joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455220
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x5f3024]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x455246
mov ecx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x455249
and ecx, 0x7f
mov ebx, dword [ebp + 0xc]
lea esi, [ebp - 0x1c]
push ecx
push eax
push esi
call fcn.00460850
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x455263
mov esi, dword [ebp - 0x1c]
lea edi, [ebp - 0x28]
push ebx
push dword [ebp + 8]
push edi
call fcn.00460850
add esp, 0xc
cmp byte [edi + 0xb], 0
jns 0x45527c
mov edi, dword [ebp - 0x28]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x1d], 0
jns 0x455297
push dword [ebp - 0x28]
call fcn.0050d52e
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x4552a8
push dword [ebp - 0x1c]
call fcn.0050d52e
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x455340
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov edi, ecx
mov eax, dword [0x5f3024]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x1c]
push edx
push ecx
push esi
call fcn.00460850
add esp, 0xc
cmp byte [esi + 0xb], 0
jns 0x45536e
mov esi, dword [ebp - 0x1c]
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x45538c
push dword [ebp - 0x1c]
call fcn.0050d52e
add esp, 4
cmp dword [ebp + 8], 0
je 0x455425
test esi, esi
je 0x455425
lea eax, [esi + esi]
xor ecx, ecx
dec ecx
test esi, esi
cmovns ecx, eax
push ecx
call fcn.0050d563
add esp, 4
mov ecx, edi
mov edi, eax
mov eax, ebx
lea ebx, [ebp - 0x1c]
push eax
push ecx
push ebx
call fcn.00460850
add esp, 0xc
cmp byte [ebx + 0xb], 0
jns 0x4553cf
mov ebx, dword [ebp - 0x1c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x4553e9
push dword [ebp - 0x1c]
call fcn.0050d52e
add esp, 4
test edi, edi
mov ebx, dword [ebp + 8]
je 0x45543e
push edi
call fcn.0052a854
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.004d9ad0
add esp, 0xc
cmp byte [ebx + 0xb], 0
js 0x455441
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebx], xmm0
push edi
call fcn.0050d56c
add esp, 4
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050db32
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
int3
push dword [ebx]
call fcn.0050d52e
add esp, 4
jmp 0x45540d
Function at 0x455590
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.00465a60
mov dword [esi], 0
test eax, eax
je 0x4555d8
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jae 0x45560a
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4555cf
mov dword [esi], ebx
call fcn.004cfe10
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 4]
lea eax, [edi + 4]
push eax
call fcn.004cecd0
lea ecx, [esi + 0x10]
call fcn.004e5680
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov al, byte [edi + 0x18]
mov byte [esi + 0x18], al
mov al, byte [edi + 0x19]
mov byte [esi + 0x19], al
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call fcn.004cfe10
push dword [esi]
call fcn.004dfa90
add esp, 4
mov dword [esi], 0
jmp 0x4555c0
Function at 0x458690
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
call fcn.00458730
mov eax, dword [esi]
mov dword [0x5f4b70], eax
test al, 1
jne 0x4586ac
mov al, 1
pop esi
pop ebp
ret
mov eax, dword [0x5f9328]
test eax, eax
jne 0x4586c1
mov ecx, dword [0x5f9314]
test ecx, ecx
je 0x4586e3
jmp 0x4586ff
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x5f9328], 0
mov ecx, dword [0x5f9314]
test ecx, ecx
jne 0x4586ff
and byte [0x5f4b70], 0xfe
push 0xc
call fcn.0050d4fe
add esp, 4
mov ecx, eax
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], eax
mov dword [0x5f9314], ecx
push dword [esi + 4]
call fcn.00459160
cmp dword [esi + 0xc], 0
jne 0x458721
mov eax, dword [0x5f9314]
cmp byte [eax + 0xb], 0
jns 0x45871a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebp
jmp fcn.0055a9d0
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x406243
pop dword [ebp - 0x1c]
mov eax, 0x6504d1d2
add eax, 0x9b3b9071
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xd558bc90
add dword [ebp - 0x2c], 0x78f988bb
mov dword [ebp - 0x28], 0x912f10b6
add dword [ebp - 0x28], 0xa1043b8f
mov dword [ebp - 0x24], 0x3e7b2e33
add dword [ebp - 0x24], 0xdd115fb
mov dword [ebp - 0x20], 0x8a979259
add dword [ebp - 0x20], 0x75686da7
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x6605d164
sub eax, 0x65c55060
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x3c9b60a5
add dword [ebp - 0x2c], 0x37d708b1
mov dword [ebp - 0x28], 0x1526538d
sub dword [ebp - 0x28], 0xd3b9f218
mov dword [ebp - 0x24], 0x238035a1
add dword [ebp - 0x24], 0x3fef36cb
mov dword [ebp - 0x20], 0x7e148e71
sub dword [ebp - 0x20], 0x7e148e71
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x38f1f
push 0
call eax
mov ecx, 0x97febc19
sub ecx, 0x97fe6c69
xor esi, esi
add esi, eax
mov edx, 0x2739fa0d
add edx, 0xd90ce9f3
add edx, dword [ebp - 0x1c]
mov edi, 0xfa328ba1
sub dword [ebp - 0xc], esi
mov ebx, dword [edx]
xor dword [ebp - 0x14], edx
add ebx, edi
mov dword [ebp - 8], 0x7ad2342d
mov dword [esi], ebx
add esi, 0xf260e4d9
sub esi, 0xf260e4d5
add edx, 0x121ad95d
sub edx, 0x121ad959
loop 0x40635c
add eax, 0x77b7a6ee
sub eax, 0x77b6755b
mov ebx, eax
add eax, 0x208b7dfc
add eax, 0xdf748209
mov ecx, 0x465095df
add ecx, 0xb9ef6a21
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x1000130c
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
push ebx
mov esi, 0x10025468
call fcn.100054e0
pop ecx
add eax, ebx
jmp 0x10001324
cmp byte [eax], 0x5c
je 0x1000132d
dec eax
cmp eax, ebx
jne 0x1000131e
cmp byte [eax], 0x5c
jne 0x1000132e
inc eax
push eax
call dword [0x1001000c]
mov edi, eax
test edi, edi
jne 0x1000134c
push ebx
call dword [0x10010008]
mov edi, eax
test edi, edi
jne 0x1000134c
xor eax, eax
jmp 0x10001370
cmp dword [0x10025468], 0
je 0x1000136d
push dword [esi]
push edi
call dword [0x10010004]
mov dword [esi + 4], eax
test eax, eax
je 0x10001373
add esi, 8
cmp dword [esi], 0
jne 0x10001355
xor eax, eax
inc eax
pop edi
pop esi
ret
push str.undef_symbol
call dword [0x10010010]
jmp 0x10001348

Function at 0x100013a7
Capabilities:
Print debug messages

Disassembly:
cmp dword [esp + 8], 0
push ebx
push esi
mov esi, 0x10025468
jne 0x100013c0
mov ebx, dword [esp + 0xc]
call fcn.1000130c
jmp 0x1000140a
push edi
call fcn.10002ccd
push dword [esp + 0x14]
mov ebx, eax
push dword [esp + 0x14]
call fcn.10001224
push ebx
mov edi, eax
call fcn.10002cfb
add esp, 0xc
test edi, edi
je 0x10001418
cmp dword [0x10025468], 0
je 0x10001406
push dword [esi]
push edi
call fcn.1000127f
pop ecx
pop ecx
mov dword [esi + 4], eax
test eax, eax
je 0x1000140d
add esi, 8
cmp dword [esi], 0
jne 0x100013ed
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
push str.undef_symbol
call dword [0x10010010]
xor eax, eax
jmp 0x10001409
Function at 0x100014fc
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x210
and dword [esp], 0
push ebx
push ebp
mov ebp, dword [0x1001000c]
push esi
push edi
mov esi, str.msvcr90.dll
push esi
call ebp
mov edi, dword [0x10010014]
test eax, eax
jne 0x1000154b
push 0x3c5e0
lea ebx, [esp + 0x18]
mov eax, 0x1021a498
call fcn.10001427
mov ebx, eax
push ebx
push esi
call fcn.10001380
add esp, 0xc
push 0x8000
push 0
push ebx
call edi
lea eax, [esp + 0x11c]
push eax
push 0x104
call dword [0x1001001c]
cmp dword [0x10025504], 0
jne 0x1000157c
mov ebx, str.python27.dll
push ebx
call ebp
test eax, eax
je 0x1000167d
call fcn.1000130c
xor esi, esi
inc esi
call dword [0x10025664]
call dword [0x10025504]
test eax, eax
jne 0x100015e3
call dword [0x10025484]
push 0x10011cac
push eax
call fcn.10005680
mov eax, dword [0x10025624]
mov dword [eax], esi
mov eax, dword [0x10025604]
mov dword [eax], esi
mov eax, dword [0x10025614]
mov dword [eax], esi
mov eax, dword [0x1002560c]
mov dword [eax], 2
mov eax, dword [0x1002561c]
mov dword [eax], esi
call dword [0x1002546c]
push esi
call dword [0x100255f4]
push eax
push str.frozen
call dword [0x10025594]
add esp, 0x14
call dword [0x10025584]
push 0x3f5
push 0
push 0x100256a0
push 0x100256d8
push str._memimporter
mov edi, eax
call dword [0x100254ec]
call fcn.10001a9f
push str.__main__
call dword [0x100255c4]
add esp, 0x18
test eax, eax
je 0x10001658
push eax
call dword [0x100255cc]
mov esi, eax
pop ecx
test esi, esi
je 0x10001658
call fcn.100014b5
mov dword [esp + 0x10], eax
test eax, eax
je 0x10001658
push esi
push esi
push eax
call dword [0x100255e4]
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x10001651
call dword [0x100255ec]
push esi
call fcn.100012b4
pop ecx
push dword [esp + 0x10]
call fcn.100012b4
push edi
call dword [0x1002558c]
pop ecx
pop ecx
call dword [0x1002547c]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x210
ret
mov ebp, 0x10256a80
push 0xe952c
lea ebx, [esp + 0x18]
mov eax, ebp
call fcn.10001427
mov esi, eax
push esi
push str.python27.dll
call fcn.100013a7
add esp, 0xc
push 0x8000
push 0
push esi
mov ebx, eax
call edi
test ebx, ebx
jne 0x1000157c
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x1c]
push str._spython27.dll
push eax
call fcn.1000556b
lea eax, [esp + 0x24]
push 0x10011ca8
push eax
call fcn.1000583c
mov edi, eax
push edi
xor esi, esi
push 0xe952c
inc esi
push esi
push ebp
call fcn.100059b5
push edi
call fcn.10005aae
add esp, 0x28
lea ebx, [esp + 0x18]
call fcn.1000130c
test eax, eax
jne 0x1000157f
mov ebx, str.python27.dll
call fcn.1000130c
jmp 0x1000157f
Function at 0x10001e7c
Capabilities:
Allocate or change rwx memory
Check os version
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push ebx
push 0x90
xor ebx, ebx
lea eax, [ebp - 0x94]
push ebx
push eax
call fcn.10005ea0
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [0x10010040]
test eax, eax
jne 0x10001ed1
push str._INJECT__inject_via_remotethread_wow64:_GetVersionEx_failed
mov eax, dword [0x1002556c]
push dword [eax]
call dword [0x1002565c]
pop ecx
pop ecx
jmp 0x10001fdb
cmp dword [ebp - 0x94], 5
jne 0x10001ef2
cmp dword [ebp - 0x90], 2
jne 0x10001ef2
push 5
call dword [0x10010030]
push str._INJECT__inject_via_remotethread_wow64:_Windows_2003_not_supported.
jmp 0x10001ebd
push esi
mov esi, dword [0x10010018]
push edi
push 0x40
mov edi, 0x3000
push edi
push 0x4c
push ebx
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x10001f27
push str._INJECT__inject_via_remotethread_wow64:_VirtualAlloc_pExecuteX64_failed
mov eax, dword [0x1002556c]
push dword [eax]
call dword [0x1002565c]
pop ecx
pop ecx
jmp 0x10001fb6
push 0x40
push edi
push 0x149
push 0
call esi
mov ebx, eax
test ebx, ebx
jne 0x10001f40
push str._INJECT__inject_via_remotethread_wow64:_VirtualAlloc_pX64function_failed
jmp 0x10001f13
push 0x4c
push 0x10015000
push dword [ebp - 4]
call fcn.10005b30
push 0x129
push 0x10015068
push ebx
call fcn.10005b30
mov eax, dword [ebp + 8]
lea esi, [ebx + 0x129]
and dword [esi + 0x18], 0
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
add esp, 0x18
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
push esi
push ebx
mov dword [esi + 0x10], eax
call dword [ebp - 4]
test eax, eax
jne 0x10001f98
push 5
call dword [0x10010030]
push str._INJECT__inject_via_remotethread_wow64:_pExecuteX64__pX64function__ctx___failed
jmp 0x10001f13
mov esi, dword [esi + 0x18]
test esi, esi
jne 0x10001fb1
push 6
call dword [0x10010030]
push str._INJECT__inject_via_remotethread_wow64:_ctx__t.hThread_is_NULL
jmp 0x10001f13
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
cmp dword [ebp - 4], 0
mov esi, dword [0x10010014]
mov edi, 0x4000
je 0x10001fcf
push edi
push 0
push dword [ebp - 4]
call esi
test ebx, ebx
je 0x10001fd9
push edi
push 0
push ebx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x10001fe0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.10002e43
add esp, 0xc
mov dword [ebp - 4], eax
test eax, eax
jne 0x10002038
cmp dword [ebp + 0xc], 2
jne 0x10002022
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.10001e7c
add esp, 0x10
test eax, eax
je 0x10002038
push str._INJECT__inject_via_remotethread:_migrate_via_remotethread_wow64_failed
jmp 0x1000204b
mov eax, dword [0x1002556c]
push str._INJECT__inject_via_remotethread:_CreateRemoteThread_failed
push dword [eax]
call dword [0x1002565c]
pop ecx
pop ecx
jmp 0x10002069
push dword [ebp - 4]
call dword [0x10010050]
cmp eax, 0xffffffff
jne 0x1000205a
push str._INJECT__inject_via_remotethread:_ResumeThread_failed
mov eax, dword [0x1002556c]
push dword [eax]
call dword [0x1002565c]
pop ecx
pop ecx
cmp dword [ebp - 4], 0
je 0x10002069
push dword [ebp - 4]
call dword [0x10010044]
push 0
call dword [0x10010030]
xor eax, eax
leave
ret

Function at 0x10002075
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 4], 5
cmp edi, ebx
je 0x1000214e
cmp dword [ebp + 0x10], ebx
je 0x1000214e
call fcn.10002fa4
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x100020c1
mov eax, dword [0x1002556c]
push str._INJECT__inject_dll._GetReflectiveLoaderOffset_failed.
push dword [eax]
call dword [0x1002565c]
pop ecx
pop ecx
jmp 0x1000216d
push dword [ebp + 8]
push ebx
push 0x47a
call dword [0x10010024]
mov esi, eax
cmp esi, ebx
jne 0x100020dd
push str._INJECT__inject_dll._OpenProcess_failed.
jmp 0x10002153
push 0x40
push 0x3000
push dword [ebp + 0x10]
push ebx
push esi
call dword [0x10010034]
mov edi, eax
cmp edi, ebx
jne 0x100020fc
push str._INJECT__inject_dll._VirtualAllocEx_2_failed
jmp 0x10002153
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push esi
call dword [0x10010048]
test eax, eax
jne 0x10002116
push str._INJECT__inject_dll._WriteProcessMemory_2_failed
jmp 0x10002153
mov eax, dword [ebp - 8]
push ebx
add edi, eax
push edi
push dword [ebp + 0x14]
push esi
call fcn.10001fe0
add esp, 0x10
test eax, eax
je 0x10002149
push ebx
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
push esi
call fcn.10001b07
add esp, 0x14
test eax, eax
je 0x10002149
push str._INJECT__inject_dll._inject_via_apcthread_failed
jmp 0x10002153
mov dword [ebp - 4], ebx
jmp 0x10002162
push str._INJECT__inject_dll.__No_Dll_buffer_supplied.
mov eax, dword [0x1002556c]
push dword [eax]
call dword [0x1002565c]
pop ecx
pop ecx
cmp esi, ebx
je 0x1000216d
push esi
call dword [0x10010044]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000257b
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov ebx, dword [edi + 4]
lea esi, [ecx + eax + 0x18]
xor ecx, ecx
cmp cx, word [eax + 6]
jae 0x1000262e
add esi, 0xc
mov eax, dword [esi + 4]
test eax, eax
jne 0x100025e5
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 8], eax
test eax, eax
jle 0x10002619
push 4
push 0x1000
push eax
mov eax, dword [esi]
add eax, ebx
push eax
call dword [0x10010018]
test eax, eax
je 0x10002636
push dword [ebp - 8]
mov eax, dword [esi]
add eax, ebx
push 0
push eax
mov dword [esi - 4], eax
call fcn.10005ea0
jmp 0x10002616
push 4
push 0x1000
push eax
mov eax, dword [esi]
add eax, ebx
push eax
call dword [0x10010018]
test eax, eax
je 0x10002636
mov eax, dword [esi + 8]
push dword [esi + 4]
add eax, dword [ebp + 8]
mov edi, dword [esi]
add edi, ebx
push eax
push edi
call fcn.10005b30
mov dword [esi - 4], edi
mov edi, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi]
movzx eax, word [eax + 6]
inc dword [ebp - 4]
add esi, 0x28
cmp dword [ebp - 4], eax
jl 0x100025a6
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x10002631
Function at 0x100029b7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
sub esp, 0x28
cmp word [eax], cx
je 0x100029d9
push 0xc1
call dword [0x10010030]
xor eax, eax
leave
ret
push edi
mov edi, dword [eax + 0x3c]
add edi, eax
cmp dword [edi], 0x4550
jne 0x100029f8
mov eax, 0x14c
cmp word [edi + 4], ax
jne 0x100029f8
test byte [edi + 0x38], 1
je 0x10002a0a
push 0xc1
call dword [0x10010030]
xor eax, eax
jmp 0x10002ba9
push ebx
push esi
mov esi, dword [0x10010018]
push 4
push 0x3000
push dword [edi + 0x50]
push dword [edi + 0x34]
call esi
mov ebx, eax
test ebx, ebx
jne 0x10002a3a
push 4
push 0x3000
push dword [edi + 0x50]
push eax
call esi
mov ebx, eax
test ebx, ebx
je 0x10002a5e
push 0x34
push 8
call dword [0x1001005c]
push eax
call dword [0x10010054]
mov esi, eax
test esi, esi
jne 0x10002a6b
push 0x8000
push eax
push ebx
call dword [0x10010014]
push 0xe
call dword [0x10010030]
jmp 0x10002b94
mov dword [esi + 4], ebx
movzx eax, word [edi + 0x16]
shr eax, 0xd
and eax, 1
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
push str.kernel32.dll
mov dword [esi + 0x1c], 0x10001191
mov dword [esi + 0x20], 0x10001178
mov dword [esi + 0x24], 0x10001188
mov dword [esi + 0x28], eax
call dword [0x10010008]
test eax, eax
je 0x10002ab7
push str.GetNativeSystemInfo
push eax
call dword [0x10010004]
lea ecx, [ebp - 0x28]
push ecx
call eax
mov eax, dword [ebp - 0x24]
push 4
push 0x1000
mov dword [esi + 0x30], eax
push dword [edi + 0x54]
push ebx
call dword [0x10010018]
push dword [edi + 0x54]
mov dword [ebp - 4], eax
push dword [ebp + 8]
push eax
call fcn.10005b30
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
mov edx, dword [ebp - 4]
push esi
add eax, edx
push edi
mov dword [esi], eax
push ecx
mov dword [eax + 0x34], ebx
call fcn.1000257b
add esp, 0x18
test eax, eax
je 0x10002b8f
mov eax, ebx
sub eax, dword [edi + 0x34]
je 0x10002b15
push eax
mov eax, esi
call fcn.100027f8
pop ecx
mov dword [esi + 0x18], eax
jmp 0x10002b1c
mov dword [esi + 0x18], 1
call fcn.1000287e
test eax, eax
je 0x10002b8f
push esi
call fcn.100026f2
pop ecx
test eax, eax
je 0x10002b8f
mov eax, dword [esi]
mov ecx, dword [esi + 4]
add eax, 0xc0
mov eax, dword [eax]
mov dword [ebp + 8], ecx
test eax, eax
je 0x10002b66
mov edi, dword [eax + ecx + 0xc]
test edi, edi
je 0x10002b66
mov eax, dword [edi]
test eax, eax
je 0x10002b66
jmp 0x10002b56
mov ecx, dword [ebp + 8]
push 0
push 1
push ecx
call eax
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x10002b53
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
xor ecx, ecx
cmp eax, ecx
je 0x10002ba2
add eax, ebx
cmp dword [esi + 0x14], ecx
je 0x10002b9d
push ecx
xor edi, edi
inc edi
push edi
push ebx
call eax
test eax, eax
jne 0x10002b98
push 0x45a
call dword [0x10010030]
call fcn.10002c5c
xor eax, eax
jmp 0x10002ba7
mov dword [esi + 0x10], edi
jmp 0x10002ba5
mov dword [esi + 0x2c], eax
jmp 0x10002ba5
mov dword [esi + 0x2c], ecx
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret
Function at 0x10002e43
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp + 0x10]
xor esi, esi
push dword [ebp + 0xc]
push 0x100000
push esi
push dword [ebp + 8]
call dword [0x10010078]
mov dword [ebp - 4], eax
call dword [0x1001007c]
cmp eax, 8
jne 0x10002f0c
push ebx
mov ebx, dword [0x1001000c]
push edi
mov edi, dword [0x10010004]
mov dword [ebp - 4], esi
cmp dword [0x100261b4], esi
jne 0x10002eb7
cmp dword [0x100261b0], esi
jne 0x10002ead
push str.RtlCreateUserThread
push str.ntdll
call ebx
push eax
call edi
mov dword [0x100261b0], eax
mov dword [0x100261b4], 1
cmp dword [0x100261b0], esi
je 0x10002f02
push str.GetThreadId
push str.kernel32
call ebx
push eax
call edi
mov ebx, eax
cmp ebx, esi
je 0x10002f0a
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push esi
push esi
push 1
push esi
push dword [ebp + 8]
call dword [0x100261b0]
mov edi, eax
push edi
call dword [0x10010030]
cmp edi, esi
jne 0x10002f0a
push dword [ebp - 4]
call ebx
jmp 0x10002f0a
push 8
call dword [0x10010030]
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x10002f12
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x3c]
push ebx
add eax, ecx
movzx ecx, word [eax + 0x14]
push esi
push edi
xor edi, edi
lea ecx, [ecx + eax + 0x18]
cmp dword [esp + 0x10], edi
je 0x10002f70
cmp edx, dword [ecx + 0x14]
jae 0x10002f33
mov eax, edx
jmp 0x10002fa0
movzx ebx, word [eax + 6]
xor eax, eax
cmp ax, bx
jae 0x10002f9e
movzx eax, di
imul eax, eax, 0x28
add eax, ecx
mov esi, dword [eax + 0xc]
cmp edx, esi
jb 0x10002f56
mov eax, dword [eax + 0x10]
add eax, esi
cmp edx, eax
jb 0x10002f5e
inc edi
cmp di, bx
jb 0x10002f3e
jmp 0x10002f9e
movzx eax, di
imul eax, eax, 0x28
add ecx, eax
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edx
jmp 0x10002fa0
cmp edx, dword [ecx + 0x14]
jb 0x10002f2f
movzx ebx, word [eax + 6]
xor eax, eax
cmp ax, bx
jae 0x10002f9e
movzx eax, di
imul eax, eax, 0x28
add eax, ecx
mov esi, dword [eax + 0xc]
cmp edx, esi
jb 0x10002f98
mov eax, dword [eax + 0x10]
add eax, esi
cmp edx, eax
jb 0x10002f5e
inc edi
cmp di, bx
jb 0x10002f80
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x10002fa4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ecx
mov eax, dword [edi + 0x3c]
add eax, edi
movzx ecx, word [eax + 0x18]
push ebx
mov edx, 0x10b
push ebp
push esi
cmp cx, dx
jne 0x10002fc6
and dword [esp + 0xc], 0
add eax, 0x78
jmp 0x10002fdd
mov edx, 0x20b
cmp cx, dx
jne 0x1000304c
mov dword [esp + 0xc], 1
add eax, 0x88
mov ebp, dword [esp + 0xc]
mov edx, dword [eax]
push ebp
mov ecx, edi
call fcn.10002f12
mov esi, eax
add esi, edi
mov edx, dword [esi + 0x20]
push ebp
mov ecx, edi
call fcn.10002f12
mov edx, dword [esi + 0x24]
mov ebx, eax
push ebp
mov ecx, edi
add ebx, edi
call fcn.10002f12
mov ebp, eax
mov eax, dword [esi + 0x18]
add esp, 0xc
add ebp, edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1000304c
push dword [esp + 0xc]
mov edx, dword [ebx]
dec dword [esp + 0x14]
mov ecx, edi
call fcn.10002f12
add eax, edi
mov dword [esp], str.ReflectiveLoader
push eax
call fcn.10006390
pop ecx
pop ecx
test eax, eax
jne 0x10003054
add ebx, 4
inc ebp
inc ebp
cmp dword [esp + 0x10], eax
jne 0x1000301b
xor eax, eax
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0xc]
mov edx, dword [esi + 0x1c]
push dword [esp + 0x10]
mov ecx, edi
call fcn.10002f12
movzx edx, word [ebp]
add eax, edi
mov edx, dword [eax + edx*4]
pop ecx
mov ecx, edi
call fcn.10002f12
pop ecx
jmp 0x1000304e

Function at 0x1000b243
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10014bf8]
jne 0x1000b24d
repz ret
jmp fcn.1000ecdb