joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007312e
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x100a5040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x10073179
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.100736e5
test al, al
jne 0x10073173
sub edx, 2
cmp edx, edi
jne 0x10073159
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x1007319b
lea eax, [edi + 2]
cmp edx, eax
je 0x1007319b
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.10072d27
add esp, 0x10
jmp 0x10073295
push esi
lea ecx, [ebp - 0x255]
call fcn.100736e5
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100731de
push dword [ebp - 0x25c]
jmp 0x1007318b
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x1007321b
cmp word [ebp - 0x226], 0
je 0x1007323c
cmp word [ebp - 0x226], ax
jne 0x1007321b
cmp word [ebp - 0x224], 0
je 0x1007323c
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.10072d27
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x10073288
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x100731f5
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x10073270
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x10073295
push 0x1007260d
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.10032819
add esp, 0x10
jmp 0x10073265
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100312c0
leave
ret

Function at 0x10081e91
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10031dbf
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10081f00
cmp esi, dword [ebp - 4]
je 0x10081efb
cmp dword [ebp + 0xc], 0
je 0x10081efb
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10081ed8
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100818b9
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10081f02
xor eax, eax
inc eax
jmp 0x10081f02
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100888eb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x100a68e0]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1008892b
cmp byte [ebx], 0xa
jne 0x1008892b
or byte [edi + eax + 0x28], 4
jmp 0x10088930
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10088a2f
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10088a12
inc eax
cmp dl, 0xd
je 0x1008895c
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10088982
cmp eax, ecx
jae 0x10088990
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10088944
jmp 0x10088a2f
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10088a0d
cmp dword [ebp - 0x10], 0
je 0x10088a0d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x100a68e0]
test byte [eax + edi + 0x28], 0x48
je 0x100889e7
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100889d2
mov byte [esi], dl
jmp 0x100889e3
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x100a68e0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10088a2f
cmp byte [ebp - 1], 0xa
jne 0x100889f6
cmp esi, ebx
jne 0x100889f6
mov byte [esi], 0xa
jmp 0x10088a2e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10030550
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10088a2f
mov byte [esi], 0xd
jmp 0x10088a2e
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x100a68e0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10088a2c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10088a2f
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10088a8b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x100a68e0]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10088ad1
cmp word [ebx], dx
jne 0x10088ad1
or byte [eax + edi + 0x28], 4
jmp 0x10088ad6
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10088c39
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10088c19
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10088b17
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10088b4d
cmp eax, edx
jae 0x10088b5b
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10088af2
jmp 0x10088c39
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10088c14
cmp dword [ebp - 0x18], 0
je 0x10088c14
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x100a68e0]
test byte [eax + edi + 0x28], 0x48
je 0x10088bea
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10088bae
mov word [esi], cx
jmp 0x10088be5
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x100a68e0]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x100a68e0]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x100a68e0]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10088c39
pop eax
cmp word [ebp - 4], ax
jne 0x10088bfa
cmp esi, ebx
jne 0x10088bfa
mov word [esi], ax
jmp 0x10088c36
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10030550
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10088c39
push 0xd
pop eax
jmp 0x10088bf5
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x100a68e0]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10088c33
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10088c39
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x6d5617f1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d5617fb
repz ret
jmp fcn.6d561b91

Function at 0x6d56184e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x6d56185d
pop dword [ebp - 0x40]
mov eax, 0x9a53cff9
add eax, 0xd3024864
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x9a007a6a
sub dword [ebp - 0x50], 0x4bae351f
mov dword [ebp - 0x4c], 0x640cc364
add dword [ebp - 0x4c], 0xce2688e1
mov dword [ebp - 0x48], 0xcd4d7355
add dword [ebp - 0x48], 0x7efed0d9
mov dword [ebp - 0x44], 0x55b513df
sub dword [ebp - 0x44], 0x55b513df
lea eax, [ebp - 0x50]
push eax
mov eax, 0x84b3291e
sub eax, 0x175cf8d6
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xc02e0e23
add dword [ebp - 0x50], 0xb4445b33
mov dword [ebp - 0x4c], 0x117717c4
add dword [ebp - 0x4c], 0x2ff549b1
mov dword [ebp - 0x48], 0x85b2539c
add dword [ebp - 0x48], 0xddbd18d0
mov dword [ebp - 0x44], 0xd377dd57
add dword [ebp - 0x44], 0x2c8822a9
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x1045782e
sub eax, 0xa2ef482e
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3712b
push 0
call eax
mov ecx, 0xac152c76
sub ecx, 0xac14e23e
mov edi, eax
mov edx, 0x46ec037f
add edx, 0x266a5e81
add edx, dword [ebp - 0x40]
mov esi, 0xdea4bb50
sub esi, 0xd87f426e
xor dword [ebp - 0x28], ebx
mov ebx, dword [edx]
mov dword [ebp - 0x14], 0x1ab41c47
sub ebx, esi
add dword [ebp - 0xc], ebx
mov dword [edi], ebx
add edi, 4
add edx, 0x22966210
sub edx, 0x2296620c
loop 0x6d56197f
add eax, 0x11bb3
mov ebx, eax
add eax, 0xa54b8787
add eax, 0x5ab4787e
mov ecx, 0xc05969ca
sub ecx, 0x530369ca
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x10d0058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.010d01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10d007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10d006a
add dl, dl
jne 0x10d0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10d00dc
xor eax, eax
add dl, dl
jne 0x10d0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10d017d
add dl, dl
jne 0x10d00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10d00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10d00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10d00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10d00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10d0075
mov eax, 1
add dl, dl
jne 0x10d00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10d00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10d00e1
sub eax, ebx
mov ebx, 1
jne 0x10d0128
mov ecx, 1
add dl, dl
jne 0x10d010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10d0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10d0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10d0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10d013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10d014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10d0136
cmp eax, 0x7d00
jae 0x10d016d
cmp eax, 0x500
jb 0x10d0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10d0075
cmp eax, 0x7f
ja 0x10d0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10d0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10d019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10d0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x41394c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x413952
ret

Function at 0x428310
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00401270
xor eax, eax
push ebp
push 0x428371
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
sub eax, 0x30
shl eax, 2
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
sub edx, 0x30
add edx, edx
add eax, edx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 2]
add eax, edx
sub eax, 0x30
add eax, 0x30
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428378
lea eax, [ebp - 4]
call fcn.004011e8
ret

Function at 0x468e58
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
test dl, dl
je 0x468e72
add esp, 0xfffffff0
call fcn.00401168
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x468f75
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.004672d4
mov byte [ebx + 0x2c], 0
mov dl, 1
mov eax, dword [0x464ec8]
call fcn.004010e0
mov dword [ebx + 0x20], eax
mov dl, 1
mov eax, dword [0x464ec8]
call fcn.004010e0
mov dword [ebx + 0x30], eax
mov edi, dword [esi + 0xc]
test edi, edi
je 0x468edb
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x14]
test al, al
jne 0x468ee5
cmp byte [esi + 0x1d], 2
je 0x468ee5
xor eax, eax
jmp 0x468ee7
mov al, 1
mov byte [ebx + 0x1c], al
mov dword [ebx + 0x38], 0xffffffff
xor eax, eax
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x24], esi
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x18], eax
test eax, eax
je 0x468f59
mov byte [ebx + 0x34], 1
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 8]
push eax
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x477f4c]
call fcn.004014a8
add esp, 4
mov eax, dword [ebx + 0x18]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 8]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x462580]
call fcn.00467fa0
mov dword [ebx + 0x28], eax
or edx, 0xffffffff
mov eax, ebx
call fcn.00469c9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468f7c
lea eax, [ebp - 0xc]
mov edx, dword [0x477f4c]
call fcn.004014b8
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40611c
pop dword [ebp - 0x2c]
mov eax, 0x40611c
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x1d04e107
add dword [ebp - 0x3c], 0x314d6444
mov dword [ebp - 0x38], 0x2c2ecb0a
sub dword [ebp - 0x38], 0xf9fb7ec5
mov dword [ebp - 0x34], 0x973a21cf
sub dword [ebp - 0x34], 0x4aeddda1
mov dword [ebp - 0x30], 0xc41e9210
add dword [ebp - 0x30], 0x3be16df0
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x1ac34be8
add eax, 0xe57d2478
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x214dd7bd
add dword [ebp - 0x3c], 0x53249199
mov dword [ebp - 0x38], 0xd1338587
sub dword [ebp - 0x38], 0x8fc72412
mov dword [ebp - 0x34], 0xcb2a4ec9
add dword [ebp - 0x34], 0x98451da3
mov dword [ebp - 0x30], 0x78fa153d
add dword [ebp - 0x30], 0x8705eac3
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x7bd463c5
sub eax, 0x7b93f2c5
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x38cdb
push 0
call eax
mov ecx, 0x875e5f55
add ecx, 0x78a1f173
xor ebx, ebx
add ebx, eax
mov edi, 0xd8625c99
add edi, 0x27dea367
add edi, dword [ebp - 0x2c]
mov edx, 0xe9b2d112
sub edx, 0xca2fba10
mov esi, dword [edi]
xor dword [ebp - 0x10], edi
add esi, edx
mov dword [ebp - 0x20], 0xba7535e
mov dword [ebx], esi
add dword [ebp - 0xc], 0x7528efec
add ebx, 0xe96e74e5
sub ebx, 0xe96e74e1
add edi, 0x964deb88
add edi, 0x69b2147c
loop 0x40623b
add eax, 0x135f3
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x103d605
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov edi, edi
mov ebp, esp
rdtsc
sub esp, 0x2c
mov dword [0x138b4cc], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0x80000000
cmp dword [0x136ece4], 0
mov dword [0x136ec9c], eax
jne 0x103d649
mov ecx, 0x136f81c
call fcn.012eb5ea
test eax, eax
jl 0x103d7eb
mov dword [0x136ece4], 1
push esi
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, 0x1000000
mov eax, dword [0x100003c]
mov ecx, dword [eax + 0x1000050]
mov eax, dword [ebp - 0x24]
lea esi, [eax - 0x80000000]
add ecx, edx
cmp ecx, esi
jb 0x103d679
lea eax, [ecx - 0x80000000]
mov ecx, dword [ebp - 0x20]
add eax, 0xffff
and eax, 0xffff0000
lea esi, [ecx - 0x80000000]
mov dword [0x1388f98], eax
cmp esi, edx
pop esi
jb 0x103d69b
mov ecx, 0x81000000
mov dword [0x13890b0], ecx
xor ecx, ecx
mov word [0x13890b0], cx
mov ecx, dword [0x13890b0]
sub ecx, eax
shr ecx, 0x10
xor eax, eax
mov dword [0x138acb4], ecx
test eax, eax
jl 0x103d7eb
mov ecx, dword [0x13891e0]
jmp 0x103d6ec
imul ecx, ecx, 0x18
add ecx, 0x1391270
call fcn.012eb5ea
test eax, eax
jl 0x103d6f1
mov ecx, dword [0x13891e0]
inc ecx
mov dword [0x13891e0], ecx
cmp ecx, 3
jb 0x103d6cd
test eax, eax
mov dword [ebp - 4], eax
jl 0x103d7eb
mov eax, dword [0x1007420]
test eax, eax
je 0x103d78b
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x1007420]
mov eax, dword [0x10fb370]
push 0x40
imul eax, ecx
push eax
push section..data
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x103d74c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x103d73e
mov eax, 0x54f
test eax, eax
jle 0x103d78d
and eax, 0xffff
or eax, 0x80070000
jmp 0x103d78d
mov eax, dword [0x1007420]
xor edx, edx
test eax, eax
jbe 0x103d78b
mov eax, dword [0x10fb370]
imul eax, edx
mov ecx, dword [0x10fb370]
lea eax, [eax + section..data]
test ecx, ecx
je 0x103d776
mov byte [eax], 0
inc eax
dec ecx
jne 0x103d76f
mov eax, dword [0x1007420]
mov dword [edx*4 + 0x1388f9c], 0xef0b
inc edx
cmp edx, eax
jb 0x103d757
xor eax, eax
test eax, eax
jl 0x103d7eb
mov ecx, dword [0x1391550]
test ecx, ecx
je 0x103d7d4
mov eax, dword [0x1391548]
lea edx, [eax + 0x1391578]
add eax, dword [0x139154c]
mov dword [0x1391560], edx
lea edx, [eax + 0x1391578]
mov dword [0x1391558], 0x1391578
mov dword [0x1391568], edx
lea eax, [eax + ecx + 0x1391578]
mov dword [0x1391570], eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, 0x3c2a67b6
mov eax, dword [ebp - 4]
test eax, eax
pop ecx
jl 0x103d7eb
xor eax, eax
leave
ret
Function at 0x103eb51
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
xor edi, edi
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x103ebae
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov edi, eax
jmp 0x103ebc9
cmp dword [ebp - 0x108], 2
jne 0x103ebc5
cmp dword [ebp - 0x114], 6
jb 0x103ebc5
xor eax, eax
inc eax
jmp 0x103ebc7
xor eax, eax
mov dword [esi], eax
test edi, edi
jge 0x103ebf2
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x103ebf2
test byte [eax + 0x3c], 2
je 0x103ebf2
push edi
push 0x10031e4
push 0x27
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0103e3fb
leave
ret 4

Function at 0x103ef69
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
push 0x11c
xor ebx, ebx
lea eax, [ebp - 0x120]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x103efc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov ebx, eax
jmp 0x103eff0
cmp dword [ebp - 0x11c], 6
jae 0x103efeb
cmp dword [ebp - 0x11c], 5
jne 0x103efe7
cmp dword [ebp - 0x118], 2
jne 0x103efe7
cmp word [ebp - 0xc], 2
jae 0x103efeb
xor eax, eax
jmp 0x103efee
xor eax, eax
inc eax
mov dword [edi], eax
test ebx, ebx
jge 0x103f019
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x103f019
test byte [eax + 0x3c], 2
je 0x103f019
push ebx
push 0x1003184
push 0xe
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0103e3fb
leave
ret 4

Function at 0x103fcbb
Capabilities:
Listen for remote procedure calls

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1388fd8]
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], eax
mov eax, dword [0x1388fdc]
mov esi, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x18], edi
je 0x103fced
push esi
lea ecx, [ebp - 0xc]
call fcn.0103e8e8
cmp dword [esi + 0x20], edi
je 0x103fd42
cmp dword [esi + 0x1c], edi
jne 0x103fd42
lea ecx, [ebp - 0xc]
call fcn.0103e913
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0x64
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
push eax
call fcn.0103ee7a
cmp dword [ebp - 4], edi
jge 0x103fd42
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x103fd42
test byte [eax + 0x3c], 2
je 0x103fd42
push dword [ebp - 4]
push 0x1003184
push 0xc
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 0xc]
call fcn.0103e913
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4