joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c73b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c6f2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c6f2
cmp esi, ebx
jge 0x1001c6f2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c735
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c735
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c74d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x1001c970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001c998
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001c9b2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1000a530
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022650
leave
ret 4

Function at 0x1001cb80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cbb6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cc15
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1000a530
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1000a530
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1000a530
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022650
leave
ret 0x10
Function at 0x1001cc30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cc5c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cc8d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cc8b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1000a530
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cc8d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022650
leave
ret 8
Function at 0x405d6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a0c], 0
push esi
jne 0x405da2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405d7c
mov dword [ecx*4 + 0x422a08], eax
inc ecx
cmp ecx, 0x100
jl 0x405d77
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405dd3
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a08]
xor eax, esi
inc ecx
dec edx
jne 0x405db5
pop edi
not eax
pop esi
ret 0xc

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040bbb3
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040bbb3
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040bbb3
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040bbb3
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040bbb3
mov dword [0x41203c], eax
call fcn.0040bbb3
test eax, eax
jge 0x402550
push 8
call fcn.0040bbb3
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040bbb3
pop ecx
push 1
call fcn.0040bbb3
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040bbb3
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040bbb3
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040bbb3
jmp 0x402495

Function at 0x40bbb3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40bbc2
pop dword [ebp - 0x20]
mov eax, 0x2b4113ca
add eax, 0xd4ffa7f8
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3d419
push 0
mov eax, 0x34d76989
add eax, 0xcb69774f
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x3d603c9f
add ecx, 0xc2a01a8e
xor esi, esi
add esi, eax
mov edi, 0x3c59d1c1
add edi, 0xc3e76a03
add edi, dword [ebp - 0x20]
mov edx, 0xb0c6bd16
add edx, 0x302920a7
add dword [ebp - 0x18], ecx
mov ebx, dword [edi]
xor dword [ebp - 0x14], 0x17c4c8e0
add ebx, edx
xor dword [ebp - 0x1c], 0x320db748
mov dword [esi], ebx
xor dword [ebp - 4], ebx
add esi, 4
add edi, 4
loop 0x40bc23
add eax, 0xb73857eb
add eax, 0x48c8f79c
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..00cfg
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x6f1f3fd4
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2bd91616
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x404dd8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x404de7
pop dword [ebp - 0x14]
mov eax, 0xfec180eb
add eax, 0x17eccfc
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x877c5d2c
add dword [ebp - 0x24], 0xc6d5e81f
mov dword [ebp - 0x20], 0xebe068d7
add dword [ebp - 0x20], 0x4652e36e
mov dword [ebp - 0x1c], 0x1601b2b1
sub dword [ebp - 0x1c], 0xc9b56e83
mov dword [ebp - 0x18], 0x39a52d1
sub dword [ebp - 0x18], 0x39a52d1
lea eax, [ebp - 0x24]
push eax
mov eax, 0x39a9082f
sub eax, 0x3966d7bb
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xc3e2bba7
sub dword [ebp - 0x24], 0x4f705251
mov dword [ebp - 0x20], 0xb5192aa3
sub dword [ebp - 0x20], 0x73acc92e
mov dword [ebp - 0x1c], 0xdad41350
sub dword [ebp - 0x1c], 0x7764a6e4
mov dword [ebp - 0x18], 0x6db25c9c
sub dword [ebp - 0x18], 0x6db25c9c
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x460add6d
sub eax, 0x45c8ac49
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3c9dd
push 0
call eax
mov ecx, 0xf6902f79
sub ecx, 0xf68febf9
mov edi, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x14]
mov edx, 0x1ea7e403
sub edx, 0x644e7f28
sub dword [ebp - 8], ecx
mov esi, dword [ebx]
xor dword [ebp - 4], 0x47c949a6
sub esi, edx
mov dword [edi], esi
add edi, 0x3b8c82d9
add edi, 0xc4737d2b
add ebx, 0x7a0ed73
add ebx, 0xf85f1291
loop 0x404f03
add eax, 0x1b7853db
add eax, 0xe488acf8
xor ebx, ebx
add ebx, eax
add eax, 0x96cd24fb
sub eax, 0x96cd24f6
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x4ac542
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004ac5c1
jae 0x4ac54e
xor ecx, ecx
call fcn.004ac5c1
jae 0x4ac578
xor eax, eax
call fcn.004ac5c1
jae 0x4ac589
mov al, 0x10
call fcn.004ac5c1
adc al, al
jae 0x4ac56a
jne 0x4ac5b6
stosb byte es:[edi], al
jmp 0x4ac54f
call fcn.004ac5cd
dec ecx
loop 0x4ac595
mov eax, ebp
call fcn.004ac5cb
jmp 0x4ac5b7
lodsb al, byte [esi]
shr eax, 1
je 0x4ac5dd
adc ecx, 2
mov ebp, eax
jmp 0x4ac5b7
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004ac5cb
cmp eax, 0x7d00
jae 0x4ac5b5
cmp eax, 0x500
jae 0x4ac5b6
cmp eax, 0x7f
ja 0x4ac5b7
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4ac54f
pop ebp
ret 8
Function at 0x401317
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410040]
jne 0x40e137
repz ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4119c0], eax
mov dword [0x4119bc], ecx
mov dword [0x4119b8], edx
mov dword [0x4119b4], ebx
mov dword [0x4119b0], esi
mov dword [0x4119ac], edi
mov word [0x4119d8], ss
mov word [0x4119cc], cs
mov word [0x4119a8], ds
mov word [0x4119a4], es
mov word [0x4119a0], fs
mov word [0x41199c], gs
pushfd
pop dword [0x4119d0]
mov eax, dword [ebp]
mov dword [0x4119c4], eax
mov eax, dword [ebp + 4]
mov dword [0x4119c8], eax
lea eax, [ebp + 8]
mov dword [0x4119d4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x411910], 0x10001
mov eax, dword [0x4119c8]
mov dword [0x4118c4], eax
mov dword [0x4118b8], 0xc0000409
mov dword [0x4118bc], 1
mov eax, dword [0x410040]
mov dword [ebp - 0x328], eax
mov eax, dword [0x4116a4]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x411908], eax
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x40e238
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x411908], 0
jne 0x40e221
push 1
call sub.MSVCR80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x40176b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi + 1]
cmp eax, esi
push edi
mov edi, ecx
jb 0x40ba0f
push eax
mov ecx, edi
call fcn.0040140c
mov ebx, eax
test ebx, ebx
jl 0x4017c1
push 0
lea eax, [ebp + 0xc]
push eax
push esi
mov ecx, edi
call fcn.0040138e
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4017ca
cmp dword [ebp + 0xc], esi
jne 0x4017ca
test esi, esi
mov eax, dword [edi]
mov byte [esi + eax], 0
mov dword [edi + 4], esi
je 0x40ba1a
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp 0x40ba21
xor eax, 0x442dcf8e
xor cl, byte [ecx]
and dword [eax], edi
xchg ecx, eax
jg 0x40b9df
mov word [eax], gs
mov eax, 0xca324ffe
cdq
push ds
int 0x1e
cli
scasd eax, dword es:[edi]
pop edx
out dx, al
sub eax, 0x467dc6d
lahf
jo 0x40b9ff
cmp al, 0xfc
js 0x40ba66
xor edx, dword [ebx]
xchg edx, eax
inc esp
adc al, 0x90
nop
call dword [eax - 0x33459fbc]
jo 0x40b9d3
dec esp
xchg edx, eax
push es
mov dl, 0xf0
and byte [edx - 0x2fb9c95b], bh
arpl di, cx
movsd dword es:[edi], dword [esi]
inc esi
shl byte [ebx - 0x31], 1
mov eax, ds
jg 0x40b9f6
loope 0x40ba81
jo 0x40ba1a
jo 0x40ba1a
invalid
mov bl, 0x32
dec ecx
arpl word [ebx], ax
dec esi
push 0xe033a678
xchg byte [ecx + 0x165a2b3b], al
into
invalid
inc ecx
xchg ebx, eax
and cl, byte [ebp - 0x7b3149b7]
lea esp, es:[edi + 0x29bd409c]
adc al, 0x15
cmc
popfd
std
invalid
test ah, dh
inc edi
call [eax - 0x43]
in al, 0x72
into
das
push 0x551ba457
in al, dx
cdq
mov byte [0xe706b6bd], al
invalid
Function at 0x4017d7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
call int.004018de
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
je 0x401852
cmp edi, ebx
je 0x401852
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x40c16c
cmp dword [ebp + 8], ebx
jne 0x40c1a0
push eax
push edi
lea ecx, [ebp - 0xc]
call fcn.0040176b
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
jl 0x401841
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
call fcn.0040185f
lea ecx, [ebp - 0xc]
call fcn.00401325
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
jmp fcn.0040c1aa
and esi, eax
jb 0x40c17c
xchg edi, eax
add dword [eax + 0x69], edi
push edx
dec esp
inc ebx
jno 0x40c0cf
arpl bx, cx
lodsb al, byte [esi]
in al, 0xaa
lodsd eax, dword [esi]
jg 0x40c146
adc dword [esi + esi - 0x7ad0be9c], ebp
inc esp
jne 0x40c131
push esp
rol byte [eax], 1
push esp
test al, 0x41
dec eax
or byte [eax], cl
or byte [0x7abbd32f], 0x9f
push edx
sahf
ret
invalid

Function at 0x40195f
Capabilities:
Hash data via wincrypt

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x100010a0
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x320
sub eax, 0
push ebx
push esi
je 0x100012ab
dec eax
jne 0x100012c0
cmp dword [esp + 0x334], 1
je 0x10001296
lea eax, [esp + 8]
mov bl, 0x6c
push eax
mov byte [esp + 0xc], 0x54
mov byte [esp + 0xd], 0x65
mov byte [esp + 0xe], 0x72
mov byte [esp + 0xf], 0x53
mov byte [esp + 0x10], 0x61
mov byte [esp + 0x11], 0x66
mov byte [esp + 0x12], 0x65
mov byte [esp + 0x13], 0x2e
mov byte [esp + 0x14], 0x64
mov byte [esp + 0x15], bl
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x10001277
mov al, 0x5f
mov cl, 0x69
mov byte [esp + 0x28], 0x47
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x6f
mov byte [esp + 0x2b], 0x62
mov byte [esp + 0x2c], 0x61
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x5c
mov byte [esp + 0x2f], 0x73
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x31], 0x61
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x66
mov byte [esp + 0x36], cl
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], 0x65
mov byte [esp + 0x39], al
mov byte [esp + 0x3a], cl
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x70
mov byte [esp + 0x3d], 0x75
mov byte [esp + 0x3e], 0x74
mov byte [esp + 0x3f], al
mov byte [esp + 0x40], 0x66
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x61
mov byte [esp + 0x43], 0x67
mov byte [esp + 0x44], al
mov byte [esp + 0x45], 0x25
mov byte [esp + 0x46], 0x64
mov byte [esp + 0x47], 0
mov byte [esp + 0x48], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x22c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x228]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
test esi, esi
je 0x10001277
push 0
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x10001263
cmp dword [ebx], 0
jne 0x1000125c
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], 0
mov edx, dword [esp + 0x330]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x12c]
push 0x100
push ecx
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x12c]
mov dword [ebx], 1
push eax
call fcn.10003b70
add esp, 4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop ebx
add esp, 0x320
ret 0xc
mov ecx, dword [esp + 0x32c]
push ecx
call fcn.10001000
add esp, 4
test eax, eax
jne 0x10001296
pop esi
pop ebx
add esp, 0x320
ret 0xc
call fcn.100012d0
pop esi
mov eax, 1
pop ebx
add esp, 0x320
ret 0xc
mov edx, dword [esp + 0x32c]
push edx
call fcn.10001080
add esp, 4
call fcn.10002130
pop esi
mov eax, 1
pop ebx
add esp, 0x320
ret 0xc
Function at 0x100012d0
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push 0
push 0x10001300
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov dword [0x10006088], eax
add esp, 0x1c
ret
Function at 0x10002260
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10c
test eax, eax
push edi
je 0x1000229a
push 0
push 0
push 0
push 0x10002850
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
add esp, 0x10c
ret 8
mov edi, 0x100061a0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x1000228e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
not eax
push eax
lea eax, [esp + 0xc]
push 0x1000503c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x28]
call fcn.10002940
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x2c]
call fcn.100029a0
lea ecx, [esp + 0x28]
call fcn.100035a0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x100061a0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
add esp, 0x10c
ret 8
Function at 0x10002970
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x100035c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x100062b0]
sub esp, 0x420
test eax, eax
push esi
jne 0x10003673
mov al, 0x4c
mov cl, 0x61
mov byte [esp + 4], al
mov byte [esp + 8], al
mov al, 0x72
mov byte [esp + 5], 0x6f
mov byte [esp + 0xb], al
mov byte [esp + 0xd], al
lea eax, [esp + 4]
mov byte [esp + 6], cl
push eax
push str.kernel32.dll
mov byte [esp + 0xf], 0x64
mov byte [esp + 0x11], 0x69
mov byte [esp + 0x12], 0x62
mov byte [esp + 0x14], cl
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], 0x57
mov byte [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003694
mov cl, 0x8b
add eax, 5
mov byte [0x100062a4], cl
mov byte [0x100062a5], 0xff
mov byte [0x100062a6], 0x55
mov byte [0x100062a7], cl
mov byte [0x100062a8], 0xec
mov byte [0x100062a9], 0x68
mov dword [0x100062aa], eax
mov byte [0x100062ae], 0xc3
mov dword [0x100062b0], 1
push 0x40
push 0x3000
push 0xb
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100036a9
pop esi
add esp, 0x420
ret 4
mov eax, dword [0x100062b0]
test eax, eax
jne 0x10003673
xor eax, eax
pop esi
add esp, 0x420
ret 4
mov edx, dword [esp + 0x428]
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x2a]
mov word [esp + 0x28], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
push 0x200
push ecx
push 0xffffffffffffffff
push edx
push 0
push 0
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [0x100062a4]
mov eax, esi
mov dword [eax], ecx
mov edx, dword [0x100062a8]
mov dword [eax + 4], edx
mov cx, word [0x100062ac]
mov word [eax + 8], cx
mov dl, byte [0x100062ae]
mov byte [eax + 0xa], dl
lea eax, [esp + 0x28]
push eax
call esi
push 0x8000
push 0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
pop edi
pop esi
add esp, 0x420
ret 4