joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016d60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100770d1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x100b39fc]
test eax, eax
jne 0x10016f0d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100a883c]
mov dword [ebp - 0x20], 0x1471b9c8
mov dword [ebp - 0x1c], 0x7b81b79
mov dword [ebp - 0x18], 0x1f60a7ce
mov esi, dword [eax + ecx*4]
mov word [ebp - 0x14], 0x754a
mov eax, dword [esi + 0x1a30]
test al, 1
jne 0x10016e2c
or eax, 1
mov dword [esi + 0x1a30], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [esi + 0x462e], 1
nop dword [eax]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x4620], al
add ecx, 1
adc edx, 0
jne 0x10016e18
cmp ecx, 0xe
jb 0x10016e00
push 0x10086d10
call fcn.100745a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x4620]
mov ecx, edi
call fcn.1006e610
mov eax, dword [esi + 0x157c]
mov dword [ebp - 0x20], 0x384b9ed6
mov dword [ebp - 0x1c], 0x5d893045
mov dword [ebp - 0x18], 0x7169bbe5
test al, 1
jne 0x10016eac
or eax, 1
mov dword [esi + 0x157c], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [esi + 0x3508], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x34fc], al
add ecx, 1
adc edx, 0
jne 0x10016e98
cmp ecx, 0xc
jb 0x10016e80
push 0x10086d60
call fcn.100745a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x34fc]
mov ecx, esi
call fcn.1006e670
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x10016f06
push 7
call fcn.100744fe
add esp, 4
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x10016f08
xor eax, eax
mov dword [0x100b39fc], eax
push 0
push 0
push 0
push 1
push ebx
mov dword [0x100a98a8], eax
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10073bc9
mov esp, ebp
pop ebp
ret
Function at 0x10016f40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077161
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], edx
mov ebx, ecx
mov eax, dword [0x100b3a00]
test eax, eax
jne 0x100170dd
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100a883c]
movaps xmm0, xmmword [0x10098c70]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0xd5
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x14f4]
test al, 1
jne 0x10016ffc
or eax, 1
mov dword [esi + 0x14f4], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x1c85], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x1c74], al
add ecx, 1
adc edx, 0
jne 0x10016fe8
cmp ecx, 0x11
jb 0x10016fd0
push 0x10086db0
call fcn.100745a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x1c74]
mov ecx, edi
call fcn.1006e550
mov eax, dword [esi + 0x2d28]
mov dword [ebp - 0x20], 0xe42d6a82
mov dword [ebp - 0x1c], 0x3b05f66b
mov dword [ebp - 0x18], 0xad0f4fb1
test al, 1
jne 0x1001707c
or eax, 1
mov dword [esi + 0x2d28], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x3e50], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x3e44], al
add ecx, 1
adc edx, 0
jne 0x10017068
cmp ecx, 0xc
jb 0x10017050
push 0x10086e00
call fcn.100745a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x3e44]
mov ecx, esi
call fcn.1006e5b0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x100170d6
push 7
call fcn.100744fe
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x100170d8
xor eax, eax
mov dword [0x100b3a00], eax
push 0
push 0
push 3
push 0
push 0
push 0x50
push dword [ebp - 0x30]
mov dword [0x100aaa88], eax
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10073bc9
mov esp, ebp
pop ebp
ret
Function at 0x10017110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100771f1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [0x100b39ec]
test eax, eax
jne 0x100172bd
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100a883c]
movaps xmm0, xmmword [0x10098e10]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0xe1
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x1814]
test al, 1
jne 0x100171dc
or eax, 1
mov dword [esi + 0x1814], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x47e9], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x47d8], al
add ecx, 1
adc edx, 0
jne 0x100171c8
cmp ecx, 0x11
jb 0x100171b0
push 0x10086e50
call fcn.100745a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x47d8]
mov ecx, edi
call fcn.1006e490
mov eax, dword [esi + 0x38d4]
mov dword [ebp - 0x20], 0xca4ba2b6
mov dword [ebp - 0x1c], 0x3189f60f
mov dword [ebp - 0x18], 0x83698785
test al, 1
jne 0x1001725c
or eax, 1
mov dword [esi + 0x38d4], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x3498], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x348c], al
add ecx, 1
adc edx, 0
jne 0x10017248
cmp ecx, 0xc
jb 0x10017230
push 0x10086ea0
call fcn.100745a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x348c]
mov ecx, esi
call fcn.1006e4f0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x100172b6
push 7
call fcn.100744fe
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x100172b8
xor eax, eax
mov dword [0x100b39ec], eax
push 0
push 0x8404f700
push 0
push 0
push dword [ebp - 0x30]
mov dword [0x100aa570], eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10073bc9
mov esp, ebp
pop ebp
ret
Function at 0x10017300
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077281
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [0x100b3a58]
test eax, eax
jne 0x1001749d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100a883c]
movaps xmm0, xmmword [0x10099db0]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0x7f
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x19a0]
test al, 1
jne 0x100173bc
or eax, 1
mov dword [esi + 0x19a0], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x3dd9], 1
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x3dc8], al
add ecx, 1
adc edx, 0
jne 0x100173a8
cmp ecx, 0x11
jb 0x10017390
push 0x10086ef0
call fcn.100745a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x3dc8]
mov ecx, edi
call fcn.1006e3d0
mov eax, dword [esi + 0x2d2c]
mov dword [ebp - 0x20], 0xc8637c28
mov dword [ebp - 0x1c], 0x9505a005
mov dword [ebp - 0x18], 0x8141591b
test al, 1
jne 0x1001743c
or eax, 1
mov dword [esi + 0x2d2c], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x37c], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x370], al
add ecx, 1
adc edx, 0
jne 0x10017428
cmp ecx, 0xc
jb 0x10017410
push 0x10086f40
call fcn.100745a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x370]
mov ecx, esi
call fcn.1006e430
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x10017496
push 7
call fcn.100744fe
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x10017498
xor eax, eax
mov dword [0x100b3a58], eax
push dword [ebp + 0x10]
mov dword [0x100a9d34], eax
push dword [ebp - 0x30]
push dword [ebp + 8]
push dword [ebp - 0x34]
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10073bc9
mov esp, ebp
pop ebp
ret
Function at 0x100174d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077311
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [0x100b39f8]
test eax, eax
jne 0x1001766d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100a883c]
movaps xmm0, xmmword [0x100991b0]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0xd3
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x3d4]
test al, 1
jne 0x1001758c
or eax, 1
mov dword [esi + 0x3d4], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0xec5], 1
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0xeb4], al
add ecx, 1
adc edx, 0
jne 0x10017578
cmp ecx, 0x11
jb 0x10017560
push 0x10086f90
call fcn.100745a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0xeb4]
mov ecx, edi
call fcn.1006e310
mov eax, dword [esi + 0x2590]
mov dword [ebp - 0x20], 0x60d1a684
mov dword [ebp - 0x1c], 0x35b5ca9f
mov dword [ebp - 0x18], 0x29f383b7
test al, 1
jne 0x1001760c
or eax, 1
mov dword [esi + 0x2590], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x1e2c], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x1e20], al
add ecx, 1
adc edx, 0
jne 0x100175f8
cmp ecx, 0xc
jb 0x100175e0
push 0x10086fe0
call fcn.100745a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x1e20]
mov ecx, esi
call fcn.1006e370
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x10017666
push 7
call fcn.100744fe
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x10017668
xor eax, eax
mov dword [0x100b39f8], eax
push dword [ebp - 0x30]
mov dword [0x100b171c], eax
push 0x64
push dword [ebp - 0x34]
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10073bc9
mov esp, ebp
pop ebp
ret
Function at 0x100176a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100773a1
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x100b3a6c]
test eax, eax
jne 0x1001783d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100a883c]
movaps xmm0, xmmword [0x10098d40]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x670ab51d
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x150c]
test al, 1
jne 0x1001775c
or eax, 1
mov dword [esi + 0x150c], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x1a80], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x1a6c], al
add ecx, 1
adc edx, 0
jne 0x10017748
cmp ecx, 0x14
jb 0x10017730
push 0x10087030
call fcn.100745a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x1a6c]
mov ecx, edi
call fcn.1006e250
mov eax, dword [esi + 0x1b00]
mov dword [ebp - 0x1c], 0x2e21902e
mov dword [ebp - 0x18], 0x17b5b8a7
mov dword [ebp - 0x14], 0x6703b51d
test al, 1
jne 0x100177dc
or eax, 1
mov dword [esi + 0x1b00], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x9a0], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x1c]
mov byte [ecx + esi + 0x994], al
add ecx, 1
adc edx, 0
jne 0x100177c8
cmp ecx, 0xc
jb 0x100177b0
push 0x10087080
call fcn.100745a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x994]
mov ecx, esi
call fcn.1006e2b0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x10017836
push 7
call fcn.100744fe
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x10017838
xor eax, eax
mov dword [0x100b3a6c], eax
push ebx
mov dword [0x100aaac4], eax
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10073bc9
mov esp, ebp
pop ebp
ret
Function at 0x10023db0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100acc0c], 0
push esi
push edi
jle 0x10023e1a
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10023e1a
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x15c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10023e5a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10023e4e
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x15c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10023e5a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x68
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10073bc9
mov esp, ebp
pop ebp
ret
Function at 0x10025db0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077d31
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x100a883c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100b3a2c]
cmp eax, dword [ecx + 0xc]
jle 0x10025e45
push 0x100b3a2c
call fcn.10073fbb
add esp, 4
cmp dword [0x100b3a2c], 0xffffffff
jne 0x10025e45
mov dword [ebp - 4], 0
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x160
push eax
mov edx, dword [ecx]
call dword [edx + 4]
add eax, 4
mov dword [ebp - 4], 0xffffffff
push 0x100b3a2c
mov dword [0x100b39c8], eax
call fcn.10073f71
add esp, 4
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10025ed4
cmp dword [0x100acbdc], 0
je 0x10025ed4
mov eax, dword [0x100adaf8]
mov ecx, dword [eax + 0x2c8]
mov eax, dword [0x100aac10]
mov ecx, dword [eax + ecx]
call fcn.10018d30
mov esi, eax
test esi, esi
je 0x10025ed4
mov ecx, dword [0x100a98fc]
push 0x100ab014
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x10025ed4
mov edx, dword [0x100a9ee0]
add edx, eax
cmp edx, eax
jbe 0x10025ed4
mov ecx, esi
call edx
test eax, eax
jle 0x10025ed4
mov edi, dword [0x100b39c8]
cmp edi, 0x1000
jbe 0x10025f05
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
call esi
mov dword [edi], 0x3a8312a2
jmp 0x10025ef9
mov edi, dword [0x100b39c8]
cmp edi, 0x1000
jbe 0x10025f05
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
call esi
mov dword [edi], 0x3e19999a
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10073bc9
mov esp, ebp
pop ebp
ret
Function at 0x10025f20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
push esi
push edi
mov edx, dword [ecx]
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x100a98fc]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x100adaf8]
je 0x10025f8a
add eax, 0x168
cmp dword [0x100aa568], 0
push eax
je 0x10025f90
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10025fbd
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10025fb1
add eax, 0x168
push eax
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10025fbd
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10073bc9
mov esp, ebp
pop ebp
ret

Function at 0x100265b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x100ad4c4], 0
jne 0x10026613
mov edx, 0x54
xor eax, eax
mov cl, byte [eax + 0x10097ba0]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x18], cl
and edx, 0x800000ff
jns 0x100265e3
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x15
jl 0x100265c6
lea eax, [ebp - 0x18]
mov byte [ebp - 3], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add eax, 0xcdda
mov dword [0x100ad4c4], 1
mov dword [0x100ab0b8], eax
add eax, 0x18
mov dword [0x100aa000], eax
mov esp, ebp
pop ebp
ret
Function at 0x1002cc70
Capabilities:
Get hostname

Disassembly:
push 0x100a7458
push 0x100aaa58
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call fcn.1002cb80
cmp eax, 1
jne 0x1002cc9c
push str.Win_XP
push 0x100adeb0
call fcn.10007430
add esp, 8
call fcn.1002cb80
cmp eax, 2
jne 0x1002ccb8
push str.Win_Vista
push 0x100adeb0
call fcn.10007430
add esp, 8
call fcn.1002cb80
cmp eax, 3
jne 0x1002ccd4
push str.Win_7
push 0x100adeb0
call fcn.10007430
add esp, 8
call fcn.1002cb80
cmp eax, 4
jne 0x1002ccf0
push str.Win_8
push 0x100adeb0
call fcn.10007430
add esp, 8
call fcn.1002cb80
cmp eax, 5
jne 0x1002cd0c
push str.Wi_10
push 0x100adeb0
call fcn.10007430
add esp, 8
ret
Function at 0x1002fc40
Capabilities:
Get disk information

Disassembly:
push esi
push 0x64
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov esi, eax
push 0xff
push 0x100a9d80
push 0x100a98dc
push 0x100adc28
push 0x100b18d0
push 0xff
push 0x100ad758
push 0x10097eb0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [0x100b18d0]
mov eax, ecx
shl eax, 5
add eax, ecx
push eax
imul eax, ecx, 0x19
push eax
push str._2x_2x
push esi
call fcn.10007430
add esp, 0x10
mov eax, esi
pop esi
ret
Function at 0x10062bb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
mov esi, edx
mov edi, ecx
nop dword [eax]
cmp byte [edi], 0x6a
jne 0x10062c4e
cmp esi, 0x1000
jbe 0x10062c2a
cmp edi, 0x1000
jbe 0x10062c2a
lea eax, [ebp - 8]
push eax
push 0x80
push 7
push esi
call ebx
push 7
push edi
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push 7
push esi
call ebx
mov edx, dword [ebp + 8]
push ecx
lea ecx, [esi + 7]
lea edx, [edx + 7]
call fcn.100167e0
add esp, 4
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
jmp 0x10062cba
mov edx, dword [ebp + 8]
push ecx
lea ecx, [esi + 7]
lea edx, [edx + 7]
call fcn.100167e0
add esp, 4
cmp esi, 0x1000
jbe 0x10062cbd
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
jmp 0x10062cba
cmp esi, 0x1000
jbe 0x10062c98
cmp edi, 0x1000
jbe 0x10062c98
lea eax, [ebp - 0xc]
push eax
push 0x80
push 5
push esi
call ebx
push 5
push edi
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
push 5
push esi
call ebx
mov edx, dword [ebp + 8]
push ecx
lea ecx, [esi + 5]
lea edx, [edx + 5]
call fcn.100167e0
add esp, 4
jmp 0x10062cb2
mov edx, dword [ebp + 8]
push ecx
lea ecx, [esi + 5]
lea edx, [edx + 5]
call fcn.100167e0
add esp, 4
cmp esi, 0x1000
jbe 0x10062cbd
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 7
push esi
call ebx
mov al, byte [edi]
cmp al, 0x8b
je 0x10062cd4
cmp al, 0x6a
je 0x10062cd4
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10062bd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10073bc9
mov esp, ebp
pop ebp
ret