joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d00b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100deded
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100f5008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov dword [ebp - 0x28], 0
mov ebx, 0xf
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov dword [ebp - 0x2c], eax
cmp esi, eax
je 0x100d01af
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x100d0135
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x100d0120
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.1002bf50
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x14]
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x100d014e
cmp ebx, 0x10
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmovae eax, edi
mov byte [eax + ecx], 0
jmp 0x100d015b
sub ecx, edx
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.10063520
cmp dword [ebp - 0x14], 0x10
lea ebx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edi, 0x811c9dc5
mov edx, dword [ebp - 0x18]
cmovae ebx, eax
xor ecx, ecx
test edx, edx
je 0x100d018a
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, edx
jb 0x100d0176
mov eax, dword [ebp - 0x28]
cmp edi, dword [ebp + 8]
jne 0x100d019a
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x100d01aa
dec ecx
mov dword [ebp - 0x30], ecx
add esi, 0x1c
cmp esi, dword [ebp - 0x2c]
je 0x100d01b2
mov ebx, dword [ebp - 0x14]
jmp 0x100d010c
mov esi, dword [esi + 0x18]
jmp 0x100d01b4
mov eax, dword [ebp - 0x28]
xor esi, esi
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x100d01e7
inc ecx
mov edx, eax
cmp ecx, 0x1000
jb 0x100d01dd
mov eax, dword [eax - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x2c], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100d0207
mov eax, dword [ebp - 0x2c]
push ecx
push eax
call fcn.100d2cb7
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d283c
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x100d0210
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100deded
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100f5008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov dword [ebp - 0x28], 0
mov ebx, 0xf
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x28], dl
mov dword [ebp - 4], edx
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov dword [ebp - 0x2c], eax
cmp esi, eax
je 0x100d030f
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x28]
cmp eax, esi
je 0x100d0295
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x100d0280
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.1002bf50
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x14]
lea ecx, [edx - 3]
cmp ecx, edx
ja 0x100d02ae
cmp ebx, 0x10
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x28]
cmovae eax, edi
mov byte [eax + ecx], 0
jmp 0x100d02bb
sub ecx, edx
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.10063520
cmp dword [ebp - 0x14], 0x10
lea ebx, [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edi, 0x811c9dc5
mov edx, dword [ebp - 0x18]
cmovae ebx, eax
xor ecx, ecx
test edx, edx
je 0x100d02ea
movzx eax, byte [ecx + ebx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, edx
jb 0x100d02d6
mov eax, dword [ebp - 0x28]
cmp edi, dword [ebp + 8]
jne 0x100d02fa
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x100d030a
dec ecx
mov dword [ebp - 0x30], ecx
add esi, 0x1c
cmp esi, dword [ebp - 0x2c]
je 0x100d0312
mov ebx, dword [ebp - 0x14]
jmp 0x100d026c
mov esi, dword [esi + 0x18]
jmp 0x100d0314
mov eax, dword [ebp - 0x28]
xor esi, esi
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x100d0347
inc ecx
mov edx, eax
cmp ecx, 0x1000
jb 0x100d033d
mov eax, dword [eax - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x2c], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x100d0367
mov eax, dword [ebp - 0x2c]
push ecx
push eax
call fcn.100d2cb7
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d283c
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x405b80
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
cmp eax, 1
jne 0x405bc6
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
fild qword [esp]
lea ecx, [esp]
push ecx
fstp qword [0x439110]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
fild qword [esp]
fdiv qword [0x439110]
fstp qword [0x439108]
fld qword [0x42ba68]
add esp, 8
ret
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
fild qword [esp]
fdiv qword [0x439110]
fsub qword [0x439108]
add esp, 8
ret
Function at 0x41cf30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00410dd0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41cffb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41cffb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41cfae
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x41cfb9
or bh, 8
and edi, 0x8000000
je 0x41cfd4
mov eax, dword [0x43c8fc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41cffb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41d3d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x41d3fb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41d41f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x41d43a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x41ef6b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x41ef8d
cmp dword [edi + 0x3c], 0
jne 0x41ef8d
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.004267c5
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0041efba
pop edi
pop esi
pop ebx
ret 8

Function at 0x41f2fa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x429988
call fcn.0040fd28
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.004267c5
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x41f339
call fcn.004267c5
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41f347
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41f355
or eax, 0xffffffff
jmp 0x41f43d
mov ecx, esi
call fcn.0041f270
mov dword [ebp - 0x14], eax
call fcn.0042012b
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x41f38c
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41f38c
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.004200df
push dword [ebp - 0x14]
call fcn.0041fc11
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0041f008
cmp eax, edi
je 0x41f3ff
test byte [esi + 0x24], 0x10
je 0x41f3cd
push 4
mov ecx, esi
pop ebx
call fcn.0042225b
test ah, 1
je 0x41f3c5
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.00421c65
cmp dword [esi + 0x1c], edi
je 0x41f3ff
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00422341
jmp 0x41f3ff
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x41f413
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x41f42c
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x41f42c
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0041f2aa
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x421b13
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x421b55
call fcn.004267c5
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x421b55
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x421b4c
xor eax, eax
jmp 0x421b5d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00421b63
pop edi
pop esi
pop ebx
ret 4

Function at 0x426f84
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x426fb2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x426fd0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00426eea
jmp 0x426fd0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x426fd0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00426eea
test edi, edi
mov eax, edi
jne 0x426fba
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x42a505
Capabilities:
Encode data using xor

Disassembly:
sbb ah, 0x99
sub dl, 0x1a
sub ecx, 2
not ah
not edx
cwde
xchg al, dl
mov dh, al
jmp 0x42aa2d
xchg al, dh
xchg ah, ah
not eax
sbb word [ecx + 0x472000], 0x523a
xchg edx, edx
jmp 0x42a70a
cld
xchg dh, dh
mov dl, 0xa
xchg al, dh
and eax, 0x457b1427
push 0x6b36
clc
pop ecx
xchg dl, al
jmp 0x42a42f
sub edx, 0x64
and edx, 0x31
sbb dl, 0x5f
inc edx
mov eax, 0x7ce710c4
dec edx
sbb edx, esp
lea eax, [ebp - 0x72ff6b25]
mov edx, 0x1e5496f6
mov dh, 0x8e
sbb eax, 0xd9692526
mov al, 0xbb
jmp 0x42a357
mov al, 0x6c
nop
cld
mov dh, 0x6b
jge 0x42a42f
not al
add dh, cl
xchg ch, al
test dh, 0x3a
not dl
jmp loc.00478916
Function at 0x100020a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x100396b4]
sub esp, 0x10
mov edx, 0x10001af0
push ebx
lea eax, [ecx + 0x236020]
push esi
mov dword [0x1003920c], eax
lea eax, [ecx + 0xd047a8]
push edi
add ecx, 0x232530
mov dword [0x10039208], eax
push 0x10039214
mov dword [0x10039210], ecx
call fcn.1000ae8d
mov ebx, dword [0x10039210]
xor esi, esi
mov ecx, 1
mov edx, 0x100396a4
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10002124
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x20
jae 0x1000210b
push 0
jmp 0x1000210d
push 1
call edi
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x100396a4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10002102
cmp dword [0x100396a8], 0
je 0x10002205
test ebx, ebx
jne 0x1000213f
call fcn.1000add7
jmp 0x10002205
mov ecx, dword [0x10039728]
xor edx, edx
test ecx, ecx
je 0x10002205
mov esi, dword [0x10039720]
mov eax, esi
cmp ebx, dword [eax]
je 0x10002168
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x10002157
jmp 0x10002205
cmp edx, 0xffffffff
je 0x10002205
imul edi, edx, 0x2c
test byte [edi + esi + 0x14], 2
jne 0x10002205
push 1
lea ecx, [ebp - 0x10]
call fcn.1000ac97
add esp, 4
test eax, eax
jne 0x10002205
add edi, dword [0x10039720]
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea esi, [eax - 5]
cmove esi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100021fd
mov byte [esi], 0xe9
mov eax, dword [edi + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [edi + 0x14], 1
je 0x100021db
mov eax, dword [edi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [edi + 0x14], 6
lea ecx, [ebp - 0x10]
call fcn.1000ad08
xor eax, eax
mov ecx, 0x100396a4
xchg dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002300
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1000233e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10002342
cmp edx, esi
jne 0x10002327
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10002362
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10002366
cmp edx, esi
jne 0x1000234b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10002386
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000238a
cmp edx, esi
jne 0x1000236f
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003530
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x100396c8]
sub esp, 0x10
mov edx, 0x10002d70
lea eax, [ecx + 0x22ace0]
push ebx
push esi
mov dword [0x100392c8], eax
lea eax, [ecx + 0x22ae20]
mov ecx, dword [0x100396d0]
push edi
add ecx, 0xbad40
mov dword [0x100392bc], eax
push 0x100392d4
mov dword [0x100392d0], ecx
call fcn.1000ae8d
mov ebx, dword [0x100392d0]
xor esi, esi
mov ecx, 1
mov edx, 0x100396a4
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x100035ba
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x20
jae 0x100035a1
push 0
jmp 0x100035a3
push 1
call edi
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x100396a4
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10003598
cmp dword [0x100396a8], 0
je 0x1000369e
test ebx, ebx
jne 0x100035d5
call fcn.1000add7
jmp 0x1000369e
mov ecx, dword [0x10039728]
xor edx, edx
test ecx, ecx
je 0x1000369e
mov esi, dword [0x10039720]
mov eax, esi
nop dword [eax]
cmp ebx, dword [eax]
je 0x10003601
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x100035f0
jmp 0x1000369e
cmp edx, 0xffffffff
je 0x1000369e
imul edi, edx, 0x2c
test byte [edi + esi + 0x14], 2
jne 0x1000369e
push 1
lea ecx, [ebp - 0x10]
call fcn.1000ac97
add esp, 4
test eax, eax
jne 0x1000369e
add edi, dword [0x10039720]
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea esi, [eax - 5]
cmove esi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003696
mov byte [esi], 0xe9
mov eax, dword [edi + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [edi + 0x14], 1
je 0x10003674
mov eax, dword [edi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [edi + 0x14], 6
lea ecx, [ebp - 0x10]
call fcn.1000ad08
xor eax, eax
mov ecx, 0x100396a4
xchg dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008d80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10029e90
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10037040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1000b910
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1000cbcf
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.10009160
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000ab76
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10037040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, 0xffffffff
je 0x1000ac81
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1000ac7a
inc edi
cmp dword [ebp - 0x20], 0x10
jb 0x1000ac3e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x1000ac3e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1000ac3e
mov edx, dword [esi]
test edx, edx
jne 0x1000ac07
push 0x200
push edx
push dword [0x100396a8]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1000ac63
lea ebx, [esi + 8]
jmp 0x1000ac31
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x1000ac31
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x100396a8]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1000ac92
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1000abbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1000ac7a
xor edi, edi
cmp dword [esi], edi
je 0x1000ac7a
push dword [esi]
push edi
push dword [0x100396a8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000b8f4
leave
ret
mov ebx, dword [ebp - 0x24]
jmp 0x1000ac63