joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40822c
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
xor ecx, ecx
mov ebp, esp
sub esp, 0x48
mov dword [0x484d20], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0x484d20
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x408298
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4

Function at 0x40829c
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], edx
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x408512
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
inc eax
push edx
je 0x408540
mov eax, ebx
mov dword [esp], esi
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x40854b
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.00408512
push ecx
cmp eax, 0xffffffff
je 0x4085a0
test byte [ebp + 0xc], 1
mov esi, eax
mov dword [esp], ebx
je 0x408598
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x408591
test byte [ebp + 0xc], 4
jne 0x4085a0
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x4085a0
mov eax, 1
jmp 0x4085a2
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x408575
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 8

Function at 0x4085ab
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
cmp eax, 0xffffffff
jne 0x4085c6
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], eax
xor ecx, ecx
mov dword [esp + 0x18], edx
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc
Function at 0x4085ff
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x64
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], 0x73006e
mov dword [ebp - 0xc], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
div ecx
xor eax, eax
add word [ebp - 0xc], dx
mov dword [esp + 8], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
jne 0x40865e
dec esi
jne 0x40860f
mov word [ebx], 0
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8

Function at 0x408669
Capabilities:
Read file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x4086a6
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x4086ad
Capabilities:
Write file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x4086ea
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x4088ee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea eax, [ebp - 0x14]
sub esp, 0x30
mov dword [ebp - 0x10], 0x4000
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
xor eax, eax
cmp dword [ebp + 0x18], 0
setne al
shl eax, 8
or eax, 0x20019
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0040883a
sub esp, 0x10
test eax, eax
je 0x40893c
mov word [ebx], 0
jmp 0x40898f
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov word [ebx + 0x3ffe], 0
test esi, esi
jne 0x408935
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
ja 0x408935
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x14
Function at 0x409a60
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x484d84], 0
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
jne 0x409a9d
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x409a88
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x409a7a
mov dword [ecx*4 + 0x484d80], eax
inc ecx
cmp ecx, 0x100
jne 0x409a73
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x409abf
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x484d80]
jmp 0x409aa7
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x408ecc
nop
mov ecx, 0x7da24b59
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x74947fea
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x402000
Capabilities:
Encode data using xor

Disassembly:
jmp 0x402048
lea eax, [eax + 0x16aa11b2]
not eax
add eax, 0x670d996a
lea eax, [eax - 0x33ae6327]
lea eax, [0x402002]
xor byte [eax], 0x2f
inc eax
cmp eax, 0x402048
jne 0x402061
lea eax, [eax - 0x1925008]
adc eax, eax
sub eax, 0xd0341d63
bswap eax
add eax, 0x118108cd
lea eax, [entry0]
push ebx
xor ebx, ebx
lea ebx, [ebx + 1]
cmp ebx, 0xfdf
jne 0x402089
mov ebx, dword [esp]
add esp, 4
add eax, 2
push eax
not eax
pop eax
jmp eax
Function at 0x409c0f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x409c3d
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x409c44
cmp ebx, dword [eax + 4]
jae 0x409c44
xor eax, eax
jmp 0x409e34
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x409c55
xor eax, eax
inc eax
jmp 0x409e33
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x409c6b
cmp ecx, edx
jae 0x409db0
cmp dword [eax + 4], 0
je 0x409c74
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x409c5c
cmp dword [ebp + 8], 0
je 0x409c96
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x409db0
cmp eax, esi
jae 0x409db0
mov eax, dword [0x413c88]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x409cbb
cmp dword [esi*4 + 0x413c90], edi
je 0x409db4
inc esi
cmp esi, eax
jl 0x409ca9
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x40d198]
test eax, eax
je 0x409e30
cmp dword [ebp - 8], 0x1000000
jne 0x409e30
test byte [ebp - 0xc], 0xcc
je 0x409d39
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x409e30
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x409e30
cmp word [eax + 0x18], 0x10b
jne 0x409e30
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x409e30
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x409d39
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x409d39
test byte [ecx + 0x27], 0x80
jne 0x409db0
push 1
push 0x413cd0
call dword [0x40d194]
test eax, eax
jne 0x409c4d
mov ecx, dword [0x413c88]
test ecx, ecx
mov edx, ecx
jle 0x409d6d
lea eax, [ecx*4 + 0x413c8c]
cmp dword [eax], edi
je 0x409d6d
dec edx
sub eax, 4
test edx, edx
jg 0x409d61
test edx, edx
jne 0x409d9e
push 0xf
pop ebx
cmp ecx, ebx
jg 0x409d7a
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x409d92
lea eax, [edx*4 + 0x413c90]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x409d80
cmp ecx, 0x10
jge 0x409d9e
inc ecx
mov dword [0x413c88], ecx
push 0
push 0x413cd0
call dword [0x40d194]
jmp 0x409c4d
xor eax, eax
jmp 0x409e33
test esi, esi
jle 0x409c4d
mov ebx, dword [0x40d194]
push 1
push 0x413cd0
call ebx
test eax, eax
jne 0x409c4d
cmp dword [esi*4 + 0x413c90], edi
je 0x409e0a
mov eax, dword [0x413c88]
lea esi, [eax - 1]
test esi, esi
jl 0x409df8
cmp dword [esi*4 + 0x413c90], edi
je 0x409df4
dec esi
jns 0x409de8
test esi, esi
jge 0x409e08
cmp eax, 0x10
jge 0x409e03
inc eax
mov dword [0x413c88], eax
lea esi, [eax - 1]
jmp 0x409e0a
je 0x409e22
xor ecx, ecx
test esi, esi
jl 0x409e22
lea eax, [ecx*4 + 0x413c90]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x409e10
push 0
push 0x413cd0
call ebx
jmp 0x409c4d
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x120
mov eax, dword [0x100812a0]
xor eax, esp
mov dword [esp + 0x11c], eax
mov edx, dword [esp + 0x128]
push esi
mov esi, dword [esp + 0x128]
mov dword [esp + 0x10], edx
test esi, esi
jne 0x1000e883
xor eax, eax
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.100201e8
add esp, 0x120
ret
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi + 0x7c]
push ebp
mov ebp, dword [eax + esi + 0x78]
xor eax, eax
add ebp, esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc], eax
test ecx, ecx
je 0x1000e9e2
cmp ebp, esi
jbe 0x1000e9e2
push ebx
push edi
cmp edx, 0x10000
jae 0x1000e8dd
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add edi, eax
cmp edx, edi
jae 0x1000e9ad
cmp edx, eax
jb 0x1000e9ad
sub edx, eax
mov eax, dword [ebp + 0x1c]
lea edx, [eax + edx*4]
mov eax, dword [edx + esi]
jmp 0x1000e983
mov ecx, dword [ebp + 0x20]
add ecx, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], eax
cmp dword [ebp + 0x18], eax
jbe 0x1000e94f
movzx edx, byte [edx]
mov dword [esp + 0x18], edx
jmp 0x1000e904
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov edx, dword [ecx + edx*4]
mov bl, byte [edx + esi]
mov ecx, dword [esp + 0x18]
add edx, esi
movzx edi, bl
sub ecx, edi
jne 0x1000e939
mov edi, dword [esp + 0x1c]
sub edi, edx
test bl, bl
je 0x1000e939
mov bl, byte [edx + 1]
movzx ecx, byte [edi + edx + 1]
inc edx
movzx eax, bl
sub ecx, eax
mov eax, dword [esp + 0x14]
je 0x1000e921
test ecx, ecx
js 0x1000e941
jg 0x1000e941
je 0x1000e968
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, dword [ebp + 0x18]
jb 0x1000e900
pop edi
pop ebx
pop ebp
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.100201e8
add esp, 0x120
ret
mov ecx, dword [ebp + 0x24]
mov edx, dword [esp + 0x10]
lea eax, [ecx + edx*2]
movzx ecx, word [eax + esi]
mov edx, dword [ebp + 0x1c]
lea eax, [edx + ecx*4]
mov eax, dword [eax + esi]
mov ecx, dword [esp + 0x20]
add eax, esi
test eax, eax
je 0x1000e94f
cmp eax, ebp
jb 0x1000e94f
add ecx, ebp
cmp eax, ecx
jae 0x1000e94f
mov cl, byte [eax]
mov ebx, eax
test cl, cl
je 0x1000e9ad
jmp 0x1000e9a0
cmp cl, 0x2e
je 0x1000e9b1
mov cl, byte [ebx + 1]
inc ebx
test cl, cl
jne 0x1000e9a0
xor eax, eax
jmp 0x1000e94f
mov esi, ebx
sub esi, eax
test esi, esi
jle 0x1000e9ad
mov ecx, esi
lea edi, [esp + 0x28]
call fcn.10010ae0
mov ecx, edi
push ecx
mov byte [esp + esi + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
inc ebx
push ebx
push eax
call fcn.1000e840
add esp, 8
jmp 0x1000e94f
mov ecx, dword [esp + 0x124]
pop ebp
pop esi
xor ecx, esp
xor eax, eax
call fcn.100201e8
add esp, 0x120
ret
Function at 0x1000f210
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Inspect section memory permissions

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x14]
mov ebx, dword [edi + 0x3c]
mov eax, dword [ebx + edi + 0x50]
push 0x40
add ebx, edi
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10083afc], eax
test eax, eax
je 0x1000f3e5
mov ecx, dword [edi + 0x3c]
movzx edx, word [ecx + edi + 0x14]
add ecx, edi
push ebp
push esi
lea ecx, [edx + ecx + 0x18]
xor esi, esi
mov edx, closesocket
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], 0
cmp si, word [ebx + 6]
jae 0x1000f2ca
lea ebp, [ecx + 0x14]
jmp 0x1000f270
mov ecx, dword [ebp]
test ecx, ecx
je 0x1000f281
cmp ecx, edx
jae 0x1000f281
mov edx, ecx
mov dword [esp + 0x10], edx
mov esi, dword [ebp - 8]
add esi, dword [0x10083afc]
lea eax, [ecx + edi]
mov ecx, dword [ebp - 4]
dec ecx
js 0x1000f2b1
mov edi, eax
lea edx, [ecx + esi]
sub edi, esi
lea ebx, [ebx]
mov al, byte [edi + edx]
mov byte [edx], al
dec edx
dec ecx
jns 0x1000f2a0
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
movzx ecx, word [ebx + 6]
inc eax
add ebp, 0x28
mov dword [esp + 0x14], eax
cmp eax, ecx
jl 0x1000f270
mov eax, dword [0x10083afc]
dec edx
js 0x1000f2e0
lea ecx, [eax + edx]
sub edi, eax
mov al, byte [edi + ecx]
mov byte [ecx], al
dec ecx
dec edx
jns 0x1000f2d2
mov eax, dword [0x10083afc]
mov ecx, eax
sub ecx, dword [ebx + 0x34]
je 0x1000f2f0
push ecx
push 1
push eax
call fcn.1000e7c0
call fcn.1000ea10
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
xor eax, eax
cmp esi, 2
setne al
push ecx
xor ecx, ecx
push edx
mov edx, dword [0x10083afc]
dec eax
and eax, 0x100836f8
test esi, esi
setne cl
push ecx
push edx
call fcn.1000ef50
mov ecx, dword [0x10083afc]
mov eax, dword [ecx + 0x3c]
movzx edx, word [eax + ecx + 0x14]
add eax, ecx
lea eax, [edx + eax + 0x18]
xor edx, edx
add esp, 0x10
xor edi, edi
cmp dx, word [ebx + 6]
jae 0x1000f39f
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esi, [eax + 0x24]
nop
mov edx, dword [esi]
xor eax, eax
test edx, 0x20000000
je 0x1000f361
mov eax, 0x10
test edx, 0x40000000
je 0x1000f36c
or eax, 0x20
test edx, edx
jns 0x1000f373
or eax, 0x40
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esi - 0x18]
push eax
mov eax, dword [esi - 0x1c]
push eax
add edx, ecx
push edx
mov dword [esp + 0x2c], 0
call ebp
movzx eax, word [ebx + 6]
mov ecx, dword [0x10083afc]
inc edi
add esi, 0x28
cmp edi, eax
jl 0x1000f350
mov edx, 0x2000
pop esi
pop ebp
test word [ebx + 0x16], dx
je 0x1000f3ba
mov eax, dword [ebx + 0x28]
push 0
push 1
push ecx
add eax, ecx
call eax
jmp 0x1000f3cb
mov edx, dword [ebx + 0x28]
push 5
push 0x1002c278
push 0
push ecx
add edx, ecx
call edx
cmp byte [esp + 0x24], 0
je 0x1000f3ed
mov eax, dword [0x100836cc]
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [0x10083afc]
pop edi
pop ebx
add esp, 8
ret
Function at 0x10010060
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push esi
push edi
mov edi, dword [ebx + 0x3c]
movzx eax, word [edi + ebx + 6]
movzx ecx, word [edi + ebx + 0x14]
add edi, ebx
lea ecx, [ecx + edi + 0x18]
mov ebp, closesocket
test eax, eax
jle 0x10010094
lea edx, [ecx + 0x14]
mov ecx, dword [edx]
test ecx, ecx
je 0x1001008e
cmp ecx, ebp
jae 0x1001008e
mov ebp, ecx
add edx, 0x28
dec eax
jne 0x10010082
push ebp
call fcn.10020596
mov esi, eax
add esp, 4
test esi, esi
jne 0x100100a7
pop edi
pop esi
pop ebp
ret
mov edx, dword [esp + 0x10]
mov dword [edx], ebp
lea edx, [ebp - 1]
test edx, edx
js 0x100100c9
mov ebp, ebx
lea ecx, [edx + esi]
sub ebp, esi
jmp 0x100100c0
mov al, byte [ecx + ebp]
mov byte [ecx], al
dec ecx
dec edx
jns 0x100100c0
mov ecx, dword [esi + 0x3c]
mov edx, 0xdfff
and word [ecx + esi + 0x16], dx
mov ecx, dword [esi + 0x3c]
movzx eax, word [ecx + esi + 0x14]
add ecx, esi
lea ecx, [eax + ecx + 0x28]
xor edx, edx
xor eax, eax
cmp dx, word [edi + 6]
jae 0x10010109
mov edi, edi
mov dword [ecx + 4], 0
mov dword [ecx], 0
movzx edx, word [edi + 6]
inc eax
add ecx, 0x28
cmp eax, edx
jl 0x100100f0
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x10010110
Capabilities:
Clear file content
Create process on windows
Create process suspended
Parse pe header
Resume thread
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x60
push ebx
push ebp
mov ebp, dword [esp + 0x6c]
mov ebx, eax
mov eax, 0x5a4d
push esi
push edi
cmp word [ebx], ax
jne 0x10010256
mov ecx, dword [ebx + 0x3c]
cmp dword [ebx + ecx], 0x4550
jne 0x10010256
cmp dword [0x100836c4], 0
jne 0x10010160
push str.NtQueryInformationProcess
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100836c4], eax
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100101d4
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 0
call fcn.10010060
mov edi, eax
add esp, 4
test edi, edi
je 0x10010256
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push eax
push ecx
push edi
push esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.100201f7
add esp, 4
jmp 0x100101df
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x10010256
push 0x40
lea edx, [esp + 0x30]
push 0
push edx
call fcn.10025370
add esp, 0xc
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push ebp
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10010256
mov edx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x78]
mov esi, dword [esp + 0x18]
push ebx
call fcn.1000f930
add esp, 4
test eax, eax
jne 0x10010261
mov edx, dword [esp + 0x18]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
Function at 0x100106c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
test edi, edi
jne 0x100106d7
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [0x10083b0c]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10010709
xor ebp, ebp
mov ecx, eax
lea esp, [esp]
cmp byte [ecx], bl
je 0x10010702
inc ebp
add ecx, 0x73
cmp ebp, 0x3e8
jl 0x100106f0
jmp 0x10010709
imul ebp, ebp, 0x73
add ebp, eax
jne 0x1001072a
push 0x40
push 0x1000
push 0x1c138
push 0
call esi
mov dword [0x10083b0c], eax
test eax, eax
jne 0x100106e8
pop esi
pop ebp
pop edi
pop ebx
add esp, 8
ret
lea esi, [ebp + 0xa]
mov dword [ebp + 0x4f], ebx
mov dword [ebp + 0x4b], edi
mov dword [esp + 0x14], esi
xor ebx, ebx
lea esp, [esp]
push 0
add edi, ebx
push edi
call fcn.1001e3a0
mov edx, eax
mov al, byte [edi]
mov dword [esp + 0x10], edx
cmp al, 0x70
jb 0x10010780
cmp al, 0x7f
ja 0x10010780
movzx eax, al
mov ecx, 0x100
imul ax, cx
mov ecx, 0x100f
add ax, cx
mov word [esi], ax
mov eax, dword [edi + 1]
sub eax, esi
add eax, edi
mov dword [esi + 2], eax
add esi, 6
jmp 0x100107d2
cmp al, 0xf
jne 0x100107a6
mov cl, byte [edi + 1]
cmp cl, 0x80
jb 0x100107a6
cmp cl, 0x8f
ja 0x100107a6
mov cx, word [edi]
mov word [esi], cx
mov eax, dword [edi + 2]
sub eax, esi
add eax, edi
mov dword [esi + 2], eax
add esi, 6
jmp 0x100107d2
cmp al, 0xe9
je 0x100107c3
cmp al, 0xe8
je 0x100107c3
push edx
push edi
push esi
call fcn.10025550
mov edx, dword [esp + 0x1c]
add esp, 0xc
add esi, dword [esp + 0x10]
jmp 0x100107d2
mov byte [esi], al
mov ecx, dword [edi + 1]
sub ecx, esi
add ecx, edi
mov dword [esi + 1], ecx
add esi, 5
mov edi, dword [esp + 0x1c]
add ebx, edx
mov eax, 6
cmp ebx, eax
jb 0x10010740
push ebx
lea eax, [ebp + 0x2b]
lea edx, [ebx + edi]
push edi
push eax
mov byte [esi], 0x68
mov dword [esi + 1], edx
mov byte [esi + 5], 0xc3
call fcn.10025550
mov ecx, dword [esp + 0x2c]
mov dword [ebp + 1], ecx
xor eax, eax
add esp, 0xc
dec eax
lea ecx, [ebp + 6]
mov byte [ebp + 0x2a], bl
mov byte [ebp], 0x68
mov byte [ebp + 5], 0xc3
mov dword [ecx], ebp
je 0x10010866
dec eax
je 0x1001084f
dec eax
je 0x10010838
mov eax, dword [esp + 0x14]
pop esi
mov byte [edi], 0x68
mov byte [edi + 5], 0xc3
mov dword [edi + 1], ebp
pop ebp
pop edi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
sub ebp, edi
sub ebp, 5
pop esi
mov byte [edi], 0xe8
mov dword [edi + 1], ebp
pop ebp
pop edi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
pop esi
mov edx, 0x15ff
pop ebp
mov word [edi], dx
mov dword [edi + 2], ecx
pop edi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
sub ebp, edi
sub ebp, 5
pop esi
mov byte [edi], 0xe9
mov dword [edi + 1], ebp
pop ebp
pop edi
pop ebx
add esp, 8
ret