joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4971b6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c6b10]
jne 0x4971c0
repz ret
jmp fcn.0049bc1d

Function at 0x499f00
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c6b10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00494532
and dword [ebp - 0x14], 0
cmp dword [0x4c9cbc], 0
mov dword [ebp - 0x18], eax
jne 0x499fb3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49a05b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4a4030
push ebx
call edi
test eax, eax
je 0x49a05b
mov esi, dword [fcn.00490bb0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c9cbc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c9cc0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c9cc4], eax
call edi
push eax
call esi
mov dword [0x4c9ccc], eax
test eax, eax
je 0x499fb3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c9cc8], eax
mov eax, dword [0x4c9cc8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00490bb4]
cmp eax, ecx
je 0x49a00c
cmp dword [0x4c9ccc], ecx
je 0x49a00c
push eax
call esi
push dword [0x4c9ccc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x49a00c
test ebx, ebx
je 0x49a00c
call edi
test eax, eax
je 0x49a003
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x49a003
test byte [ebp - 8], 1
jne 0x49a00c
or dword [ebp + 0x10], 0x200000
jmp 0x49a03f
mov eax, dword [0x4c9cc0]
cmp eax, dword [ebp - 0x18]
je 0x49a03f
push eax
call esi
test eax, eax
je 0x49a03f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x49a03f
mov eax, dword [0x4c9cc4]
cmp eax, dword [ebp - 0x18]
je 0x49a03f
push eax
call esi
test eax, eax
je 0x49a03f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c9cbc]
call esi
test eax, eax
je 0x49a05b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x49a05d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004971b6
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x4f743488
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..rdata
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x78827206
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x10a05
Capabilities:
Create device object
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x10988]
test eax, eax
mov ecx, 0xbb40
je 0x10a1c
cmp eax, ecx
jne 0x10a3f
mov edx, dword [sym.imp.ntoskrnl.exe_KeTickCount]
mov eax, 0x10988
shr eax, 8
xor eax, dword [edx]
and eax, 0xffff
mov dword [0x10988], eax
jne 0x10a3f
mov eax, ecx
mov dword [0x10988], eax
not eax
mov dword [0x10984], eax
pop ebp
jmp 0x10670
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x1c66a2f
Capabilities:
Packed with generic packer

Disassembly:
repne scasb al, byte es:[edi]
mov dword [esp + 8], edi
lea esp, [esp + 0xc]
jne fcn.01e80da9
rcl si, 0xe
mov ecx, edi
bsr si, ax
xor si, cx
sub ecx, ebx
movsx esi, al
rcl esi, 3
adc si, cx
bsr esi, ebp
mov esi, esp
cmc
jmp 0x20cd638

Function at 0x20cd60e
Capabilities:
Packed with generic packer

Disassembly:
cmp dl, 0xb8
bt ax, bp
cmp edi, ebx
call fcn.020eb487
call fcn.020cfcd7
cmp ebx, edx
push edi
jnp 0x1e7bebb
cdq
sub ebp, esp
scasb al, byte es:[edi]
stc
mov eax, 0x34c0045e
fcom qword [esi - 0x42]
inc eax
lodsb al, byte [esi]
inc esp
jl 0x1e7bea4
sub eax, 0x16b0f57d
mov esp, 0x9f5fce23
adc ecx, esp
inc esi
dec edx
push eax
lodsd eax, dword [esi]
insb byte es:[edi], dx
or byte [edi + 0x79], ch
pop edx
loope 0x1e7be92
pop es
or eax, 0x5fd3f0e0
or byte [ebx], 0x5f
xchg edx, eax
out dx, eax
aam 0x14
mov eax, dword [edx - 0x69e3e8ec]
adc byte [edi + edx], 0x1c
xchg esi, eax
popal
insb byte es:[edi], dx
iretd
pop ebx
int1
shl ebx, 1
jg 0x1e7bea7
jecxz 0x1e7bf28
std
popfd
sbb ecx, ebp
stc
xchg ebx, eax
paddusb mm6, mm3
mov ah, 0xb6
pop esp
invalid
daa
xchg ecx, eax
adc ecx, edi
inc edi
in eax, 0xb1
popal
and edx, dword [eax]
adc al, 0x57
cwde
clc
adc al, 0xee
fdiv st(5), st(0)
mov ebp, 0x4dd53fc9
shr cl, cl
xlatb
stosd dword es:[edi], eax
push edi
add dword [edi - 0x7e170299], ebp
add edx, dword [ecx + 0xc1be4ff]
sbb eax, 0x82eae449
xlatb
xchg ecx, eax
call fcn.0178c261
in al, 0x1b
or al, 0x1d
dec ecx
in al, 0xea
adc bh, 0x91
push esi
cmp eax, dword [ecx]
jle 0x1e7bedb
cmp byte [esi + 0x47], 0x61
div byte [ebp + 0xe]
xchg esp, eax
sub byte [eax + 0x60d48cfa], bl
xor dword [edi - 0x333b7a60], esi
cmp byte [edi + 0x47], 0x3b
push cs
push ss
and eax, 0xb6945966
and esi, esi
push eax
sub al, 0xc8
pop es
xor al, 0x65
mov dl, 0xac
enter 0x24c2, 0x28
mov byte [0x2fc111], al
dec edi
popal
mov ch, byte [esi - 0x49]
xchg ecx, eax
pop esp
or ebp, dword ss:[edi]
cmp dword [ebp + 0x15], ebp
xchg ebp, eax
and byte [edi], bl
mov dl, 0xff
lodsd eax, dword gs:[esi]
mov bh, 0x6b
or eax, 0x63f761a3
pop gs
adc dword [edi - 0x13], edi
imul eax, dword [esi + 0x14], 0x57
xchg edi, eax
ret 0x5a4a
movzx ecx, word [edi + ecx*2]
bsf di, cx
pushal
rcr edi, 2
mov word [esp], si
mov edi, dword [edx + 0x1c]
mov byte [esp + 0xc], bh
add edi, eax
cmp dh, ch
bt sp, sp
clc
mov edi, dword [edi + ecx*4]
cmc
pushfd
call fcn.01c676e5
cmc
test cl, ch
sub edi, 4
clc
clc
cmp ax, 0x2105
cmp dx, 0x28b
push dword [edi]
jmp 0x1e7be41
Function at 0x10022f00
Capabilities:
Encode data using xor

Disassembly:
and dword [ebp + 0x3c], ecx
mov eax, 0x17b35f33
lds esp, [esi + 0x34]
sub al, 0x68
push edi
cmp dword [ebp - 0x7c056541], eax
test dword [edi + 0x4c83fa9a], edi
xor ebx, dword [edx]
cmp eax, 0xe59a542
mov ch, byte [ecx + 0x3e]
dec ebx
insd dword es:[edi], dx
jecxz 0x10022ee2
add eax, 0x57eeff2e
pop esi
pop esi
cmp al, 0xb5
dec edx
dec ecx
cli
popfd
aad 0xe3
int1
sbb esi, dword [esi + 0x76342c88]
inc dword [eax + 0x73]
dec ebp
jmp 0x466ad163

Function at 0x1002a0b0
Capabilities:
Authenticate hmac

Disassembly:
insd dword es:[edi], dx
out 0x30, eax
and eax, 0xd8fbc92e
or al, 0x80
in al, dx
sbb eax, 0x65f598f4
dec ebx
xchg edx, eax
add ecx, dword [edi]
pop ecx
and byte [ebx - 0x7fc12f92], al
cmp al, byte [esi]
imul edx, ebp, 0x6e
and eax, 0x66f16264
sub byte [ebp - 0x35], al
test byte [eax - 0x3b], 0x54
dec eax
inc eax
lds edx, [eax + ecx*2 + 0x55]
push ebp
inc dword [ecx + 0x49b2f1b9]
inc eax
sub al, 0xed
imul esp, dword [ecx], 0x5f
push esp
out dx, al
call edi
adc dl, byte [edi]
jge 0x1002a048
movsb byte es:[edi], byte [esi]
or esp, dword [eax + 0x1d79abcd]
xchg bh, bh
xchg ebx, eax
jo 0x1002a0b6
xor al, ch
inc ebp
push ds
push ss
jae 0x1002a018
jecxz 0x1002a07a
mov ebp, 0xf36534fa
pushfd
push es
adc byte [esi - 0xa], ah
pop ds
neg byte [edi]
inc ebp
pop ebx
mov esi, 0x407466c7
out 0x56, al
ljmp 0x2517
add eax, 0x37db7466
dec ecx
xchg edx, eax
sub ch, byte [ebp + 0x5e]
jae 0x1002a104
jae 0x1002a044
frstor dword [ecx]
xor eax, 0x28f996f3
loope 0x1002a052
adc byte [edi + 0x26a180a4], al
fist word [ecx - 0x3d]
sbb dword gs:[ecx], 0xb0796739
jmp 0x1002a11f
scasb al, byte es:[edi]
mov bl, 0xb1
iretd
inc edx
out dx, al
add esp, esi
pop esp
lea esi, [ebp + 0x2e]
push dword [ebx + 0x3fd80c65]
invalid

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x46f569e0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x243a114a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10001220
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
mov dword [ebp - 0x14], 0
cmp byte [ebp + 0xc], 0
mov eax, ecx
push edi
mov edi, edx
mov dword [ebp - 4], eax
cmovne esi, edi
test esi, esi
jne 0x10001249
mov byte [ebp - 8], 0
jmp 0x10001269
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, dword [ebp - 4]
setne byte [ebp - 8]
push edi
push eax
push dword [ebp + 8]
call fcn.10019b40
add esp, 0xc
cmp byte [ebp - 8], 0
je 0x10001293
mov eax, dword [ebp - 0xc]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100012a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], ecx
cmp byte [ebp + 0xc], 0
mov eax, edx
push edi
cmovne esi, eax
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x18], edi
test esi, esi
jne 0x100012c7
xor bl, bl
jmp 0x100012ec
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
setne bl
push eax
push dword [ebp + 8]
mov byte [ebp - 0xc], bl
push ecx
call fcn.10019b40
add esp, 0xc
test bl, bl
je 0x10001315
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0xc], eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002590
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 8]
mov bl, byte [esi]
test eax, eax
je 0x100025d7
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100025e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002ce80
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push esi
push edi
mov eax, dword [0x100a7040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x1c], 0
sub edi, esi
jne 0x10002628
mov byte [ebp - 0x10], 0
jmp 0x1000263e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
push eax
push 0x40
push edi
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
push edi
push 0x90
push esi
call fcn.1001a2c0
add esp, 0xc
cmp byte [ebp - 0x10], 0
je 0x10002666
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push esi
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov dword [esi], 0x90909090
mov byte [esi + 4], 0x90
cmp byte [ebp - 0x10], 0
je 0x100026a7
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
call ebx
mov eax, dword [0x100a9974]
test al, 1
jne 0x100026c5
or eax, 1
push 0x1002d8f0
mov dword [0x100a9974], eax
call fcn.1001888d
add esp, 4
push 0x100048e0
mov edx, esi
lea ecx, [ebp - 0x90]
call fcn.10006360
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x90]
mov eax, dword [0x100a9890]
push ecx
cmp eax, dword [0x100a9894]
je 0x10002705
mov ecx, eax
call fcn.10007830
add dword [0x100a9890], 0x70
jmp 0x10002710
push eax
mov ecx, 0x100a988c
call fcn.10004ea0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 1
call fcn.100056f0
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x10002747
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x10002747
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x10002747
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x90]
call fcn.10006900
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002ce80
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push esi
push edi
mov eax, dword [0x100a7040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x1c], 0
sub edi, esi
jne 0x100027b8
mov byte [ebp - 0x10], 0
jmp 0x100027ce
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
push eax
push 0x40
push edi
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
push edi
push 0x90
push esi
call fcn.1001a2c0
add esp, 0xc
cmp byte [ebp - 0x10], 0
je 0x100027f6
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push esi
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov dword [esi], 0x90909090
mov byte [esi + 4], 0x90
cmp byte [ebp - 0x10], 0
je 0x10002837
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
call ebx
mov eax, dword [0x100a9940]
test al, 1
jne 0x10002855
or eax, 1
push 0x1002d8e0
mov dword [0x100a9940], eax
call fcn.1001888d
add esp, 4
push 0x10004980
mov edx, esi
lea ecx, [ebp - 0x90]
call fcn.10006360
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x90]
mov eax, dword [0x100a9884]
push ecx
cmp eax, dword [0x100a9888]
je 0x10002895
mov ecx, eax
call fcn.10007830
add dword [0x100a9884], 0x70
jmp 0x100028a0
push eax
mov ecx, 0x100a9880
call fcn.10004ea0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 1
call fcn.100056f0
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x100028d7
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x100028d7
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x100028d7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x90]
call fcn.10006900
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002900
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002ce80
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push esi
push edi
mov eax, dword [0x100a7040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x1c], 0
sub edi, esi
jne 0x10002948
mov byte [ebp - 0x10], 0
jmp 0x1000295e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
push eax
push 0x40
push edi
push esi
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
push edi
push 0x90
push esi
call fcn.1001a2c0
add esp, 0xc
cmp byte [ebp - 0x10], 0
je 0x10002986
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
call ebx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push esi
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x1c], esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov dword [esi], 0x90909090
mov byte [esi + 4], 0x90
cmp byte [ebp - 0x10], 0
je 0x100029c7
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
call ebx
mov eax, dword [0x100a9964]
test al, 1
jne 0x100029e5
or eax, 1
push 0x1002d8d0
mov dword [0x100a9964], eax
call fcn.1001888d
add esp, 4
push 0x100049f0
mov edx, esi
lea ecx, [ebp - 0x90]
call fcn.10006360
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x90]
mov eax, dword [0x100a98ac]
push ecx
cmp eax, dword [0x100a98b0]
je 0x10002a25
mov ecx, eax
call fcn.10007830
add dword [0x100a98ac], 0x70
jmp 0x10002a30
push eax
mov ecx, 0x100a98a8
call fcn.10004ea0
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], 1
call fcn.100056f0
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x10002a67
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x10002a67
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x10002a67
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea ecx, [ebp - 0x90]
call fcn.10006900
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret