joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007ba0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10007ab0
push 5
sub eax, 0x598fbe
push 0x598fb9
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x10007c04
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x598fb9
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x598fb9
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x10007c0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10007c30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4f3ec8
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4f3ec8], 0xff
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4f3ec8
call esi
push 0x10007c90
push 0x50ad14
mov bl, 0xe8
call fcn.1000ded0
push 0x10007e40
push 0x50ad2d
call fcn.1000ded0
add esp, 0x10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007ed0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x607090
call esi
mov bl, 0xeb
lea ecx, [ebp - 4]
push ecx
mov byte [0x607090], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x607090
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x607095
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x607095], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x607095
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x607141
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x607141], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x607141
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x607146
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x607146], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x607146
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x6071b3
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x6071b3], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x6071b3
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x6071b8
call esi
mov byte [0x6071b8], bl
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push 0x6071b8
call esi
push 0x10008010
push 0x4beb03
mov bl, 0xe8
call fcn.1000ded0
push 0x10008010
push 0x4c1900
call fcn.1000ded0
push 0x10008010
push 0x5df615
call fcn.1000ded0
push 0x10008060
push 0x64d303
call fcn.1000ded0
add esp, 0x20
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100081e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10013020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10008227
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000effe
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x18]
push eax
push 6
lea ecx, [ebp - 0x20]
push ecx
push edi
call ebx
mov edx, 0x1112
cmp word [ebp - 0x20], dx
jne 0x1000833c
cmp dword [ebp - 0x1e], 0x36
jne 0x1000833c
cmp byte [ebp + 0xc], 0
push esi
mov esi, 0x1005d3e4
je 0x10008267
mov esi, 0x1005d414
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
call ebx
mov edx, dword [0x1005d444]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi], edx
mov eax, dword [0x1005d448]
xor eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov ecx, dword [0x1005d44c]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 8], ecx
mov edx, dword [0x1005d450]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0xc], edx
call ebx
mov edx, dword [0x1005d444]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi + 0x10], edx
mov eax, dword [0x1005d448]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [0x1005d44c]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x18], ecx
mov edx, dword [0x1005d450]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0x1c], edx
call ebx
mov edx, dword [0x1005d444]
xor edx, dword [ebp - 0x14]
push edi
mov dword [esi + 0x20], edx
mov eax, dword [0x1005d448]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov ecx, dword [0x1005d44c]
xor ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ecx
mov edx, dword [0x1005d450]
xor edx, dword [ebp - 8]
mov dword [esi + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000effe
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.1000effe
mov esp, ebp
pop ebp
ret 8
Function at 0x1000b350
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x1000b360
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x1000b36c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x1000b376
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x1000b380
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x1000b38a
or eax, 8
shr ecx, 1
test cl, 1
je 0x1000b394
or eax, 4
shr ecx, 1
test cl, 1
je 0x1000b39e
or eax, 2
test cl, 2
je 0x1000b3a6
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x1000b460
test al, 1
je 0x1000b46d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x1000b460
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x1000b354
pop edi
pop ebx
ret

Function at 0x1000b490
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x100113cc
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x1000b4c2
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x1000b4f0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x1000b553
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x1000b539
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x1000b518
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x1000b510
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b5b0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x10013020]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
lea esi, [esp + 0x10]
call fcn.1000b350
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x79464]
mov eax, str.Main.gbt
call fcn.1000b490
test al, al
je 0x1000b626
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.Main.gbt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000b626
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x79460
je 0x1000b63c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.1000effe
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x79460
lea esi, [ebx + 4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000b61f
xor eax, eax
mov edx, eax
shr edx, 8
xor dl, 0x95
add dl, byte [esi + eax]
xor dl, al
xor dl, 0xca
mov byte [esi + eax], dl
inc eax
cmp eax, 0x79460
jb 0x1000b661
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x414]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.1000effe
mov esp, ebp
pop ebp
ret

Function at 0x1000b6a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x518
mov eax, dword [0x10013020]
xor eax, esp
mov dword [esp + 0x514], eax
cmp dword [edi + 0x114], 0
push ebx
push esi
je 0x1000b790
push 0x103
lea eax, [esp + 0x415]
push 0
push eax
mov byte [esp + 0x41c], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 0x414]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000b708
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ebx, [edi + 0xb1]
push ebx
lea esi, [esp + 0x414]
call fcn.1000df10
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x1000b731
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea esi, [esp + 0x10]
call fcn.1000b350
mov edx, esi
push edx
lea esi, [esp + 0x10]
mov eax, ebx
call fcn.1000b490
test al, al
jne 0x1000b768
push 0x10
push str.Error
push str.Main.exe_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [edi + 0x114]
cmp eax, dword [esp + 0xc]
je 0x1000b790
push 0x10
push str.Error
push str.Main.exe_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x51c]
pop esi
pop ebx
xor ecx, esp
call fcn.1000effe
mov esp, ebp
pop ebp
ret
Function at 0x1000b7b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x10013020]
xor eax, esp
mov dword [esp + 0x40c], eax
cmp dword [edi + 0x118], 0
push ebx
push esi
je 0x1000b84a
lea esi, [esp + 0x10]
call fcn.1000b350
mov eax, esi
lea ebx, [edi + 0xd1]
push eax
lea esi, [esp + 0x10]
mov eax, ebx
call fcn.1000b490
test al, al
jne 0x1000b812
push 0x10
push str.Error
push str.Plugin_1_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [edi + 0x118]
cmp ecx, dword [esp + 0xc]
je 0x1000b826
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x1000b838
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.EntryProc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000b84a
call eax
mov ecx, dword [esp + 0x414]
pop esi
pop ebx
xor ecx, esp
call fcn.1000effe
mov esp, ebp
pop ebp
ret

Function at 0x1000b860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x10013020]
xor eax, esp
mov dword [esp + 0x40c], eax
cmp dword [edi + 0x11c], 0
push ebx
push esi
je 0x1000b8fa
lea esi, [esp + 0x10]
call fcn.1000b350
mov eax, esi
lea ebx, [edi + 0xf1]
push eax
lea esi, [esp + 0x10]
mov eax, ebx
call fcn.1000b490
test al, al
jne 0x1000b8c2
push 0x10
push str.Error
push str.Plugin_2_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [edi + 0x11c]
cmp ecx, dword [esp + 0xc]
je 0x1000b8d6
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x1000b8e8
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.EntryProc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000b8fa
call eax
mov ecx, dword [esp + 0x414]
pop esi
pop ebx
xor ecx, esp
call fcn.1000effe
mov esp, ebp
pop ebp
ret

Function at 0x1000c550
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0x6c41c0], 5
jne 0x1000c601
cmp dword [0x101da554], 1
jne 0x1000c601
push esi
call fcn.1000c610
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101da560]
cmp eax, dword [0x101da568]
jbe 0x1000c5c9
mov dword [0x101da554], 2
mov dword [0x101da558], 0
call esi
mov dword [0x101da55c], eax
call esi
mov dword [0x101da560], eax
mov dword [0x101da564], 0
mov dword [0x101da568], 0
mov eax, 0x4e0ca0
mov ecx, 0x57506a0
pop esi
jmp eax
call esi
sub eax, dword [0x101da55c]
cmp eax, dword [0x101da564]
jb 0x1000c600
mov eax, dword [0x101da558]
sub eax, 0
je 0x1000c5f4
dec eax
jne 0x1000c5f9
call fcn.1000c780
call esi
mov dword [0x101da55c], eax
pop esi
ret
call fcn.1000c720
call esi
mov dword [0x101da55c], eax
pop esi
ret
Function at 0x1000cb50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101da558], 2
jne 0x1000cbcb
mov edx, dword [0x100d9890]
mov eax, dword [0x100d988c]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov ax, word [0x100d9894]
lea edx, [ebp - 0x10]
push esi
mov ecx, 0xe
push edx
mov dword [ebp - 0x10], 0x3f30ec1
mov word [ebp - 4], ax
call fcn.1000c430
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 4
mov dword [0x101da554], 1
mov dword [0x101da558], 3
call esi
mov dword [0x101da55c], eax
call esi
mov dword [0x101da560], eax
mov eax, 0x7530
mov dword [0x101da564], eax
mov dword [0x101da568], eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000cf10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x1000cf90
push 0x5b79b4
mov bl, 0xe8
call fcn.1000ded0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0x5b7a0f
call esi
mov edx, 0x5b7a0f
mov ecx, 0x90909090
lea eax, [ebp - 4]
push eax
mov word [edx], cx
mov ecx, dword [ebp - 4]
push ecx
push 2
push edx
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 2
push 0x5b7996
call esi
mov ecx, 0x5b7996
mov eax, 0x90909090
lea edx, [ebp - 4]
push edx
mov word [ecx], ax
mov eax, dword [ebp - 4]
push eax
push 2
push ecx
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d020
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0
call dword [sym.imp.MSVCR100.dll__time64]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x1000d0b0
push 5
sub eax, 0x623255
push 0x623250
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x1000d096
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x623250
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x623250
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x1000d09c
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000d240
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x61fc58
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x61fc58], 0xeb
mov edx, dword [ebp - 4]
push edx
push 1
push 0x61fc58
call esi
push 0x61fd1a
push 0x61fcd2
mov bl, 0xe9
call fcn.1000ded0
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x61fd1f
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x61fd1f], 0x50
mov edx, dword [ebp - 4]
push edx
push 1
push 0x61fd1f
call esi
push 0x1000d2e0
push 0x61fd79
mov bl, 0xe8
call fcn.1000ded0
push 0x1000d310
push 0x5dce0a
call fcn.1000ded0
add esp, 0x10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000da40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push eax
push str.SoftwareWebzenMUConfig
push getpeername
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000da9b
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push eax
push eax
mov eax, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000da91
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x1000dab0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x103dd21c]
push esi
test eax, eax
jne 0x1000dadd
mov eax, dword [0x575052c]
push 0x1000dbe0
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x103dd21c], eax
test eax, eax
je 0x1000db28
mov ecx, dword [0x575052c]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1000db0e
mov edx, dword [0x575052c]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov esi, 0x103dd218
call fcn.1000db30
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x575052c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov esi, 0x103dd218
call fcn.1000db30
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000dc40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x10
call fcn.1000e0ef
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
mov eax, 0x90909090
mov dword [esi], eax
mov dword [esi + 4], eax
add esp, 4
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10
xor ebx, ebx
push 0x5990af
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x1000dcb6
mov ecx, dword [esi]
mov eax, 0x5990af
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 0x10
push 0x5990af
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x1000dcbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x1000ddd0
push 5
sub edx, 0x5990b4
push 0x5990af
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x1000dd0c
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x5990af
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x5990af
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x1000dd12
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 6
call fcn.1000e0ef
add esp, 4
lea edx, [ebp - 4]
push edx
mov esi, eax
push 0x40
mov eax, 0x90909090
push 6
mov dword [esi], eax
push 0x5dee8e
mov word [esi + 4], ax
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x1000dd68
mov ecx, dword [esi]
mov eax, 0x5dee8e
mov dword [eax], ecx
mov dx, word [esi + 4]
mov word [eax + 4], dx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 6
push 0x5dee8e
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x1000dd6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x1000de80
push 5
sub edx, 0x5dee8e
push 0x5dee89
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x1000ddbe
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x5dee89
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x5dee89
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x1000ddc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000dea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 4
push esi
call edi
fld dword [ebp + 0xc]
mov edx, dword [ebp + 8]
fstp dword [esi]
lea ecx, [ebp + 8]
push ecx
push edx
push 4
push esi
call edi
pop edi
pop esi
pop ebp
ret
Function at 0x1000ded0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call edi
cmp bl, 0xff
je 0x1000def1
mov byte [esi], bl
mov ecx, dword [ebp + 0xc]
sub ecx, esi
sub ecx, 5
lea edx, [ebp - 4]
push edx
mov dword [esi + 1], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000df60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [ebp - 0x10], cl
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x1000df99
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov dword [esi], eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push esi
mov byte [esi + 4], cl
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x1000df8e
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000e160
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x100120b8
call fcn.1000f510
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov edx, dword [ebp - 0x30]
cmp word [edx], ax
jne 0x1000e1c8
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x1000e1c8
mov ecx, dword [eax + 0xd8]
lea esi, [ecx + edx]
cmp dword [ebp + 0xc], esi
jb 0x1000e1c8
mov eax, dword [eax + 0xdc]
add eax, ecx
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x1000e1c8
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1000e1d1
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.1000f555
ret