joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426dbe
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push 0xffffffffffffffff
push 0x68
push dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 1], bl
call fcn.00403619
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x426df1
push ebx
push 0x43d128
push dword [ebp + 8]
call fcn.0040258f
jmp 0x426ef7
push 0x514
call fcn.00401000
mov ebx, eax
test ebx, ebx
je 0x426ef7
cmp byte [0x4461e8], 0
push esi
push edi
lea edi, [ebx + 0x104]
je 0x426e2b
push 1
push str.EveryDownLocSetFg
push str.Config
call fcn.004010aa
test eax, eax
je 0x426e56
mov esi, 0x4461e8
push esi
push 0x43c288
push dword [ebp + 8]
call fcn.00403f4f
test eax, eax
je 0x426ef5
push esi
push str.DefDownloadPath
push str.Config
call fcn.00401134
push 2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
push edi
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00423cd3
cmp eax, 0xfffffffd
jne 0x426e95
xor eax, eax
push eax
push eax
push eax
push edi
push dword [ebp - 8]
lea esi, [edi + 0x208]
push dword [ebp + 8]
call fcn.00423cad
push eax
push dword [ebp + 8]
call fcn.00419dee
test eax, eax
jmp 0x426eda
cmp eax, 0xfffffff7
je 0x426edc
lea eax, [edi + 0x208]
mov ecx, edi
call fcn.004195d0
push ebx
call fcn.00402610
push edi
mov byte [eax], 0
call fcn.0040126f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
xor eax, eax
push 2
pop esi
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
cmp eax, esi
je 0x426ef5
push dword [ebp - 8]
push 0x68
push dword [ebp + 8]
call fcn.00403619
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x426e56
pop edi
pop esi
push ebx
call fcn.00401019
pop ebx
leave
ret 4

Function at 0x427e02
Capabilities:
Create process on windows
Set file attributes

Disassembly:
push esi
push 0x208
call fcn.00401000
mov esi, eax
test esi, esi
je 0x427e9b
push 0x104
push esi
push dword [0x445f50]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push dword [esp + 0xc]
call fcn.0040262f
push eax
push esi
call fcn.00402610
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call fcn.00404046
test eax, eax
je 0x427e61
push esi
push dword [esp + 0x10]
call fcn.0040a03f
test eax, eax
je 0x427e73
push 0
push 0
push esi
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.0041ae32
test edi, edi
je 0x427e8c
cmp byte [edi], 0
je 0x427e8c
push 0x20
push esi
call fcn.00401255
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
push esi
call fcn.00401019
pop esi
ret 8
Function at 0x428329
Capabilities:
Set file attributes

Disassembly:
push ebx
push 0x30c
call fcn.00401000
mov ebx, eax
test ebx, ebx
je 0x42839a
push esi
push edi
push 0x104
lea esi, [ebx + 0x104]
push esi
push dword [0x445f50]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, str.7_epp___q05_18q_:q4_efooopWPLKVQXpVRXZpYVQ_ROlpYVQ_ROlqXVY
push edi
call fcn.0040262f
push eax
push esi
call fcn.00402610
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call fcn.00404046
test eax, eax
je 0x42838b
push esi
push edi
call fcn.0040a03f
test eax, eax
je 0x428398
push 0
push 0
push esi
push edi
push 0
call fcn.0041ae32
pop edi
pop esi
push ebx
call fcn.00401019
pop ebx
ret

Function at 0x428633
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x410
call fcn.00401000
mov dword [ebp - 4], eax
test eax, eax
je 0x428752
push ebx
push esi
push edi
lea esi, [eax + 0x208]
push 0x104
push esi
push dword [0x445f50]
lea ebx, [esi + 0x104]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push ebx
call edi
push str.WEBDOWN.EXE
push ebx
call fcn.00402610
push eax
call edi
push esi
mov edi, str.7_epp___q05_18q_:q4_pSZQ_Mp_PHQpYVQ_ROlqZGZ
push edi
call fcn.0040a03f
test eax, eax
je 0x428732
push 1
push 0x43d854
push dword [ebp + 8]
call fcn.0040258f
cmp eax, 1
jne 0x428747
push ebx
call fcn.00404046
test eax, eax
je 0x4286ca
push ebx
push str.7_epp___q05_18q_:q4_pSZQ_Mp_PHQpHZ__PHQqZGZ
call fcn.0040a03f
test eax, eax
je 0x4286dc
push 0
push 0
push ebx
push str.7_epp___q05_18q_:q4_pSZQ_Mp_PHQpHZ__PHQqZGZ
push dword [ebp + 8]
call fcn.0041ae32
push ebx
call fcn.00404046
test eax, eax
je 0x428747
push esi
push edi
push ebx
push str._s__s___s__RUN
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push 0x51
push 0x111
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, accept
push eax
push eax
push eax
push 1
push str.ViewStartLogHelp
push str.Config
call fcn.00401182
jmp 0x428747
cmp byte [ebp + 0xc], 0
jne 0x428747
push 0
push 0x43d824
push dword [ebp + 8]
call fcn.0040258f
push dword [ebp - 4]
call fcn.00401019
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x432ddf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445498]
jne 0x432de9
repz ret
jmp fcn.004350f5

Function at 0x43612c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00432e60
and dword [ebp - 4], 0
cmp dword [0x446e40], 0
mov ebx, eax
jne 0x4361dd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43628e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43fc98
push edi
call esi
test eax, eax
je 0x43628e
push eax
call fcn.00432dee
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x446e40], eax
call esi
push eax
call fcn.00432dee
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x446e44], eax
call esi
push eax
call fcn.00432dee
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x446e48], eax
call esi
push eax
call fcn.00432dee
pop ecx
mov dword [0x446e50], eax
test eax, eax
je 0x4361dd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00432dee
pop ecx
mov dword [0x446e4c], eax
mov eax, dword [0x446e4c]
cmp eax, ebx
je 0x436235
cmp dword [0x446e50], ebx
je 0x436235
push eax
call fcn.00432e69
push dword [0x446e50]
mov esi, eax
call fcn.00432e69
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x436235
test edi, edi
je 0x436235
call esi
test eax, eax
je 0x43622c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43622c
test byte [ebp - 0xc], 1
jne 0x436235
or dword [ebp + 0x10], 0x200000
jmp 0x43626e
mov eax, dword [0x446e44]
cmp eax, ebx
je 0x43626e
push eax
call fcn.00432e69
pop ecx
test eax, eax
je 0x43626e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43626e
mov eax, dword [0x446e48]
cmp eax, ebx
je 0x43626e
push eax
call fcn.00432e69
pop ecx
test eax, eax
je 0x43626e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x446e40]
call fcn.00432e69
pop ecx
test eax, eax
je 0x43628e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x436290
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x8434eb
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0xffffffff
add eax, ebp
pop ebp
push ebx
mov ebx, 0x3fb7baa0
xor ebx, 0x4af576a5
xor ebx, 0x2b35e584
sub eax, ebx
jmp 0x843a1d
xor edi, 0x2aeb7870
sub edi, 0x4ff3ead2
push ebx
jmp 0x84378a
push ebp
mov ebp, esp
jmp 0x843639
mov esp, dword [esp]
push eax
mov eax, 0x5fbfa788
shr eax, 8
push ebp
jmp 0x8433d6
push dword [esp + 4]
mov ecx, dword [esp]
jmp 0x843b4f
push edi
push 0x53eb8fe4
pop edi
jmp 0x84340b
add ebx, ecx
sub ebx, 0x673e82b4
pop ecx
xchg dword [esp], ebx
mov esp, dword [esp]
jmp 0x843dfb
inc ecx
xor ecx, 0x2ff36651
not ecx
add ecx, 0x6c67d678
jmp 0x843844
mov ebx, 0xffffffff
jmp 0x843901
push eax
mov eax, 0x5dfe8119
push edx
mov edx, 0x77bdfb69
shl edx, 4
or edx, 0x1ef77e5d
and edx, 0x5399cb69
jmp 0x843aa0
push ecx
mov ecx, 0x673e82b4
add ebx, ecx
jmp 0x843cd5
sub edi, ebx
mov ebx, dword [esp]
add esp, 4
shr edi, 2
sub edi, 0xa43432c
add ebp, edi
pop edi
add ebp, 4
xchg dword [esp], ebp
pop esp
jmp 0x8439aa
xor eax, 0x78d45b0d
push eax
pop edx
mov eax, dword [esp]
add esp, 4
push 0x6e75b971
mov dword [esp], ecx
jmp 0x843a5e
pop ebx
add eax, 0x5fe90ea8
shl eax, 6
sub eax, 0x14cb1dd6
and edi, eax
pop eax
push esi
mov esi, 0xede8e519
add edi, esi
mov esi, dword [esp]
jmp 0x843b82
mov dword [esp], esi
mov dword [esp], edi
push ecx
mov dword [esp], 0x37a77262
push dword [esp]
pop edi
push ecx
mov ecx, esp
jmp 0x8437be
not edx
add edx, 0x73975ec2
xor eax, edx
pop edx
shr eax, 2
add eax, 0xef7f3aac
add ecx, eax
pop eax
push edx
mov edx, 4
add ecx, edx
pop edx
push ecx
jmp 0x843545
add esp, 4
pop dword [esp]
jmp 0x84351c
add esp, 4
mov eax, edi
pop edi
push eax
mov dword [esp], edx
mov dword [esp], 0x3c01135b
mov dword [esp], ecx
mov dword [esp], esi
mov dword [esp], 0x7d5932e6
push ecx
mov ecx, 0x7ab124a6
jmp 0x843c40
sub dword [esp + 4], ecx
pop ecx
push ebx
mov ebx, 0x8689e192
sub dword [esp + 4], ebx
jmp 0x843c54
pop ebx
mov edx, dword [esp]
push esi
mov esi, esp
add esi, 4
sub esi, 4
xchg dword [esp], esi
pop esp
jmp 0x843cb1
mov dword [esp], ebx
push esp
mov ebx, dword [esp]
add esp, 4
add ebx, 4
push eax
mov dword [esp], ecx
mov ecx, 0x6b94b229
and ecx, 0x57fdf0b1
jmp 0x8436f6
pop ecx
jmp 0x843645
add byte [eax], al
add byte [eax], al
mov edx, dword [ecx - 7]
or dl, byte [eax + 0x40]
pop ebp
xchg edi, eax
dec ebp
and ecx, dword [esi + edi*2 + 7]
and ah, byte [ecx + ecx*8 + 0x761d4745]
dec edx
dec ecx
jge 0x843da4
movsd dword es:[edi], dword [esi]
sub eax, 0xb7ca3b35
invalid
Function at 0x40364b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x403672
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x403675
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00403627
pop esi
leave
ret 8

Function at 0x40428d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4042cc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4042cc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4042cc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4042cc
cmp dword [ecx + 0x74], 0xe
jbe 0x4042cc
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10001010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
call fcn.100084da
add esp, 4
mov esi, eax
lea eax, [ebp + 0xc]
push eax
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 8]
push edi
push ecx
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x10001050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push ebx
mov edi, ecx
call fcn.100084da
add esp, 4
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 8]
add ebx, eax
nop
push 0x1c
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov edx, dword [edi]
mov edx, dword [edx + 0x14]
push eax
push ecx
push esi
mov ecx, edi
call edx
mov eax, dword [ebp - 0x14]
add esi, eax
add eax, dword [ebp - 0x20]
cmp eax, ebx
jb 0x10001080
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100010c0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x1000c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov edx, dword [ebp - 0xd0]
mov ecx, dword [esi]
push 0
push edx
push 4
push esi
mov dword [ebp - 0xcc], ecx
call edi
xor eax, eax
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10001104
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov edx, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xcc]
push 0
push edx
push 4
push esi
mov dword [esi], ecx
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100084e5
mov esp, ebp
pop ebp
ret 4

Function at 0x10001150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x1000c018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
xor eax, eax
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10001170
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xcc]
xor ecx, ebp
call fcn.100084e5
mov esp, ebp
pop ebp
ret 4
Function at 0x100011b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push 0x40
push esi
push edi
call ebx
mov ecx, dword [ebp + 0xc]
push esi
push ecx
push edi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp + 0x10]
add esp, 0xc
lea edx, [ebp + 0x10]
push edx
push eax
push esi
push edi
call ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x10002cd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
cmp byte [ebx], 0x6a
push edi
mov edi, eax
jne 0x10002d52
lea eax, [ebp - 4]
push eax
push 0x80
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 7
push ebx
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 7
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
lea ebx, [esi + 7]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
sub edi, ebx
push edx
add edi, 2
push 5
mov dword [ebx + 1], edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
mov byte [ebx], 0xe9
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 0xa
push esi
call edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
push ecx
push 0x80
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 5
push ebx
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
lea ebx, [esi + 5]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
sub edi, ebx
push 5
mov dword [ebx + 1], edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
mov byte [ebx], 0xe9
call edi
lea ecx, [ebp - 8]
push ecx
push 0x40
push 0xa
push esi
call edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002dc0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x10002e2b
push esi
cmp ecx, edx
jne 0x10002e21
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10002de3
mov esi, dword [eax]
mov dword [ecx], esi
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x10002def
mov esi, dword [eax]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x10002dfb
mov esi, dword [eax + 0x10]
mov dword [ecx], esi
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10002e08
mov esi, dword [eax + 0x14]
mov dword [ecx + 4], esi
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10002e14
mov esi, dword [eax + 0xc]
mov dword [esi], ecx
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10002e21
mov esi, dword [eax + 0xc]
mov dword [ecx + 4], esi
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x10002dd4
pop esi
ret
Function at 0x10002e30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
call edi
push 0x1000
push 0
push esi
call sub.MSVCR100.dll_memset
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add esp, 0xc
push 0
push ecx
push edx
push eax
call edi
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10006110
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1000c018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x94]
cmp eax, 5
jne 0x10006178
mov eax, 1
cmp dword [ebp - 0x90], eax
je 0x1000616a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100084e5
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x100061ca
mov eax, dword [ebp - 0x90]
test eax, eax
jne 0x1000619a
mov eax, 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100084e5
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x100061b2
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100084e5
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x10006168
mov eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100084e5
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x10006168
cmp dword [ebp - 0x90], 0
jne 0x10006168
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 5
call fcn.100084e5
mov esp, ebp
pop ebp
ret
Function at 0x100061f0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x1000e6a4
push 0x1001059c
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
call fcn.10006110
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
dec eax
cmp eax, 4
ja case.default.0x10006216
jmp dword [eax*4 + 0x100062d4]
cmp dword [ebp - 4], 1
jne case.0x10006216.2
push str.Win_XP
push 0x100105e0
call esi
add esp, 8
call fcn.10006110
dec eax
cmp eax, 4
ja case.default.0x1000623d
jmp dword [eax*4 + 0x100062e8]
cmp dword [ebp - 4], 2
jne case.0x1000623d.1
push str.Win_Vista
push 0x100105e0
call esi
add esp, 8
call fcn.10006110
dec eax
cmp eax, 4
ja case.default.0x10006264
jmp dword [eax*4 + 0x100062fc]
cmp dword [ebp - 4], 3
jne case.0x10006264.1
push str.Win_7
push 0x100105e0
call esi
add esp, 8
call fcn.10006110
dec eax
cmp eax, 4
ja case.default.0x1000628b
jmp dword [eax*4 + 0x10006310]
cmp dword [ebp - 4], 4
jne case.0x1000628b.1
push str.Win_8
push 0x100105e0
call esi
add esp, 8
call fcn.10006110
dec eax
cmp eax, 4
ja case.default.0x100062b2
jmp dword [eax*4 + 0x10006324]
cmp dword [ebp - 4], 5
jne case.0x100062b2.1
push str.Wi_10
push 0x100105e0
call esi
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10007880
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x1000f2c0]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x80
push 6
push esi
call edi
push 6
push 0x10007840
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 6
push esi
call edi
mov eax, dword [0x1000f2c0]
mov esi, dword [eax + 2]
mov ecx, dword [esi]
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push esi
mov dword [0x1000f2b8], ecx
call edi
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 4
push esi
mov dword [esi], 0x10007850
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10007b70
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.xxxxxxx____xxx_
push 0x1000add0
push str.d3d9.dll
call edi
push eax
call fcn.10002bf0
add esp, 0xc
push str.xxxxxxxxx
mov esi, eax
push 0x1000adec
lea eax, [esi + 6]
push str.d3d9.dll
mov dword [0x10010104], eax
call edi
push eax
call fcn.10002bf0
mov edi, eax
add esp, 0xc
lea ecx, [edi + 6]
mov dword [0x1000f800], ecx
test esi, esi
je 0x10007c03
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
push 6
push esi
call edi
mov eax, 0x10007b30
sub eax, esi
sub eax, 5
mov byte [esi], 0xe9
mov dword [esi + 1], eax
lea ecx, [ebp - 8]
push ecx
mov byte [esi + 5], 0x90
mov edx, dword [ebp - 4]
push edx
push 6
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x10007c3f
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push edi
call esi
mov ecx, 0x10007b50
sub ecx, edi
sub ecx, 5
mov byte [edi], 0xe9
mov dword [edi + 1], ecx
lea edx, [ebp - 8]
push edx
mov byte [edi + 5], 0x90
mov eax, dword [ebp - 4]
push eax
push 6
push edi
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x10007b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10007e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [edi], 0xe9
jne 0x10007e6f
push esi
lea esp, [esp]
mov al, byte [ebx]
cmp al, 0x8b
je 0x10007e1a
cmp al, 0x6a
jne 0x10007e61
mov eax, dword [edi + 1]
lea ecx, [ebp - 4]
push ecx
push 0x40
lea esi, [eax + edi + 5]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
mov edx, ebx
sub edx, esi
push 5
sub edx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [edi + 1]
mov ecx, dword [edx + edi + 6]
lea eax, [edx + edi + 5]
lea edx, [ecx + eax + 5]
cmp edx, ebx
je 0x10007e6e
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [edi], 0xe9
je 0x10007e10
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10008230
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x10008265
mov edx, dword [ebp + 8]
push esi
mov dword [0x1000f2b4], edx
call fcn.10002dc0
mov esi, edx
call fcn.10002e30
push 0
push 0
push 0
push 0x10008140
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov eax, 1
pop ebp
ret 0xc

Function at 0x100084e5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000c018]
jne 0x100084ef
repz ret
jmp fcn.100088d7