
call ebx
mov dword [0x118cef60], eax
call fcn.10097ae0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1009b670
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
xor ebx, ebx
mov edx, eax
cmp byte [0x118cb64d], bl
je 0x1009b6df
mov eax, 0x140
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x1009b6df
cmp dword [ebp + 8], 0x201
jne 0x1009b6b2
pop esi
mov byte [0x118cb898], 1
pop ebx
pop ebp
ret 4
sub edx, dword [0x118cb894]
mov byte [0x118cb898], bl
cmp edx, 0x1f4
jb 0x1009b6df
call esi
mov dword [0x118cb894], eax
mov byte [0x118cb64d], bl
mov dword [0xe8cb3c], ebx
mov byte [0x118cb67d], bl
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1009b6f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
xor ebx, ebx
mov edx, eax
cmp byte [0x118cb64d], bl
je 0x1009b77f
mov eax, 0x141
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x1009b77f
cmp byte [0x118cb8ee], bl
je 0x1009b77f
cmp dword [ebp + 8], 0x201
jne 0x1009b73a
pop esi
mov byte [0x118cb8ec], 1
pop ebx
pop ebp
ret 4
sub edx, dword [0x118cb8e8]
mov byte [0x118cb8ec], bl
cmp edx, 0x1f4
jb 0x1009b77f
call esi
mov dword [0x118cb8e8], eax
lea eax, [ebp + 8]
mov ecx, 4
push eax
mov dword [ebp + 8], 0x3ff04c1
call fcn.10100800
mov byte [0x118cb64d], bl
mov dword [0xe8cb3c], ebx
add esp, 4
mov byte [0x118cb67d], bl
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1009b840
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10144410
push 0x1012e15a
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x1014a018]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14c], eax
push ecx
push str..PhysicalDrive_d
lea edx, [ebp - 0x12c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push esi
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x148], edi
cmp edi, 0xffffffff
je 0x1009b9f2
xor eax, eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], esi
push esi
lea ecx, [ebp - 0x150]
push ecx
push 8
lea edx, [ebp - 0x140]
push edx
push 0xc
lea eax, [ebp - 0x138]
push eax
push 0x2d1400
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call ebx
test eax, eax
jne 0x1009b924
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1009b9f2
mov ecx, dword [ebp - 0x13c]
push ecx
call fcn.1012baac
mov esi, eax
mov dword [ebp - 0x144], esi
mov edx, dword [ebp - 0x13c]
push edx
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0x10
push 0
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
push esi
push 0xc
lea edx, [ebp - 0x138]
push edx
push 0x2d1400
push edi
call ebx
test eax, eax
jne 0x1009b983
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
jmp 0x1009b9f2
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1009b970
mov dword [ebp - 4], 0
add eax, esi
push eax
push 0x100
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1009b9f4
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.1012db16
mov esp, ebp
pop ebp
ret 4
Function at 0x100a6760
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4cfa8f
call esi
mov edi, 0x2ac7
lea ecx, [ebp - 4]
push ecx
mov dword [0x4cfa8f], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x4cfa8f
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x60d985
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x60d985], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x60d985
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x60f356
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x60f356], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x60f356
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x6103ee
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x6103ee], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x6103ee
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x969c60
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x969c60], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x969c60
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x969b3f
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x969b3f], 0x2f8220
mov edx, dword [ebp - 4]
push edx
push 4
push 0x969b3f
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x969b60
call esi
mov edi, 0x2ec7
lea ecx, [ebp - 4]
push ecx
mov dword [0x969b60], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x969b60
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x969b6f
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x969b6f], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x969b6f
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x969bad
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x969bad], 0x2f821c
mov edx, dword [ebp - 4]
push edx
push 4
push 0x969bad
call esi
push 0x100a62d0
push 0x572b9b
mov bl, 0xe9
call fcn.10110d60
push 0x100a6310
push 0x572ec5
call fcn.10110d60
push 0x100a6550
push 0x8c5bb5
mov bl, 0xe8
call fcn.10110d60
push fcn.100a56b0
push 0x4e199d
call fcn.10110d60
push fcn.100a56b0
push 0x587049
call fcn.10110d60
push fcn.100a56b0
push 0x590ccc
call fcn.10110d60
push fcn.100a56b0
push 0x5bbee6
call fcn.10110d60
push fcn.100a56b0
push 0x64229d
call fcn.10110d60
add esp, 0x40
push fcn.100a56b0
push 0x642d51
call fcn.10110d60
push fcn.100a56b0
push 0x643229
call fcn.10110d60
push fcn.100a56b0
push 0x65ea86
call fcn.10110d60
push fcn.100a56b0
push 0x911a53
call fcn.10110d60
push fcn.100a56b0
push 0x911a6d
call fcn.10110d60
push fcn.100a56b0
push 0x911a87
call fcn.10110d60
push fcn.100a56b0
push 0x911aa1
call fcn.10110d60
push fcn.100a56b0
push 0x911abb
call fcn.10110d60
add esp, 0x40
push 0x100a5520
push 0x633ffb
call fcn.10110d60
push 0x100a6130
push 0x55a35f
call fcn.10110d60
push 0x100a6350
push 0x48e32c
mov bl, 0xe9
call fcn.10110d60
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100aaa90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x118c503c]
cmp eax, 0x5dc
jb 0x100aab30
push ebx
call esi
xor ebx, ebx
cmp byte [0x118c5041], 1
mov dword [0x118c503c], eax
jne 0x100aaad5
mov byte [0x118c5041], bl
mov dword [0xe8cb3c], ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov byte [0x118c6b29], bl
mov dword [0xe8cb3c], ebx
call fcn.100a8470
lea eax, [ebp - 8]
mov ecx, 4
push eax
mov dword [0x116ff08c], ebx
mov dword [ebp - 8], 0xe7f304c1
call fcn.10100800
lea edx, [ebp - 8]
mov ecx, 5
push edx
mov dword [ebp - 8], 0xe6f305c1
mov dword [0x116ff084], ebx
mov byte [ebp - 4], bl
call fcn.10100800
add esp, 8
mov byte [0x118c5041], 1
mov dword [0xe8cb3c], ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100ae9e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x649e27
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x649e27], 0xe
mov edx, dword [ebp - 4]
push edx
push 1
push 0x649e27
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x556c38
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x556c38], 2
mov edx, dword [ebp - 4]
push edx
push 1
push 0x556c38
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x100ae4f0
push 5
sub eax, 0x5509d3
xor edi, edi
push 0x5509ce
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x100aea8d
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x5509ce
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x5509ce
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100aea93
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x100ae9d0
push 5
sub ecx, 0x551578
push 0x551573
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x100aeae3
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x551573
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x551573
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100aeae9
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100aee50
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ecx, ecx
push edi
mov dword [ebp - 4], ecx
lea edi, [ecx + 1]
mov esi, 2
lea edx, [esi + 1]
mov eax, 0xf0f0f0f1
mul edx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x1023476b]
xor al, byte [esi + 0x1023471e]
movzx ebx, al
mov eax, 0xf0f0f0f1
mul esi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x1023476a]
xor al, byte [edi + 0x1023471e]
add esi, 4
movzx edx, al
add bx, dx
mov eax, 0xf0f0f0f1
mul edi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x10234769]
xor al, byte [ecx + 0x1023471e]
add edi, 4
movzx edx, al
add bx, dx
mov eax, 0xf0f0f0f1
mul ecx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x10234768]
xor al, byte [ecx + 0x1023471d]
add ecx, 4
movzx edx, al
add bx, dx
add word [ebp - 4], bx
cmp esi, 0x22
jb 0x100aee64
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 4]
mov edx, dword [0xd227b0]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
shr ecx, 8
sub cl, 0x74
mov byte [0x108c6c0b], cl
lea ecx, [ebp - 4]
push ecx
sub al, 0x4d
push 0x40
mov byte [0x108c8370], al
mov eax, dword [0xd227f8]
push 4
push 0xd227b0
mov dword [0x108c8378], edx
mov dword [0x108c8374], eax
call esi
lea edx, [ebp - 4]
push edx
mov dword [0xd227b0], 0x100aeb80
mov eax, dword [ebp - 4]
push eax
push 4
push 0xd227b0
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 4
push 0xd227f8
call esi
lea edx, [ebp - 4]
push edx
mov dword [0xd227f8], 0x100aebe0
mov eax, dword [ebp - 4]
push eax
push 4
push 0xd227f8
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret