joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040049
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x1004009f
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x10040078
call fcn.10037357
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x1004008d
call fcn.10037357
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x1004009f
call fcn.10037357
call fcn.10034024
cmp dword [eax + 0x3c], 0
je 0x100400b4
push edi
mov ecx, ebx
call fcn.1003f76c
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.1004029a
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x100400dd
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x100400e9
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1004d66b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x1004d684
call fcn.10034024
mov esi, dword [eax + 0xc]
push 0x1019948c
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x1004d6c6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1004d6c6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x1004d6c6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.1004d6cf
jmp 0x1004d6c8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x100cf9f8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.10019b8e
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x100cfa34
call fcn.100cfc15
mov dword [esi + 0xc], 1
jmp 0x100cfa39
call fcn.100cfc15
cmp dword [esi], 0
je 0x100cfa84
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov ecx, esi
test edi, edi
jle 0x100cfa5f
push edi
call fcn.10018141
lea ecx, [edi + 1]
push ecx
jmp 0x100cfa6e
push 0xff
call fcn.10004f9a
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.1000a0e3
pop edi
jmp 0x100cfaa8
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x100cfaa8
push dword [esi]
push dword [ebp - 4]
call fcn.1003e588
pop esi
leave
ret 0xc
Function at 0x100cfb6c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.100cfc15
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x100cfbb4
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10018141
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.1000a0e3
jmp 0x100cfbbf
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.1003e588
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x100dd9ff
Capabilities:
Get file system object information

Disassembly:
push 0x274
mov eax, 0x1018b5db
call fcn.1015f9a4
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.100050e8
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x101c8fa0
call fcn.1000695a
cmp eax, 0xffffffff
jne 0x100ddada
push 0
push 0x101c956c
lea ecx, [ebp - 0x278]
call fcn.1000695a
cmp eax, 0xffffffff
jne 0x100ddada
push 0
push 0x101ca75c
lea ecx, [ebp - 0x278]
call fcn.1000695a
cmp eax, 0xffffffff
jne 0x100ddada
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.100050e8
add eax, 0x10
pop ecx
mov dword [ebp - 0x280], eax
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x114]
push ecx
push 0x104
push edx
push eax
lea edi, [eax - 0x10]
push edx
mov dword [ebp - 0x27c], edi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x100ddaa9
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x10192a68]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x27c]
mov edi, eax
call fcn.10003bf1
jmp 0x100ddb13
lea eax, [ebp - 0x114]
push eax
call fcn.1016dc10
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.1000520a
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.10003bf1
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x100ddb00
mov edi, dword [ebp - 0x274]
jmp 0x100ddb13
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x10192a68]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.10003bf1
mov eax, edi
call fcn.1015f953
ret

Function at 0x10125513
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.1016fb00
pop ecx
test eax, eax
jne 0x10125555
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10011b8a
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1012551b
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret
Function at 0x10179851
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101794ce

Function at 0x40302f
Capabilities:
Terminate process

Disassembly:
push 0x60
push 0x40fde8
call fcn.00407554
and dword [ebp - 4], 0
lea eax, [ebp - 0x70]
push eax
call dword [0x40e0a4]
mov dword [ebp - 4], 0xfffffffe
mov edi, 0x94
push edi
push 0
mov ebx, dword [0x40e0a0]
call ebx
push eax
call dword [0x40e09c]
mov esi, eax
test esi, esi
jne 0x402e9a
push 0x12
call fcn.00402dea
pop ecx
jmp 0x403024
mov dword [esi], edi
push esi
call dword [0x40e098]
push esi
push 0
test eax, eax
jne 0x402eb8
call ebx
push eax
call dword [0x40e094]
jmp 0x403024
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov edi, dword [esi + 0xc]
and edi, 0x7fff
call ebx
push eax
call dword [0x40e094]
mov esi, dword [ebp - 0x20]
cmp esi, 2
je 0x402eea
or edi, 0x8000
mov ecx, dword [ebp - 0x24]
push ecx
pop eax
shl eax, 8
mov edx, dword [ebp - 0x28]
add eax, edx
mov dword [0x434280], esi
mov dword [0x434288], eax
mov dword [0x43428c], ecx
mov dword [0x434290], edx
mov dword [0x434284], edi
call fcn.00402e0e
mov dword [ebp - 0x20], eax
sub ebx, ebx
inc ebx
push ebx
call fcn.004074f8
pop ecx
or eax, eax
jne 0x402f32
push 0x1c
call fcn.00402dea
pop ecx
call fcn.00404531
test eax, eax
jne 0x402f43
push 0x10
call fcn.00402dea
pop ecx
call fcn.00407455
mov dword [ebp - 4], ebx
call fcn.00407215
test eax, eax
jge 0x402f5c
push 0x1b
call fcn.00406706
pop ecx
call dword [0x40e090]
mov dword [0x435a58], eax
call fcn.004070e0
mov dword [0x433e30], eax
call fcn.00407027
test eax, eax
jge 0x402f82
push 8
call fcn.00406706
pop ecx
call fcn.00406db4
test eax, eax
jge 0x402f93
push 9
call fcn.00406706
pop ecx
push ebx
call fcn.00406822
pop ecx
or eax, eax
je 0x402fa5
push eax
call fcn.00406706
pop ecx
call fcn.00406d57
test byte [ebp - 0x44], bl
je 0x402fb5
movzx ecx, word [ebp - 0x40]
jmp 0x402fb8
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x400000
call main
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0
jne 0x402fd5
push eax
call fcn.00406982
call fcn.004069a4
jmp 0x40300a
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
jmp 0x403029
mov eax, 0xff
call fcn.00407599
ret
call fcn.00407746
jmp 0x402e4f

Function at 0x40b0c0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
cmp word [ecx], 0x5a4d
je 0x40b0ce
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40b0cb
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
push ecx
pop eax
ret

Function at 0x40b0f0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x40b12c
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x40b122
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x40b12e
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40b112
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x10001ca7
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x40
call fcn.100704ce
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 0x40
mov dword [ebp - 8], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop
nop
cmp dword [ebp - 8], esp
je 0x10001d08
push 0x2c
push 0x40145c7
push 6
call fcn.100704da
add esp, 0xc
mov ebx, dword [ebp - 4]
add ebx, 8
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
fild qword [ebx]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fdiv qword [0x1008b8f4]
fstp qword [ebp - 0x18]
push 0
push 0
push 0
push 0x80000601
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 2
mov ebx, 0x68
call fcn.100718b0
add esp, 0x1c
push 0x80000601
push edx
push eax
push 1
mov ebx, 0x198
call fcn.100717c0
add esp, 0x10
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call fcn.10001dc1
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x10001d80
push ebx
call fcn.100704d4
add esp, 4
mov eax, dword [ebp - 0x28]
jmp 0x10001d88
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.100704d4
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x1000257e
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x100025e2
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x100025cb
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x100025ba
xor ecx, eax
xor edx, ebx
dec edi
jne 0x100025ab
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x1000572b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x10005773
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.100704ce
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10005784
push ebx
call fcn.100704d4
add esp, 4
pop eax
mov dword [ebp - 4], eax
push htons
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000579b
mov eax, 0x1008929b
push eax
push 1
mov ebx, 0x194
call fcn.10071940
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
call fcn.10001f3a
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 1
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.10005904
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], esp
push 0x40
push 0x1000
push 0x64
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10005818
push 0x14e
push 0x4014628
push 6
call fcn.100704da
add esp, 0xc
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0x80000301
push 0
push dword [ebp - 0x14]
push 0xa0000101
push 0
push 0x1008bf19
push 3
mov ebx, 0x914
call fcn.100723e0
add esp, 0x28
push dword [ebp - 8]
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [ebp - 0x14]
mov dword [ebp - 0x18], esp
push 0x8000
push 0
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10005897
push 0xa61
push 0x4014628
push 6
call fcn.100704da
add esp, 0xc
mov dword [ebp - 0x18], esp
push 0x8000
push 0
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x100058cd
push 0xa8d
push 0x4014628
push 6
call fcn.100704da
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x100058e7
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.100704ce
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x100058ec
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100058fd
push ebx
call fcn.100704d4
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10007bca
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [0x1012e057]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10007c0d
push 0x19
push 0x4014602
push 6
call fcn.100704da
add esp, 0xc
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.10071950
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10007c43
push ebx
call fcn.100704d4
add esp, 4
pop eax
mov dword [ebp - 8], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x1008b904]
fstp qword [ebp - 0x18]
mov dword [ebp - 0x1c], esp
fld qword [ebp - 0x18]
call fcn.10001d9a
push eax
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x10007c91
push 0x88
push 0x4014602
push 6
call fcn.100704da
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x10007cad
push eax
mov ebx, eax
call fcn.1000176c
inc eax
push eax
call fcn.100704ce
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10007cb2
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10007cc3
push ebx
call fcn.100704d4
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x1000af10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [0x1012e057]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000af53
push 0x2b
push 0x401470a
push 6
call fcn.100704da
add esp, 0xc
mov dword [ebp - 0x18], eax
fild dword [ebp - 0x18]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x1008b904]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.10001d9a
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.10071950
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000afa6
push ebx
call fcn.100704d4
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000afdc
push 0x84
push 0x401470a
push 6
call fcn.100704da
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x1000aff8
push eax
mov ebx, eax
call fcn.1000176c
inc eax
push eax
call fcn.100704ce
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1000affd
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000b00e
push ebx
call fcn.100704d4
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100133c5
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.10013575
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x100134c3
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10013466
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x100134a9
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x1001347d
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x10013498
test al, 0x40
je 0x1001348f
mov ecx, dword [edi + 0x20]
jmp 0x10013496
test al, 0x80
je 0x100134a9
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x100134a9
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x10013435
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x10018972
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x100189ba
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.100704ce
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100189cb
push ebx
call fcn.100704d4
add esp, 4
pop eax
mov dword [ebp - 4], eax
push htons
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100189e2
mov eax, 0x1008929b
push eax
push 1
mov ebx, 0x194
call fcn.10071940
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
call fcn.10001f3a
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push dword [ebp + 0xc]
call fcn.10005904
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], esp
push 0x40
push 0x1000
push 0x64
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10018a58
push 0x146
push 0x4014627
push 6
call fcn.100704da
add esp, 0xc
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0x80000301
push 0
push dword [ebp - 0x14]
push 0xa0000101
push 0
push 0x1008c3f8
push 3
mov ebx, 0x914
call fcn.100723e0
add esp, 0x28
push dword [ebp - 8]
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [ebp - 0x14]
mov dword [ebp - 0x18], esp
push 0x8000
push 0
push dword [ebp - 0x14]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10018ad7
push 0xba6
push 0x4014627
push 6
call fcn.100704da
add esp, 0xc
mov dword [ebp - 0x18], esp
push 0x8000
push 0
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10018b0d
push 0xbd2
push 0x4014627
push 6
call fcn.100704da
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x10018b27
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.100704ce
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10018b2c
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10018b3d
push ebx
call fcn.100704d4
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10018c10
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getsockname
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, htons
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, cl
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
imul esi, esi, 0x666
mov dword [ebp - 4], esi
nop
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
mov eax, dword [ebp - 4]
jmp 0x10018cad
mov esp, ebp
pop ebp
ret