joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002989
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1002e08
call fcn.01002b34
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1004378
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100279e
cmp eax, esi
jne 0x1002791
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x10027a1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002778
xor esi, esi
inc esi
mov eax, dword [0x1004374]
cmp eax, esi
jne 0x10027b4
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10027ef
mov eax, dword [0x1004374]
test eax, eax
jne 0x10027e9
mov dword [0x1004374], esi
push 0x10011b0
push 0x10011a4
call fcn.010026f5
pop ecx
pop ecx
test eax, eax
je 0x10027ef
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x10028b9
mov dword [0x1004038], esi
mov eax, dword [0x1004374]
cmp eax, esi
jne 0x1002813
push 0x10011a0
push 0x1001198
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1004374], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1002820
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100437c], ebx
je 0x1002841
push 0x100437c
call fcn.01002aa9
pop ecx
test eax, eax
je 0x1002841
push ebx
push 2
push ebx
call dword [0x100437c]
push dword [0x1004020]
push dword [0x1004024]
push dword [0x100401c]
call fcn.010025bb
add esp, 0xc
mov dword [0x1004034], eax
cmp dword [0x1004028], ebx
jne 0x100289f
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1004038], ebx
jne 0x10028ad
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1004034]
call fcn.01002b79
ret
call fcn.01002c81
jmp 0x1002756
Function at 0x401040
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401050
sub eax, edx
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.00405019
mov edi, eax
add esp, 4
mov ecx, ebx
sub edi, ebx
lea ecx, [ecx]
mov dl, byte [ecx]
mov byte [edi + ecx], dl
inc ecx
test dl, dl
jne 0x401070
xor ecx, ecx
mov byte [eax + esi], dl
test esi, esi
jle 0x40108f
mov dl, byte [esp + 0x14]
xor byte [ecx + eax], dl
inc ecx
cmp ecx, esi
jl 0x401087
pop edi
pop esi
pop ebx
ret
Function at 0x402310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402329
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402364
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402360
lea ebx, [ebx]
cmp esi, eax
jae 0x402364
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402350
cmp esi, eax
jb 0x40236a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402af0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [esp + 0xc]
mov dword [esi], eax
call fcn.004024b0
mov eax, dword [eax]
test eax, eax
je 0x402b11
mov eax, dword [eax]
jmp 0x402b13
xor eax, eax
lea ecx, [esi + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, dword [esp + 8]
mov dword [esi + 4], eax
test edi, edi
je 0x402b61
lea edx, [edi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x402b61
test edi, edi
je 0x402b61
mov eax, dword [edi]
test eax, eax
je 0x402b48
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [edi + 4]
test eax, eax
je 0x402b58
push eax
call fcn.00405d66
add esp, 4
push edi
call fcn.00405459
add esp, 4
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x402b70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x412d20
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x41836c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
push 0x414440
push 0x81
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402cb2
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x402cb2
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x402cb2
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x402cb2
lea ecx, [esp + 0x18]
call fcn.004039e0
mov eax, dword [0x4195a0]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 0
mov dword [esp + 0x14], 0
call fcn.004024b0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
push edi
lea ecx, [esp + 0x28]
mov byte [esp + 0x50], 1
call fcn.00403ad0
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.00402920
test edi, edi
je 0x402ca1
push esi
push 0
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov esi, eax
test esi, esi
je 0x402ca1
lea eax, [esp + 0x14]
push eax
push esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jl 0x402ca1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ecx
push edi
push edx
call fcn.00405f40
add esp, 0xc
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], 0xffffffff
call fcn.00403650
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x38
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x40], 0xffffffff
call fcn.00403650
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x38
ret
Function at 0x4032d0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0x402480
call fcn.004063a6
mov eax, dword [esp + 0x18]
push eax
call fcn.00402ec0
add esp, 0x10
xor eax, eax
ret 0x10
Function at 0x405cd0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41836c]
jne 0x405cda
repz ret
jmp fcn.0040874c

Function at 0x40f49b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040739f
and dword [ebp - 4], 0
cmp dword [0x419fe0], 0
mov ebx, eax
jne 0x40f54c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f5fd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40f5fd
push eax
call fcn.0040732d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x419fe0], eax
call esi
push eax
call fcn.0040732d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x419fe4], eax
call esi
push eax
call fcn.0040732d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x419fe8], eax
call esi
push eax
call fcn.0040732d
pop ecx
mov dword [0x419ff0], eax
test eax, eax
je 0x40f54c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040732d
pop ecx
mov dword [0x419fec], eax
mov eax, dword [0x419fec]
cmp eax, ebx
je 0x40f5a4
cmp dword [0x419ff0], ebx
je 0x40f5a4
push eax
call fcn.004073a8
push dword [0x419ff0]
mov esi, eax
call fcn.004073a8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f5a4
test edi, edi
je 0x40f5a4
call esi
test eax, eax
je 0x40f59b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f59b
test byte [ebp - 0xc], 1
jne 0x40f5a4
or dword [ebp + 0x10], 0x200000
jmp 0x40f5dd
mov eax, dword [0x419fe4]
cmp eax, ebx
je 0x40f5dd
push eax
call fcn.004073a8
pop ecx
test eax, eax
je 0x40f5dd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f5dd
mov eax, dword [0x419fe8]
cmp eax, ebx
je 0x40f5dd
push eax
call fcn.004073a8
pop ecx
test eax, eax
je 0x40f5dd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x419fe0]
call fcn.004073a8
pop ecx
test eax, eax
je 0x40f5fd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f5ff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10020b6
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001230
call fcn.0100227c
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x10020f3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10020f3
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x100210b
cmp eax, 0x20b
je 0x10020f8
mov dword [ebp - 0x1c], ebx
jmp 0x100211f
cmp dword [ecx + 0x84], 0xe
jbe 0x10020f3
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1002119
cmp dword [ecx + 0x74], 0xe
jbe 0x10020f3
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1005664], 0xffffffff
or dword [0x1005668], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100553c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1005538]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100566c], eax
call fcn.010022e4
cmp dword [0x1005008], ebx
jne 0x100217a
push fcn.010022e4
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010022d2
push 0x10011ac
push 0x10011a8
call sub.msvcrt.dll__initterm
mov eax, dword [0x1005534]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1005530]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x10011a4
push 0x10011a0
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x1002210
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x10021e4
cmp al, 0x22
jne 0x10021d6
cmp byte [esi], 0x22
jne 0x10021ed
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x10021f7
cmp al, 0x20
jbe 0x10021e9
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x100221b
movzx eax, word [ebp - 0x48]
jmp 0x100221e
cmp byte [esi], 0x20
jbe 0x10021ed
inc esi
mov dword [ebp - 0x34], esi
jmp 0x1002210
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x100223b
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1002270
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010022b5
ret
Function at 0x10022f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100231a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x1002373
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push esi
push 1
call ebx
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x1002348
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x100235e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, 0x94
lea esi, [ebp - 0x250]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push dword [ebp + 0xc]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
pop esi
sete al
pop ebx
pop edi
leave
ret 8

Function at 0x1002b53
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
push 0x14
push 0x1001348
call fcn.0100227c
or dword [ebp - 0x1c], 0xffffffff
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], edi
cmp dword [ebp + 0x10], edi
je 0x1002bcc
push edi
push 4
call fcn.01003722
mov dword [0x10055e4], eax
cmp eax, edi
je 0x1002c1b
mov esi, 0x1005198
mov dword [ebp - 0x24], esi
mov eax, dword [esi]
cmp eax, edi
je 0x1002ba1
push dword [esi + 4]
push eax
call fcn.01002b2e
add esi, 8
jmp 0x1002b8a
push 0x20a
mov esi, 0x10056a0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1002c1b
push 0x1001338
push esi
call fcn.01002448
push eax
call dword [sym.imp.msvcrt.dll__mbscpy]
pop ecx
pop ecx
jmp 0x1002bd1
mov esi, 0x10056a0
cmp dword [0x10055f0], edi
je 0x1002bec
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x1002bfb
mov ecx, dword [0x10055d8]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x1002c14
mov eax, dword [eax]
mov dword [0x10055d8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x10055dc], eax
mov dword [ebp - 0x20], 1
or dword [ebp - 4], 0xffffffff
call fcn.01002c31
mov eax, dword [ebp - 0x20]
call fcn.010022b5
ret 0xc

Function at 0x430005
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x1001e3e
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1002ab8
call fcn.01002004
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x10053a8
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1001bf5
cmp eax, esi
jne 0x1001be8
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1001bf8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001bcf
xor esi, esi
inc esi
mov eax, dword [0x10053a4]
cmp eax, esi
jne 0x1001c0b
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001c3a
mov eax, dword [0x10053a4]
test eax, eax
jne 0x1001c34
mov dword [0x10053a4], esi
push 0x100114c
push 0x1001140
call fcn.01001b34
pop ecx
pop ecx
test eax, eax
je 0x1001c3a
jmp 0x1001d62
mov dword [0x100505c], esi
mov eax, dword [0x10053a4]
cmp eax, esi
jne 0x1001c5e
push 0x100113c
push 0x1001134
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10053a4], 2
test ebx, ebx
jne 0x1001c6a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10053ac], 0
je 0x1001c8e
push 0x10053ac
call fcn.01001f79
pop ecx
test eax, eax
je 0x1001c8e
push 0
push 2
push 0
call dword [0x10053ac]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1001cea
test al, al
je 0x1001ca8
cmp dword [ebp - 0x1c], 0
jne 0x1001cea
mov al, byte [esi]
test al, al
je 0x1001cb8
cmp al, 0x20
ja 0x1001cb8
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1001ca8
test byte [ebp - 0x3c], 1
je 0x1001cc4
movzx eax, word [ebp - 0x38]
jmp 0x1001cc7
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1005058], eax
cmp dword [0x100504c], 0
jne 0x1001d3e
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x1001cf9
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1001d0c
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1001c95
cmp dword [0x100505c], 0
jne 0x1001d4d
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1005058]
jmp 0x1001d6e
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01002049
ret
call fcn.01002151
jmp 0x1001b95
Function at 0x1c22fc0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x1c234e0
test edx, edx
je 0x1c234e0
call fcn.01c22fd7
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x1c26cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.01c26cc9

Function at 0x1c32780
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x1d0002c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQuerySection
push eax
call edi
mov dword [0x1d2ed1c], eax
push str.NtQueryVirtualMemory
push esi
call edi
mov dword [0x1d2ed14], eax
push str.NtUnmapViewOfSection
push esi
call edi
mov dword [0x1d2ed18], eax
cmp dword [0x1d2ed1c], 0
mov edi, 0xd
je 0x1c328a2
cmp dword [0x1d2ed14], 0
je 0x1c328a2
test eax, eax
je 0x1c328a2
push 0
call fcn.01c3eff0
add esp, 4
test eax, eax
je 0x1c328b6
mov esi, eax
mov eax, dword [eax]
mov edi, dword [eax + 0x18]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
call edi
lea ecx, [ebp - 0x14]
mov dword [ecx], 0
mov eax, 0x40
push ecx
push eax
push eax
push section..crthunk
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1c328bd
push 0x1d0002c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
mov ebx, dword [eax + 4]
mov ecx, ebx
call dword [section..00cfg]
xor edi, edi
mov ecx, esi
push edi
push 0x40
push section..crthunk
push 0x1c32130
push edi
push str.NtMapViewOfSection
push 0x1c20000
push dword [ebp - 0x18]
call ebx
test eax, eax
js 0x1c328c4
lea eax, [ebp - 0x14]
push eax
push 0x20
push 0x40
push section..crthunk
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [section..00cfg]
mov ecx, esi
push 1
call ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c92fe3
mov eax, edi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0xe
jmp 0x1c328a2
mov edi, 0xf
jmp 0x1c32890
mov dword [0x1d2ed20], eax
mov edi, 0x10
jmp 0x1c32890
Function at 0x1c35340
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ecx + 0x10]
test eax, eax
jne 0x1c35390
mov edx, dword [ecx + 0xc]
test edx, edx
jne 0x1c3539e
mov edx, dword [ecx]
xor eax, eax
test edx, edx
je 0x1c35390
mov dword [ecx + 0xc], edx
mov esi, dword [ecx + 4]
cmp esi, 0x40
jb 0x1c35395
movzx edi, word [edx]
cmp edi, 0x5a4d
jne 0x1c35395
mov edi, dword [edx + 0x3c]
lea ebx, [edi + 0x18]
xor eax, eax
cmp ebx, esi
ja 0x1c35390
add edx, edi
cmp dword [edx], 0x4550
jne 0x1c35390
add edx, 4
mov dword [ecx + 0x10], edx
mov eax, edx
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ecx + 0xc], 0
jmp 0x1c35390
mov esi, dword [ecx + 4]
jmp 0x1c35372

Function at 0x1c353b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x1c353c8
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [ecx + 0xc]
mov esi, dword [ecx + 0x10]
test esi, esi
jne 0x1c35418
test edi, edi
jne 0x1c3549b
mov edi, dword [ecx]
xor eax, eax
test edi, edi
je 0x1c353c0
mov dword [ecx + 0xc], edi
mov ebx, dword [ecx + 4]
cmp ebx, 0x40
jb 0x1c35468
movzx edx, word [edi]
cmp edx, 0x5a4d
jne 0x1c35468
mov esi, dword [edi + 0x3c]
lea edx, [esi + 0x18]
xor eax, eax
cmp edx, ebx
ja 0x1c353c0
add esi, edi
cmp dword [esi], 0x4550
jne 0x1c353c0
add esi, 4
mov dword [ecx + 0x10], esi
jne 0x1c3541b
jmp 0x1c353c0
mov ebx, dword [ecx + 4]
mov dword [ebp - 0x14], esi
lea edx, [esi + 0x14]
mov esi, ebx
mov ebx, edx
sub ebx, edi
lea edi, [ebx + 2]
xor eax, eax
mov dword [ebp - 0x10], esi
cmp edi, esi
ja 0x1c353c0
movzx edi, word [edx]
cmp edi, 0x10b
jne 0x1c35474
mov dword [ecx + 8], 1
add ebx, 0xe0
mov edi, dword [ebp - 0x10]
cmp ebx, edi
mov esi, dword [ebp - 0x14]
ja 0x1c353c0
cmp edi, 0xffffffff
je 0x1c35493
mov dword [ecx + 0x14], edx
mov eax, edx
jmp 0x1c353c0
mov dword [ecx + 0xc], 0
jmp 0x1c353c0
cmp edi, 0x20b
jne 0x1c354a3
mov dword [ecx + 8], 2
lea edi, [ebx + 0xf0]
cmp edi, dword [ebp - 0x10]
jbe 0x1c35445
jmp 0x1c353c0
mov eax, dword [esi + 0x4c]
mov dword [ecx + 4], eax
jmp 0x1c3545e
mov ebx, dword [ecx + 4]
jmp 0x1c353f8
mov dword [ecx + 8], 0
jmp 0x1c353c0
Function at 0x1c40360
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov ebx, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x1d12014]
xor eax, ebp
mov dword [esp + 0x48], eax
movzx eax, byte [ecx + 0xb]
test al, al
jns 0x1c40389
mov eax, dword [ecx + 4]
test eax, eax
je 0x1c404f6
mov eax, ebx
not eax
test eax, 0x300
je 0x1c404f6
cmp edi, 2
mov eax, 0x1d2fbae
mov ecx, 0x1d2fdae
cmove ecx, eax
cmp word [ecx], 0
jne 0x1c404f6
xorps xmm0, xmm0
lea esi, [esp + 0x20]
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
mov dword [esi + 0x20], 0
push esi
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esi], 0
je 0x1c404f6
cmp byte [0x1d2fbac], 0
setne al
bt ebx, 8
jb 0x1c404f6
shr ebx, 9
and ebx, 1
or bl, al
je 0x1c404f6
cmp edi, 2
mov eax, 0x1d0319c
mov edx, 0x1d031b0
cmove edx, eax
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0xb]
test cl, cl
jns 0x1c40509
mov ecx, dword [eax]
mov dword [esp + 4], ecx
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
mov dword [esp + 0x18], ecx
xor esi, esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0
mov edi, dword [edx + 4]
mov ebx, eax
sub ebx, edi
jb 0x1c40477
push edi
push dword [edx]
push dword [esp + 0xc]
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], eax
call fcn.01ca8083
mov edx, dword [esp + 0x28]
add esp, 0xc
test eax, eax
mov eax, dword [esp + 0x14]
je 0x1c40483
add edx, 0x14
inc esi
cmp esi, dword [esp + 0x18]
jb 0x1c4044b
jmp 0x1c404ef
mov eax, dword [esp + 4]
movzx ecx, word [eax + edi*2]
mov eax, dword [esp + 0x14]
cmp ecx, 0x5c
jne 0x1c40539
mov eax, dword [esp + 4]
lea eax, [eax + edi*2]
mov esi, dword [edx + 8]
cmp esi, 2
jne 0x1c404b5
mov dword [esp + 0xc], str.WOW6432Node
mov dword [esp + 8], eax
jmp 0x1c404be
cmp esi, 1
je 0x1c40546
cmp cx, 0x5c
mov dword [esp + 0x10], esi
jne 0x1c404db
lea ecx, [eax + 2]
dec ebx
cmp word [eax + 2], 0x5c
mov dword [esp + 4], ecx
mov eax, ecx
je 0x1c404c8
jmp 0x1c404df
mov dword [esp + 4], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0x18], eax
mov edx, dword [edx + 0xc]
xor esi, esi
mov eax, ebx
jmp 0x1c4047b
cmp dword [esp + 0x10], 0
jne 0x1c40514
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.01c92fe3
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
mov eax, ecx
jmp 0x1c4042a
mov eax, dword [ebp + 8]
cmp byte [eax + 0xb], 0
jns 0x1c40522
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [esp + 8]
sub edx, eax
sar edx, 1
mov ecx, dword [ebp + 8]
push dword [esp + 0xc]
push edx
call fcn.01cd32e0
jmp 0x1c404f6
test ecx, ecx
jne 0x1c40477
jmp 0x1c40498
mov dword [esp + 0xc], str.WOW6432Node_
mov edi, dword [esp + 4]
mov dword [esp + 8], edi
jmp 0x1c404be