joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcaed20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xcaed58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xcaed60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xcaed94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xcaed94
push eax
push esi
call fcn.00cb120b
add esp, 8
pop esi
ret 0x10

Function at 0xcaeda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcaee22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xcaee15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xcc7320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00cb0dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xcaedda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xcaee30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcaeec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xcaeeb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xcc7320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00cb0dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xcaeeab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xcaee6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xcaf000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xcaf131
push esi
call fcn.00cb2145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00ca1080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xcaf131
push 0
push ebp
call fcn.00ca13a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00ca1260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xcaf08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00ca12f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xcaf121
push 0xcc7918
push edi
call fcn.00cb03f0
push eax
push ebx
push esi
call fcn.00caef60
push 0xcc78f8
push edi
call fcn.00cb03f0
push eax
push ebx
push esi
call fcn.00caef60
push 0xcc78d8
push edi
call fcn.00cb03f0
push eax
push ebx
push esi
call fcn.00caef60
push 0xcc78c0
push edi
call fcn.00cb03f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00caef60
push 0xcc78a0
push edi
call fcn.00cb03f0
push eax
push ebx
push esi
call fcn.00caef60
push 0xcc7888
push edi
call fcn.00cb03f0
push eax
push ebx
push esi
call fcn.00caef60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xcb01b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00cb0140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00cb0140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00cb0140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00cb0140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xcb0230
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
mov ebp, dword [esp + 0x218]
push esi
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcb02d6
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
push edx
call edi
mov esi, eax
test esi, esi
jne 0xcb02ae
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.00cb0230
mov esi, eax
add esp, 8
test esi, esi
jne 0xcb02ae
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call edi
mov esi, eax
test esi, esi
je 0xcb027e
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
pop edi
je 0xcb02ce
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0xcb0bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xcb0c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xcc287c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xcb0c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xcb0c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x1000a390
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov ecx, 0x401000
call fcn.1000aa80
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.1000c8b0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1000a3ed
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call edi
cmp esi, 0x53ec8b55
jne 0x1000a400
mov eax, 0x3e9
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x401000
call fcn.1000aa80
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.1000c8b0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1000a44f
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call edi
cmp esi, 0x16197be9
jne 0x1000a462
mov eax, 0x3ea
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8245bc
call fcn.1000c150
cmp eax, 0x94bf
jne 0x1000a47e
mov eax, 0x3f3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8252fc
call fcn.1000c150
cmp eax, 0x94bf
jne 0x1000a49a
mov eax, 0x44d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x82533c
call fcn.1000c150
cmp eax, 0x94bf
jne 0x1000a4b6
mov eax, 0x457
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858d51
call fcn.1000c150
cmp eax, 0x3539f633
jne 0x1000a4d2
mov eax, 0xc80
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858c61
call fcn.1000c150
xor ecx, ecx
mov edx, 0xc8a
cmp eax, 0x3539f633
pop edi
cmove ecx, edx
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000b070
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov bh, dl
mov eax, esi
mov byte [ebp - 1], bh
mov dword [ebp - 0xc], esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub eax, 1
je 0x1000b0a5
sub eax, 1
je 0x1000b0f9
sub eax, 2
je 0x1000b156
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
sub bl, al
dec bl
mov dword [ebp - 8], eax
movzx ecx, bh
mov dword [ebp - 0x1c], 0
test bh, bh
jne 0x1000b0c7
mov byte [ebp - 0x10], bh
mov byte [eax], bl
jmp 0x1000b0f9
lea edx, [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0x1c], eax
call edi
mov ecx, dword [ebp - 8]
test eax, eax
setne byte [ebp - 0x10]
mov byte [ecx], bl
test eax, eax
je 0x1000b0f9
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call edi
mov eax, dword [ebp + 0xc]
sub eax, esi
mov dword [ebp - 0x1c], 0
mov esi, dword [ebp + 8]
sub eax, esi
movzx eax, ax
mov dword [ebp - 8], eax
movzx ecx, ax
movzx eax, bh
add eax, eax
jne 0x1000b123
mov byte [ebp - 0x10], 0
mov word [esi], cx
jmp 0x1000b156
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x1c], esi
call edi
mov ecx, dword [ebp - 8]
test eax, eax
setne byte [ebp - 0x10]
mov word [esi], cx
test eax, eax
je 0x1000b156
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call edi
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
add eax, esi
mov ebx, dword [ebp + 0xc]
sub ebx, eax
mov dword [ebp - 0x1c], 0
movzx eax, byte [ebp - 1]
shl eax, 2
test eax, eax
jne 0x1000b181
mov byte [ebp - 0x10], al
mov dword [esi], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x1c], esi
call edi
test eax, eax
setne byte [ebp - 0x10]
mov dword [esi], ebx
test eax, eax
je 0x1000b1b0
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x1c]
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b1c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov byte [ebp - 2], dl
mov dword [ebp - 0x18], 0
push ebx
movzx ebx, dl
push esi
mov esi, eax
push edi
mov edi, ecx
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test dl, dl
jne 0x1000b1eb
xor dl, dl
jmp 0x1000b209
lea edx, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push edx
push 0x40
push ebx
push eax
mov dword [ebp - 0x18], eax
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, dword [ebp + 8]
setne dl
mov byte [ebp - 0xc], dl
mov dh, byte [esi]
mov byte [ebp - 1], dh
test dl, dl
je 0x1000b22e
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
push edx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call ecx
mov eax, dword [ebp + 8]
mov dh, byte [ebp - 1]
movzx ecx, dh
sub ecx, 0xe8
je 0x1000b319
sub ecx, 1
je 0x1000b319
sub ecx, 0x16
jne 0x1000b30a
mov dword [ebp - 0x18], ecx
lea esi, [eax + 1]
test ebx, ebx
jne 0x1000b25d
xor cl, cl
jmp 0x1000b279
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov byte [ebp - 0xc], cl
mov dl, byte [esi]
mov byte [ebp - 1], dl
test cl, cl
je 0x1000b2a2
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 8]
mov dl, byte [ebp - 1]
cmp dl, 0x15
je 0x1000b2ac
cmp dl, 0x25
jne 0x1000b30a
shl ebx, 2
lea esi, [eax + 2]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
test ebx, ebx
jne 0x1000b2c5
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor al, al
jmp 0x1000b2e3
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push 0x40
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov dword [ebp - 0x18], esi
call ebx
mov ecx, dword [ebp - 0x18]
test eax, eax
setne al
mov byte [ebp - 0xc], al
mov esi, dword [esi]
test al, al
je 0x1000b2fd
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
push edx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push ecx
call ebx
mov eax, dword [esi]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, esp
inc eax
mov dword [ecx], eax
lea esi, [eax + 4]
mov cl, byte [ebp - 2]
call fcn.1000cbe0
add esp, 4
add eax, esi
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b4f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov si, cx
movzx edx, dl
xor ebx, ebx
movzx ecx, si
test si, si
mov word [ebp - 2], si
mov esi, dword [ebp + 8]
sete bl
mov dword [ebp - 8], ecx
lea eax, [edx*4]
mov dword [ebp - 0xc], edx
add ebx, 0xc2
mov dword [ebp - 0x20], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000b53d
mov byte [ebp - 0x14], 0
mov dword [esi], ebx
jmp 0x1000b572
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x20], esi
call edi
test eax, eax
setne byte [ebp - 0x14]
mov dword [esi], ebx
test eax, eax
je 0x1000b56c
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x20]
call edi
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov bx, word [ebp - 2]
test bx, bx
je 0x1000b5ca
mov esi, dword [ebp + 8]
lea eax, [edx + edx]
inc esi
mov dword [ebp - 0x20], 0
test eax, eax
jne 0x1000b59a
mov byte [ebp - 0x14], al
mov word [esi], cx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x20], esi
call edi
test eax, eax
setne byte [ebp - 0x14]
mov word [esi], bx
test eax, eax
je 0x1000b5ca
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x20]
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c150
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
call fcn.1000aa80
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.1000c8b0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1000c1a9
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000cbe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, cl
xor edx, edx
shl eax, 2
mov dword [ebp - 0x14], edx
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x1000cbfd
xor al, al
jmp 0x1000cc19
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov esi, dword [esi]
test al, al
je 0x1000cc37
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000cd90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor edx, edx
movzx eax, cl
mov dword [ebp - 0x14], edx
push esi
mov esi, dword [ebp + 8]
test cl, cl
jne 0x1000cdab
xor al, al
jmp 0x1000cdc7
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov bl, byte [esi]
test al, al
je 0x1000cde5
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10010000
Capabilities:
Hash data using fnv

Disassembly:
mov edx, dword [esp + 8]
movzx eax, byte [edx]
xor eax, dword [esp + 4]
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
ret

Function at 0x10010040
Capabilities:
Hash data using fnv

Disassembly:
mov edx, dword [esp + 8]
movzx eax, byte [edx]
xor eax, dword [esp + 4]
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
ret
Function at 0x10022310
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a4bd
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100f1340]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [ebp + 8], 0
mov ecx, dword [edi + 0x38]
je 0x100224ac
test ecx, ecx
jne 0x10022464
push dword [edi + 0x18]
call fcn.10020520
add esp, 4
mov dword [edi + 0x24], eax
mov ecx, edi
call fcn.10020800
mov dword [edi + 0x38], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push dword [edi + 0x24]
mov dword [ebp - 4], 0
push dword [edi + 0x18]
call ebx
test eax, eax
je 0x1002244e
push dword [edi + 0x24]
lea eax, [ebp + 8]
push eax
call fcn.100133a0
lea esi, [edi + 0x1c]
add esp, 8
cmp esi, eax
je 0x100223ce
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [esi]
mov dword [esi], ecx
test eax, eax
je 0x100223ce
push eax
call fcn.1004bdad
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x100223de
push eax
call fcn.1004bdad
add esp, 4
push dword [edi + 0x24]
push dword [edi + 0x18]
push dword [esi]
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [edi + 0x18]
mov edx, dword [edi + 0x38]
sub edx, esi
mov dword [ebp + 8], 0xe9
sub edx, 5
mov eax, dword [esi]
cmp al, 0xe8
movzx ecx, al
cmovne ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x13], edx
mov byte [ebp - 0x14], cl
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
movzx eax, byte [ebp - 0x10]
mov byte [esi + 4], al
mov eax, dword [edi + 0x24]
sub eax, 5
push eax
mov eax, dword [edi + 0x18]
add eax, 5
push 0x90
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea eax, [ebp + 8]
push eax
push 0x20
push dword [edi + 0x24]
push dword [edi + 0x18]
call ebx
test eax, eax
jne 0x100224ce
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x28]
mov ebx, dword [edi + 0x34]
mov edx, dword [edi + 0x30]
mov ecx, edx
mov esi, dword [eax + 0x1c]
mov eax, ebx
shrd ecx, eax, 8
mov eax, ebx
mov byte [esi + 1], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, ebx
mov byte [esi], dl
shrd edx, eax, 0x18
mov eax, ebx
mov byte [esi + 4], bl
shr eax, 8
mov byte [esi + 5], al
mov eax, ebx
shr eax, 0x10
shr ebx, 0x18
mov byte [esi + 2], cl
mov byte [esi + 3], dl
mov byte [esi + 6], al
mov byte [esi + 7], bl
jmp 0x100224ce
test ecx, ecx
je 0x100224ce
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x28]
mov dword [edi + 0x34], ecx
mov eax, dword [eax + 0x1c]
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov eax, dword [edi + 0x28]
push dword [eax + 0x20]
push dword [edi + 0x38]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100229b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a5c5
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
push edi
mov eax, dword [0x100f1340]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 4]
mov dword [edi], 0
mov dword [edi + 0xc], 1
push dword [esi]
push esi
call fcn.10010270
mov eax, dword [esi]
push 0x40
push 0
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 4], eax
lea eax, [ebp - 0x4c]
push eax
mov dword [esi + 4], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
lea ecx, [ebp - 0x4c]
call fcn.10017420
push eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.10022740
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.10017e70
lea ecx, [ebp - 0x4c]
call fcn.10017ee0
push 0x40
lea eax, [ebp - 0x4c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x4c]
call fcn.10017420
push eax
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.10022740
lea ecx, [ebp - 0x2c]
call fcn.10017e70
lea ecx, [ebp - 0x4c]
call fcn.10017ee0
lea ecx, [edi + 0x10]
call fcn.1001ef60
lea ecx, [edi + 0x30]
call fcn.1001edd0
mov edx, dword [edi + 0x54]
mov eax, dword [edx]
cmp eax, edx
je 0x10022aa6
nop
mov ecx, dword [eax + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [eax]
cmp eax, edx
jne 0x10022a90
lea ecx, [edi + 0x50]
call fcn.1001f0f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret