joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47031f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4e8848]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x47035f
cmp byte [ebx], 0xa
jne 0x47035f
or byte [eax + edi + 0x28], 4
jmp 0x470364
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x470462
mov al, byte [edx]
cmp al, 0x1a
je 0x470444
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x470393
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4703b8
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4703c2
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x470375
jmp 0x470462
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47043f
cmp dword [ebp - 0xc], 0
je 0x47043f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4e8848]
test byte [eax + edi + 0x28], 0x48
je 0x470419
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x470404
mov byte [esi], dl
jmp 0x470415
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4e8848]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x470462
cmp byte [ebp - 1], 0xa
jne 0x470428
cmp esi, ebx
jne 0x470428
mov byte [esi], 0xa
jmp 0x470461
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004711b4
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x470462
mov byte [esi], 0xd
jmp 0x470461
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4e8848]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x47045e
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x470462
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x47046b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4e8848]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4704ae
cmp word [esi], dx
jne 0x4704ae
or byte [edi + eax + 0x28], 4
jmp 0x4704b3
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x470606
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4705e6
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4704f5
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x47052b
cmp eax, edx
jae 0x470537
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4704cd
jmp 0x470606
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4705e2
cmp dword [ebp - 0x14], 0
je 0x4705e2
mov eax, dword [ebx*4 + 0x4e8848]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4705ba
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x470583
mov word [esi], cx
jmp 0x4705b6
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4e8848]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4e8848]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4e8848]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x470606
pop ebx
cmp word [ebp - 4], bx
jne 0x4705cb
cmp esi, dword [ebp + 0xc]
jne 0x4705cb
mov word [esi], bx
jmp 0x470603
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004711b4
add esp, 0x10
cmp word [ebp - 4], bx
je 0x470606
push 0xd
jmp 0x4705ff
mov ecx, dword [ebx*4 + 0x4e8848]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4705fd
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x470606
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10008ed0
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck
Execute anti-debugging instructions
Execute shellcode via indirect call
Hide graphical window
Parse credit card information
Parse pe header
Resume thread

Disassembly:
jmp 0x10015f9b
sete cl
and cl, 1
mov byte [ebp - 0x136], cl
cmc
test dl, ch
cmp eax, 0xa
setl al
test eax, ecx
cmp ecx, ecx
test ebx, 0xaa88eab4
and al, 1
test esp, 0x8f3f059d
mov byte [ebp - 0x135], al
mov dword [ebp - 0x13c], 0xe7347c0c
rol al, cl
not ah
push ebp
or ecx, esp
mov ebp, esp
push ebx
xor edx, 0x90af6621
btr ecx, 0x82
push edi
btc edx, ebx
sub edx, esi
push esi
sal ch, cl
sbb dl, 0xac
sub esp, 0x134
sar ecx, 0x32
mov eax, dword [0x10074800]
xor eax, ebp
mov dword [ebp - 0x10], eax
bswap dx
mov ecx, dword [0x10075b28]
shld dx, bp, 0x88
movsx edx, sp
mov eax, dword [0x10075b24]
ror dx, 0xa5
stc
mov edx, ecx
lea edx, [edx - 0xc406793]
cmc
cmp ch, ah
lea edx, [edx - 1]
test dh, 7
cmc
lea edx, [edx + 0xc406793]
imul ecx, edx
cmc
and ecx, 1
cmp ecx, 0
jmp 0x100110c5

Function at 0x1001afd3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001b012
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001b012
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001b012
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001b012
cmp dword [ecx + 0x74], 0xe
jbe 0x1001b012
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001dc8f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001dd2c
push ebx
push esi
call fcn.1001dc58
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001dbec
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001dcd9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001dd2b
push edi
push eax
call fcn.1001ec4a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001dcf9
call fcn.1001c734
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001dd2a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001dbec
add esp, 0x20
test eax, eax
jne 0x1001dd18
push edi
call fcn.1001c734
jmp 0x1001dd20
push ebx
call fcn.1001c734
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001df99
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cc8
push 0x10025cc0
push str.FlsAlloc
push 0x1f
call fcn.1001deb5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001dfcd
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
jmp 0x1001dfd3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001e017
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cd8
push 0x10025cd0
push str.FlsGetValue
push 0x21
call fcn.1001deb5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e04e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001e056
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025ce0
push 0x10025cd8
push str.FlsSetValue
push 0x22
call fcn.1001deb5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e090
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10023720
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002374d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002374d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10002b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push 0x401000
call fcn.10002ce0
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
call fcn.10005300
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x10002b61
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x53ec8b55
jne 0x10002b73
mov eax, 0x3e9
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x401000
call fcn.10005290
cmp eax, 0x16197be9
jne 0x10002b8e
mov eax, 0x3ea
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8245bc
call fcn.10005290
cmp eax, 0x94bf
jne 0x10002ba9
mov eax, 0x3f3
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8252fc
call fcn.10005290
cmp eax, 0x94bf
jne 0x10002bc4
mov eax, 0x44d
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x82533c
call fcn.10005290
cmp eax, 0x94bf
jne 0x10002bdf
mov eax, 0x457
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858d51
call fcn.10005290
cmp eax, 0x3539f633
jne 0x10002bfa
mov eax, 0xc80
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858c61
call fcn.10005290
xor ecx, ecx
mov edx, 0xc8a
cmp eax, 0x3539f633
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x10004bb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor ecx, ecx
mov dword [ebp - 0x10], 0
cmp byte [ebp + 0x14], cl
cmovne ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x10004bcf
mov byte [ebp - 4], cl
jmp 0x10004bec
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10013850
add esp, 0xc
cmp byte [ebp - 4], 0
je 0x10004c1a
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x14]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x14], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x10004c20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor ecx, ecx
cmp byte [ebp + 0x14], cl
push ebx
cmovne ecx, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
test ecx, ecx
jne 0x10004c3e
xor bl, bl
jmp 0x10004c5d
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [ebp - 0x10]
test eax, eax
setne bl
push dword [ebp + 0x10]
mov byte [ebp - 4], bl
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.10013850
add esp, 0xc
test bl, bl
je 0x10004c8a
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x14]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x14], eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004c90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub eax, 1
je 0x10004cc4
sub eax, 1
je 0x10004d1d
sub eax, 2
je 0x10004d7d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
sub bl, al
mov bh, byte [ebp + 0x14]
dec bl
mov dword [ebp - 4], eax
movzx ecx, bh
mov dword [ebp - 0x18], 0
test bh, bh
jne 0x10004ce9
mov byte [ebp - 0xc], bh
mov byte [eax], bl
jmp 0x10004d20
lea edx, [ebp - 0x10]
mov dword [ebp - 0x14], ecx
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0x18], eax
call edi
mov ecx, dword [ebp - 4]
test eax, eax
setne byte [ebp - 0xc]
mov byte [ecx], bl
test eax, eax
je 0x10004d20
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call edi
jmp 0x10004d20
mov bh, byte [ebp + 0x14]
mov eax, dword [ebp - 8]
sub eax, esi
mov dword [ebp - 0x18], 0
mov esi, dword [ebp + 8]
sub eax, esi
movzx eax, ax
mov dword [ebp - 8], eax
movzx ecx, ax
movzx eax, bh
add eax, eax
jne 0x10004d4a
mov byte [ebp - 0xc], 0
mov word [esi], cx
jmp 0x10004d7d
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call edi
mov ecx, dword [ebp - 8]
test eax, eax
setne byte [ebp - 0xc]
mov word [esi], cx
test eax, eax
je 0x10004d7d
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
add eax, esi
mov ebx, dword [ebp + 0xc]
sub ebx, eax
mov dword [ebp - 0x18], 0
movzx eax, byte [ebp + 0x14]
shl eax, 2
test eax, eax
jne 0x10004da8
mov byte [ebp - 0xc], al
mov dword [esi], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], ebx
test eax, eax
je 0x10004dd7
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x18]
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004de0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
movzx ebx, byte [ebp + 0x10]
mov dword [ebp - 0x14], edx
push esi
mov esi, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test ebx, ebx
jne 0x10004e05
xor cl, cl
jmp 0x10004e20
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push ecx
push 0x40
push ebx
push eax
mov dword [ebp - 0x14], eax
call edi
mov edx, dword [ebp - 0x14]
test eax, eax
mov eax, dword [ebp + 0xc]
setne cl
mov byte [ebp - 8], cl
mov ch, byte [esi]
mov byte [ebp + 0x13], ch
test cl, cl
je 0x10004e43
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edx
call edi
mov eax, dword [ebp + 0xc]
mov ch, byte [ebp + 0x13]
movzx ecx, ch
sub ecx, 0xe8
je 0x10004f1c
sub ecx, 1
je 0x10004f1c
sub ecx, 0x16
jne 0x10004f0c
mov dword [ebp - 0x14], ecx
lea esi, [eax + 1]
test ebx, ebx
jne 0x10004e72
xor cl, cl
jmp 0x10004e8a
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x14], esi
call edi
test eax, eax
mov eax, dword [ebp + 0xc]
setne cl
mov byte [ebp - 8], cl
mov dl, byte [esi]
mov byte [ebp + 0x13], dl
test cl, cl
je 0x10004eaf
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
mov eax, dword [ebp + 0xc]
mov dl, byte [ebp + 0x13]
cmp dl, 0x15
je 0x10004eb9
cmp dl, 0x25
jne 0x10004f0c
shl ebx, 2
lea esi, [eax + 2]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test ebx, ebx
jne 0x10004ecc
xor al, al
jmp 0x10004ee4
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x14], esi
call edi
mov ecx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov esi, dword [esi]
test al, al
je 0x10004efe
mov eax, dword [ebp - 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0x10], eax
push ecx
call edi
mov eax, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl ebx, 2
lea esi, [eax + 1]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
test ebx, ebx
jne 0x10004f2f
xor al, al
jmp 0x10004f47
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x14], esi
call edi
mov ecx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov ebx, dword [esi]
test al, al
je 0x10004f61
mov eax, dword [ebp - 0xc]
lea edx, [ebp + 0x10]
push edx
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0x10], eax
push ecx
call edi
mov eax, dword [ebp + 8]
lea ecx, [ebx + 4]
pop edi
add ecx, esi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005200
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push dword [ebp + 8]
call fcn.10002ce0
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
call fcn.10005300
mov dword [ebp - 0x18], 0
mov esi, dword [eax]
xor eax, eax
cmp byte [ebp + 0x10], al
cmovne eax, dword [ebp + 0xc]
test eax, eax
jne 0x1000523c
mov byte [ebp - 0xc], al
jmp 0x10005256
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
push dword [ebp + 0xc]
push 0x90
push esi
call fcn.10013dd0
add esp, 0xc
cmp byte [ebp - 0xc], 0
je 0x10005284
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10005290
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push ecx
call fcn.10002ce0
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
call fcn.10005300
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x100052ed
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10005380
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x10], edx
push ebx
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x1000539c
xor al, al
jmp 0x100053b8
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x10]
test eax, eax
setne al
mov byte [ebp - 4], al
mov bl, byte [esi]
test al, al
je 0x100053d6
mov ecx, dword [ebp - 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp - 0xc]
mov dword [ebp + 0xc], ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fdb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002f83d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x1003d180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.100121c0
mov edi, eax
add esp, 4
test edi, edi
je 0x1000fe4d
push 1
mov dword [ebp - 4], 0
call fcn.10011420
add esp, 4
mov dword [edi + 4], eax
jmp 0x1000fe4f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.100043f0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov dword [ebp - 4], 0xffffffff
mov bl, al
test edi, edi
je 0x1000feaa
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x1000feaa
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
jne 0x1000fec6
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x1000fee9
cmp byte [ebp + 0xc], 0
je 0x1000fed5
push esi
call fcn.10011b26
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x1000fef5
mov esi, str.ios_base::badbit_set
jmp 0x1000ff05
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.100036a0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.10004050
push 0x1003bff8
lea eax, [ebp - 0x28]
push eax
call fcn.1001337b
int3
Function at 0x10010090
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ecx]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov edx, dword [eax + 8]
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push ebx
push 5
push ecx
mov eax, esp
mov dword [eax], esi
call edx
push ebx
push ecx
mov eax, esp
push dword [ebp + 8]
mov dword [eax], esi
call fcn.10004de0
add esp, 0xc
movzx eax, bl
mov dword [ebp - 0x14], 0
test bl, bl
jne 0x100100d8
mov byte [ebp - 8], bl
mov byte [esi], 0xe8
jmp 0x10010111
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0xc]
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
call ebx
test eax, eax
setne byte [ebp - 8]
mov byte [esi], 0xe8
test eax, eax
je 0x1001010e
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call ebx
mov ebx, dword [ebp + 0x14]
push ebx
push 4
push ecx
mov ecx, esp
inc esi
push ecx
mov dword [ecx], edi
mov ecx, esp
mov dword [ecx], esi
call fcn.10004c90
mov eax, dword [ebp + 8]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10