joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005e20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x627499
call esi
mov bl, 0xeb
lea ecx, [ebp - 4]
push ecx
mov byte [0x627499], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x627499
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x62749f
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x62749f], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x62749f
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x6276c6
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x6276c6], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x6276c6
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x6276cc
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x6276cc], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x6276cc
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x627763
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x627763], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x627763
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x627769
call esi
mov byte [0x627769], bl
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push 0x627769
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x627498
call esi
mov bl, 0x69
lea ecx, [ebp - 4]
push ecx
mov byte [0x627498], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x627498
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x6276c5
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x6276c5], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x6276c5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x627762
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x627762], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x627762
call esi
push 0x10006000
push 0x52aa39
mov bl, 0xe8
call fcn.1000d250
push 0x10006000
push 0x52aa80
call fcn.1000d250
push 0x10006000
push 0x639c8d
call fcn.1000d250
push 0x10006000
push 0x7c35ab
call fcn.1000d250
push 0x10006000
push 0x7d230f
call fcn.1000d250
push 0x10006000
push 0x99170c
call fcn.1000d250
push 0x10006050
push 0x998a14
call fcn.1000d250
add esp, 0x38
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100060a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x55e421
call esi
mov bl, 0xff
lea ecx, [ebp - 4]
push ecx
mov byte [0x55e421], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x55e421
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x55e422
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x55e422], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x55e422
call esi
push 0x100061c0
push 0x4e79aa
mov bl, 0xe8
call fcn.1000d250
push 0x100061c0
push 0x59134c
call fcn.1000d250
push 0x100061c0
push 0x596fa3
call fcn.1000d250
push 0x100061c0
push 0x5b0a19
call fcn.1000d250
push 0x100061c0
push 0x63b28c
call fcn.1000d250
push 0x100061c0
push 0x63be40
call fcn.1000d250
push 0x100061c0
push 0x63c5ac
call fcn.1000d250
push 0x100061c0
push 0x8b93ca
call fcn.1000d250
add esp, 0x40
push 0x100061c0
push 0x8b93e3
call fcn.1000d250
push 0x100061c0
push 0x8b93fc
call fcn.1000d250
push 0x100061c0
push 0x8b9415
call fcn.1000d250
push 0x100061c0
push 0x8b942e
call fcn.1000d250
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009840
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x420
mov eax, dword [0x1001a170]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
push edi
lea esi, [esp + 0x10]
call fcn.100019b0
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x89ab8]
mov eax, str.ServerInfo.sse
call fcn.10001af0
test al, al
jne 0x100098a1
push str._Error__ReadMainFile_1:_Failed_to_calculate_CRC_for_the_main_file.
call fcn.1000d320
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.10010263
mov esp, ebp
pop ebp
ret
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.ServerInfo.sse
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100098e5
push str._Error__ReadMainFile_2:_Failed_to_open_the_main_file.
call fcn.1000d320
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.10010263
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x89ab4
je 0x1000991f
push str._Error__ReadMainFile_3:_Unexpected_size_for_the_main_file.
call fcn.1000d320
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.10010263
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x89ab4
lea esi, [ebx + 4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10009949
push str._Error__ReadMainFile_4:_Failed_to_read_the_main_file_data.
jmp 0x100098fa
mov dword [esp + 0x410], 0x6a3b6ae3
mov dword [esp + 0x414], 0x6b1fc1a7
mov dword [esp + 0x418], 0xaafa3c18
mov dword [esp + 0x41c], 0x2d01d0f1
mov dword [esp + 0x420], 0x5a0d4d3c
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov eax, ecx
sub eax, edx
mov al, byte [esp + eax + 0x410]
mov edx, ecx
shr edx, 8
xor dl, al
mov dl, byte [esi + ecx]
xor dl, al
xor dl, cl
mov byte [esi + ecx], dl
inc ecx
cmp ecx, 0x89ab4
jb 0x10009982
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x424]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.10010263
mov esp, ebp
pop ebp
ret
Function at 0x100099e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x518
mov eax, dword [0x1001a170]
xor eax, esp
mov dword [esp + 0x514], eax
cmp dword [edi + 0xf4], 0
push ebx
push esi
je 0x10009add
push 0x103
lea eax, [esp + 0x415]
push 0
push eax
mov byte [esp + 0x41c], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x414]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10009a56
push str._Error__CheckClientFile_1:_Failed_to_get_the_module_file_name.
call fcn.1000d320
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ebx, [edi + 0xd3]
push ebx
lea esi, [esp + 0x414]
call fcn.1000d2d0
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x10009a8c
push str._Error__CheckClientFile_2:_Unexpected_client_file_name.
call fcn.1000d320
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea esi, [esp + 0x10]
call fcn.100019b0
mov edx, esi
push edx
lea esi, [esp + 0x10]
mov eax, ebx
call fcn.10001af0
test al, al
jne 0x10009abc
push str._Error__CheckClientFile_3:_Failed_to_calculate_CRC_for_the_client_file.
call fcn.1000d320
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [edi + 0xf4]
cmp eax, dword [esp + 0xc]
je 0x10009add
push str._Error__CheckClientFile_4:_Client_file_CRC_does_not_match.
call fcn.1000d320
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x51c]
pop esi
pop ebx
xor ecx, esp
call fcn.10010263
mov esp, ebp
pop ebp
ret
Function at 0x10009b00
Capabilities:
Encode data using xor
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x1001a170]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_fread]
lea ecx, [eax + 0xf8]
push esi
add eax, 0x198
push edi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [eax], 0
je 0x10009c2a
lea esi, [esp + 0x20]
call fcn.100019b0
mov edx, dword [esp + 0x14]
push 0x10015ecc
push edx
lea eax, [esp + 0x18]
push eax
or esi, 0xffffffff
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
jne 0x10009c6c
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov ecx, dword [esp + 0x14]
add esp, 4
mov edi, eax
push ecx
test edi, edi
je 0x10009c63
push 0x400
push 1
push edi
call ebx
add esp, 0x10
test eax, eax
je 0x10009be6
mov ecx, edi
test eax, eax
je 0x10009bd0
movzx ebx, byte [ecx]
mov edx, esi
and edx, 0xff
xor edx, ebx
shr esi, 8
xor esi, dword [esp + edx*4 + 0x20]
inc ecx
dec eax
jne 0x10009bb2
mov ebx, dword [sym.imp.MSVCR100.dll_fread]
mov eax, dword [esp + 0x10]
push eax
push 0x400
push 1
push edi
call ebx
add esp, 0x10
test eax, eax
jne 0x10009bac
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.MSVCR100.dll_fclose]
mov edx, dword [esp + 0x20]
not esi
add esp, 8
cmp dword [edx], esi
jne 0x10009c81
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10009c96
push str.EntryProc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009c2a
call eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
add dword [esp + 0x14], 0x20
inc ecx
add eax, 4
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
cmp ecx, 5
jl 0x10009b41
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10010263
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
push str._Error__CheckPluginFile_1:_Failed_to_calculate_CRC_for_a_plugin_file.
call fcn.1000d320
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._Error__CheckPluginFile_2:_Plugin_file_CRC_does_not_match.
call fcn.1000d320
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str._Error__CheckPluginFile_3:_Failed_to_load_a_plugin_file.
call fcn.1000d320
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000a5d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
call fcn.1000b680
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [0x1012f2c4], ecx
mov edx, dword [esi + 0x50]
mov dword [0x1012f2c8], edx
mov dword [0x1012f2bc], eax
mov eax, dword [esi + 0x54]
mov dword [0x1012f2cc], eax
mov ecx, dword [esi + 0x58]
mov dword [0x1012f2d0], ecx
mov edx, dword [esi + 0x5c]
mov dword [0x1012f2d4], edx
mov eax, dword [esi + 0x60]
mov dword [0x1012f2d8], eax
mov ecx, dword [esi + 0x64]
mov dword [0x1012f2dc], ecx
mov edx, dword [esi + 0x68]
mov dword [0x1012f2e0], edx
mov eax, dword [esi + 0x6c]
mov dword [0x1012f2e4], eax
mov ecx, dword [esi + 0x70]
mov dword [0x1012f320], ecx
mov edx, dword [esi + 0x74]
mov dword [0x1012f324], edx
mov eax, dword [esi + 0x78]
mov dword [0x1012f328], eax
mov ecx, dword [esi + 0x7c]
mov dword [0x1012f32c], ecx
mov edx, dword [esi + 0x80]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x1012f330], edx
mov eax, dword [0x7f05cac]
xor ecx, ecx
mov word [eax + 0x7e], cx
mov edx, dword [0x7f05cac]
mov byte [edx + 0x328], cl
mov eax, dword [0x8499dcc]
movzx ecx, byte [eax + 0xb]
lea edx, [ebp - 4]
push edx
push 0x40
push 1
and ecx, 7
mov bl, byte [ecx + 0x100a4644]
push 0x55b6a2
call esi
lea eax, [ebp - 4]
push eax
mov byte [0x55b6a2], bl
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x55b6a2
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a7c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx edx, word [eax + 4]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0xe], dx
movzx edx, word [eax + 6]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x74], dx
movzx edx, word [eax + 0x10]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x18], dx
movzx edx, word [eax + 0x12]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x1a], dx
movzx edx, word [eax + 0x14]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x1c], dx
movzx edx, word [eax + 0x16]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x1e], dx
movzx edx, word [eax + 0x18]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x20], dx
movzx edx, word [eax + 0x1a]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x22], dx
movzx edx, word [eax + 0x1c]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x26], dx
movzx edx, word [eax + 0x1e]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x24], dx
movzx edx, word [eax + 0x20]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x28], dx
movzx edx, word [eax + 0x22]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x40], dx
movzx edx, word [eax + 0x24]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x42], dx
movzx edx, word [eax + 0x26]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x2a], dx
movzx edx, word [eax + 0x28]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x2c], dx
movzx edx, word [eax + 0x2a]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x4c], dx
movzx edx, word [eax + 0x2c]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x4e], dx
movzx edx, word [eax + 0x2e]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x50], dx
movzx edx, word [eax + 0x30]
mov ecx, dword [0x8499dcc]
mov word [ecx + 0x52], dx
mov ecx, dword [0x8499dcc]
mov edx, dword [eax + 8]
mov dword [ecx + 0x10], edx
mov ecx, dword [0x8499dcc]
mov edx, dword [eax + 0xc]
mov dword [ecx + 0x14], edx
mov ecx, dword [eax + 0x70]
mov dword [0x8b158c0], ecx
mov edx, dword [eax + 0x74]
mov dword [0x8b158c4], edx
mov ecx, dword [eax + 0x78]
mov dword [0x8b158c8], ecx
mov edx, dword [eax + 0x7c]
mov dword [0x8b158cc], edx
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x38]
mov dword [0x1012f2c4], edx
mov dword [0x1012f2bc], ecx
mov ecx, dword [eax + 0x3c]
mov dword [0x1012f2c8], ecx
mov edx, dword [eax + 0x40]
mov dword [0x1012f2cc], edx
mov ecx, dword [eax + 0x44]
mov dword [0x1012f2d0], ecx
mov edx, dword [eax + 0x48]
mov dword [0x1012f2d4], edx
mov ecx, dword [eax + 0x4c]
mov dword [0x1012f2d8], ecx
mov edx, dword [eax + 0x50]
mov dword [0x1012f2dc], edx
mov ecx, dword [eax + 0x54]
mov dword [0x1012f2e0], ecx
mov edx, dword [eax + 0x58]
mov dword [0x1012f2e4], edx
mov ecx, dword [eax + 0x5c]
mov dword [0x1012f320], ecx
mov edx, dword [eax + 0x60]
mov dword [0x1012f324], edx
mov ecx, dword [eax + 0x64]
mov dword [0x1012f328], ecx
mov edx, dword [eax + 0x68]
mov dword [0x1012f32c], edx
mov ecx, dword [eax + 0x6c]
mov dword [0x1012f330], ecx
mov edx, dword [eax + 8]
mov dword [0x1012f308], edx
mov ecx, dword [eax + 0xc]
mov dword [0x1012f30c], ecx
mov edx, dword [eax + 0x70]
mov dword [0x1012f310], edx
mov ecx, dword [eax + 0x74]
mov dword [0x1012f314], ecx
mov edx, dword [eax + 0x78]
mov dword [0x1012f318], edx
mov eax, dword [eax + 0x7c]
mov dword [0x1012f31c], eax
ret
Function at 0x1000b600
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1012f3c8], 2
jne 0x1000b67b
mov edx, dword [0x1012f268]
mov eax, dword [0x1012f264]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov ax, word [0x1012f26c]
lea edx, [ebp - 0x10]
push esi
mov ecx, 0xe
push edx
mov dword [ebp - 0x10], 0x3f30ec1
mov word [ebp - 4], ax
call fcn.1000ac10
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 4
mov dword [0x1012f3c4], 1
mov dword [0x1012f3c8], 3
call esi
mov dword [0x1012f3cc], eax
call esi
mov dword [0x1012f3d0], eax
mov eax, 0x7530
mov dword [0x1012f3d4], eax
mov dword [0x1012f3d8], eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000b680
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor ebx, ebx
cmp dword [0x1012f3c8], 3
push esi
jne 0x1000b6b4
cmp dword [0x1012f3e0], ebx
je 0x1000b6b4
lea eax, [ebp - 8]
lea ecx, [ebx + 5]
push eax
mov dword [ebp - 8], 0x51bf05c1
mov byte [ebp - 4], bl
call fcn.1000ac10
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1012f3c4], ebx
mov dword [0x1012f3c8], ebx
call esi
mov dword [0x1012f3cc], eax
call esi
pop esi
mov dword [0x1012f3d4], ebx
mov dword [0x1012f3d8], ebx
mov dword [0x1012f3dc], ebx
mov dword [0x1012f3e0], ebx
mov dword [0x1012f3d0], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d060
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x1012f4a4]
push esi
test eax, eax
jne 0x1000d08d
mov eax, dword [0x11c3e7c]
push 0x1000d190
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x1012f4a4], eax
test eax, eax
je 0x1000d0d8
mov ecx, dword [0x11c3e7c]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1000d0be
mov edx, dword [0x11c3e7c]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov esi, 0x1012f4a0
call fcn.1000d0e0
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x11c3e7c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov esi, 0x1012f4a0
call fcn.1000d0e0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000d1f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call edi
fld dword [ebp + 8]
mov edx, dword [ebp - 4]
fstp dword [esi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push esi
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000d220
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 8
push esi
call edi
fld qword [ebp + 0xc]
mov edx, dword [ebp + 8]
fstp qword [esi]
lea ecx, [ebp + 8]
push ecx
push edx
push 8
push esi
call edi
pop edi
pop esi
pop ebp
ret
Function at 0x1000d250
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call edi
cmp bl, 0xff
je 0x1000d271
mov byte [esi], bl
mov ecx, dword [ebp + 0xc]
sub ecx, esi
sub ecx, 5
lea edx, [ebp - 4]
push edx
mov dword [esi + 1], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000d290
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
mov ecx, dword [ebp + 0xc]
push esi
push ecx
push edi
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push esi
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d390
Capabilities:
Get common file path
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x1001a170]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x1000d3c9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10010263
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
lea edx, [ebp - 0x108]
push edx
mov byte [ebp - 0x105], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x1000d3b9
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, word [ebp - 0x10e]
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x10c]
and ecx, 0xf5fb
shl edx, 0x10
or ecx, edx
xor ecx, 0x15ca2020
push ecx
movzx ecx, word [ebp - 0x130]
shl ecx, 0xe
mov edx, eax
shr edx, 2
or ecx, edx
push ecx
mov ecx, dword [ebp - 0x11c]
shl ecx, 0x10
or ecx, eax
imul eax, eax
imul ecx, ecx, 0x14ce1989
push ecx
sub eax, 0x13b06451
push eax
push 0x12ba1074
push str._08X__08X__08X__08X__08X
push 0x1012f5bc
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x1c
mov eax, 0x1012f5bc
call fcn.10010263
mov esp, ebp
pop ebp
ret
Function at 0x1000d480
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x43a119
call esi
lea ecx, [ebp - 4]
push ecx
mov word [0x43a119], di
mov edx, dword [ebp - 4]
push edx
push 2
push 0x43a119
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x43fdf3
call esi
lea ecx, [ebp - 4]
push ecx
mov word [0x43fdf3], di
mov edx, dword [ebp - 4]
push edx
push 2
push 0x43fdf3
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x994bee
call esi
mov cl, byte [ebp + 0xc]
lea edx, [ebp - 4]
push edx
mov byte [0x994bee], cl
mov eax, dword [ebp - 4]
push eax
push 1
push 0x994bee
call esi
lea ecx, [ebp + 0xc]
push ecx
push 0x40
push 2
push 0x994c19
call esi
mov dx, word [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
mov word [0x994c19], dx
mov ecx, dword [ebp + 0xc]
push ecx
push 2
push 0x994c19
call esi
mov edx, dword [ebp + 8]
mov dword [0x1012f2a0], edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000f8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov ecx, edi
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x1000f8e4
mov eax, edx
sub esi, edx
mov dword [ebp - 4], ecx
push ebx
mov ebx, dword [esi + eax]
xor dword [eax], ebx
add eax, 4
dec ecx
jne 0x1000f8d2
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
pop ebx
add eax, eax
add eax, eax
sub edi, eax
je 0x1000f909
add edx, eax
add esi, eax
test edi, edi
je 0x1000f909
mov ecx, esi
mov eax, edx
sub ecx, edx
mov esi, edi
lea esp, [esp]
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x1000f900
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000f910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
mov ecx, edi
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x1000f95b
mov edi, ebx
sub esi, edx
mov eax, edx
sub edi, edx
mov dword [ebp - 4], ecx
lea esp, [esp]
mov ebx, dword [esi + eax]
xor ebx, dword [eax]
add eax, 4
dec ecx
mov dword [edi + eax - 4], ebx
jne 0x1000f940
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
add eax, eax
add eax, eax
sub edi, eax
je 0x1000f984
add ebx, eax
add esi, eax
add edx, eax
test edi, edi
je 0x1000f984
mov ecx, esi
mov esi, ebx
sub ecx, edx
mov eax, edx
sub esi, edx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
inc eax
dec edi
mov byte [eax + esi - 1], dl
jne 0x1000f977
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret