joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c392
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00401200
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x40c3ad
mov byte [ebx], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40c3b7
mov byte [eax], 0
test edi, edi
je 0x40c460
movzx eax, word [edi]
test ax, ax
je 0x40c460
push esi
xor esi, esi
xor ecx, ecx
movzx eax, ax
inc edi
inc edi
cmp ax, 0x3d
jne 0x40c3f0
cmp dword [ebp + 0xc], 0
je 0x40c3fc
test esi, esi
jne 0x40c3fc
test ebx, ebx
je 0x40c3ec
mov byte [ebx], 1
mov esi, edx
jmp 0x40c40b
cmp ax, 0xd
je 0x40c41e
cmp ax, 0xa
je 0x40c420
mov word [edx], ax
mov eax, dword [ebp + 0x14]
inc edx
add eax, 0xfffffffe
inc edx
cmp ecx, eax
jg 0x40c416
movzx eax, word [edi]
inc ecx
test ax, ax
jne 0x40c3d0
jmp 0x40c420
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
jmp 0x40c420
inc edi
inc edi
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov word [edx], ax
test ebx, ebx
je 0x40c45b
mov word [ebx], ax
test esi, esi
je 0x40c45b
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0x14]
lea eax, [ebp - 0x2000]
push eax
push ebx
call fcn.0040ebed
xor eax, eax
mov word [esi], ax
mov eax, edi
pop esi
jmp 0x40c462
xor eax, eax
pop edi
pop ebx
leave
ret 0x10

Function at 0x40c4a7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push 0x400
lea eax, [ebp - 0x820]
push eax
call fcn.00412ae4
cmp byte [0x422b15], 0
jne 0x40c535
push 6
push dword [0x41509c]
lea eax, [ebp - 0x820]
push eax
call fcn.00407bcb
push eax
call fcn.0040f625
test eax, eax
jne 0x40c535
push 0x4137ec
call fcn.00412ad1
lea eax, [ebp - 0x820]
push eax
call fcn.0040b11d
xor ecx, ecx
push 0x1e
mov word [ebp + eax*2 - 0x81e], cx
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.0040ad9c
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x820]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
leave
ret

Function at 0x40c600
Capabilities:
Delete file

Disassembly:
push ebx
xor ebx, ebx
mov byte [0x4219f1], 1
cmp dword [0x421a00], ebx
je 0x40c628
push 0x7d
call fcn.0040a407
push eax
push 2
push dword [0x421a00]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x421a00]
mov dword [0x4219f4], ebx
mov byte [0x4219f0], 1
cmp eax, ebx
je 0x40c689
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x422b24], ebx
jne 0x40c657
cmp byte [0x422b14], bl
je 0x40c65f
cmp dword [0x4219f8], ebx
jne 0x40c681
push ebx
push 1
push 0x111
push dword [0x421a00]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40c681
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0040b5d8
cmp dword [0x421a00], ebx
jne 0x40c675
cmp byte [0x421a08], bl
pop ebx
je 0x40c697
jmp fcn.0040c4a7
ret
Function at 0x40c6d3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
push ebx
xor ebx, ebx
cmp byte [0x421a10], bl
je 0x40c753
cmp word [0x41b0d8], bx
je 0x40c753
push esi
push 0x41b0d8
lea esi, [ebp - 0x808]
call fcn.0040c698
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop esi
test eax, eax
jne 0x40c753
push dword [ebp + 8]
call fcn.0040b11d
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x808]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x40c758
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00401200
cmp byte [0x421a10], 0
je 0x40c7ff
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x100c]
call fcn.0040c698
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x40c7ff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x100c]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c7f6
shr dword [ebp - 4], 1
mov eax, 0x3ff
cmp dword [ebp - 4], eax
jae 0x40c7da
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x80c], cx
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 8]
call fcn.0040ebed
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8

Function at 0x40c927
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp byte [0x4218e6], 0
mov eax, dword [ebp + 0xc]
mov dword [0x4218e8], eax
mov eax, dword [ebp + 0x10]
mov dword [0x4218ec], eax
mov eax, dword [ebp + 0x14]
mov dword [0x4218e0], eax
je 0x40c957
xor eax, eax
inc eax
jmp 0x40c980
cmp byte [0x4218e7], 0
je 0x40c965
push 2
pop eax
jmp 0x40c980
push dword [ebp + 8]
push 0x40bbb1
push dword [0x421a00]
push str.REPLACEFILEDLG
push dword [0x415e74]
call esi
dec eax
je 0x40c9d2
dec eax
je 0x40c9e4
dec eax
je 0x40c9cb
dec eax
jne 0x40c9af
push dword [ebp + 8]
push 0x40befd
push dword [0x421a00]
push str.RENAMEDLG
push dword [0x415e74]
call esi
test eax, eax
je 0x40c931
mov al, 0x52
jmp 0x40c9df
dec eax
je 0x40c9c0
dec eax
mov al, 0x4e
jne 0x40c9df
mov byte [0x4218e7], 1
jmp 0x40c9df
mov byte [0x4219f2], 1
mov al, 0x43
jmp 0x40c9df
mov byte [0x4218e6], 1
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 0x59
pop esi
pop ebp
ret 0x10
mov al, 0x4e
jmp 0x40c9df
Function at 0x40e385
Capabilities:
Accept command line arguments
Read file via mapping
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 1
call fcn.0040effc
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, 0x42a4c8
call fcn.0040f722
mov esi, 0x5800
push esi
push ebx
mov edi, 0x41c0e0
push edi
call fcn.0040ad9c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40e433
push eax
call fcn.0040c26d
cmp byte [0x421a11], bl
je 0x40e425
push str.winrarsfxmappingfile.tmp
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40e41a
push esi
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40e411
push esi
push eax
push edi
call fcn.0040adc9
push edi
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e433
push dword [ebp - 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x400
mov esi, 0x41b8e0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push str.sfxname
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push 0x64
push edi
mov dword [0x415e74], edi
mov dword [0x415e78], edi
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x65
push dword [0x415e78]
mov dword [0x41b8dc], eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
lea ecx, [ebp - 0xc]
mov dword [0x41b8d8], eax
call fcn.00412b54
push esi
mov ecx, 0x415e88
call fcn.0040a3f0
lea ecx, [ebp - 0x5c]
call fcn.00406a41
lea ecx, [ebp - 0x34]
call fcn.00406a41
push 0x64
call fcn.0040b8e1
push 0x64
mov dword [ebp - 0x40], eax
call fcn.0040b8e1
push ebx
push 0x40db65
mov dword [ebp - 0x18], eax
push ebx
lea eax, [ebp - 0x5c]
mov dword [0x41b0d4], eax
push str.STARTDLG
lea eax, [ebp - 0x34]
push edi
mov dword [0x41b0d0], eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea ecx, [ebp - 0x34]
mov dword [0x41b0d0], ebx
mov dword [0x41b0d4], ebx
call fcn.00406a63
lea ecx, [ebp - 0x5c]
call fcn.00406a63
lea ecx, [ebp - 0xc]
call fcn.00412bae
cmp byte [0x421a08], bl
je 0x40e512
call fcn.0040c4a7
push 0x100
push ebx
push 0x4218f0
call fcn.0040ad9c
cmp dword [0x422b24], ebx
jbe 0x40e535
push dword [0x422b18]
call fcn.0040ad18
push dword [0x41b8dc]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
mov eax, dword [0x41b8d8]
cmp eax, ebx
je 0x40e54f
push eax
call esi
cmp dword [0x415e7c], ebx
jne 0x40e56e
cmp byte [0x4219f2], bl
je 0x40e56e
push 0xff
mov ecx, 0x415e7c
call fcn.0040341b
mov eax, dword [0x422b30]
mov byte [0x4219f2], 1
cmp eax, ebx
je 0x40e584
push eax
call fcn.0040c468
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [0x422b2c]
cmp eax, ebx
ja 0x40e598
mov eax, dword [0x415e7c]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40e8fd
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x4129f9
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x413b8c
push 1
xor ebx, ebx
push ebx
push 0x413c3c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x412aca
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x413c2c
push eax
call dword [ecx]
test eax, eax
jl 0x412ac1
cmp byte [ebp + 8], bl
je 0x412a4c
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x412a69
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x412a7b
push 0x413734
jmp 0x412a7e
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x412a93
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x412aa4
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x412ab8
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x412ae4
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x12517517
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x79bf6083
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1003220
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x100325f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1003255
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1003261
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1003245
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100096d0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x100b300c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10009751
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [esi]
push 0
push dword [ebp - 0xd0]
mov dword [ebp - 0xcc], eax
push 4
push esi
call edi
xor eax, eax
nop word [eax + eax]
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10009720
lea eax, [ebp - 0xd0]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 0xcc]
push 0
push dword [ebp - 0xd0]
mov dword [esi], eax
push 4
push esi
call edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1007c769
mov esp, ebp
pop ebp
ret 4

Function at 0x10009770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x100b300c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x100097b7
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
xor eax, eax
xor byte [ebp + eax - 0xcc], al
inc eax
cmp eax, 4
jb 0x10009794
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007c769
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1007c769
mov esp, ebp
pop ebp
ret 4

Function at 0x100097d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007da9d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x100b300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
cmp dword [0x100b48c8], 0x10
mov eax, 0x100b48b4
cmovae eax, dword [0x100b48b4]
cmp byte [eax], 0
je 0x100098ea
mov ecx, dword [ebp + 8]
cmp byte [ecx], 0
je 0x100098ea
cmp dword [0x100b450c], 0x10
mov eax, 0x100b44f8
cmovae eax, dword [0x100b44f8]
cmp byte [eax], 0
je 0x100098ea
mov esi, 0x100bacf8
mov edx, ecx
sub esi, ecx
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [esi + edx - 1], al
test al, al
jne 0x10009846
mov edx, 0x100b6ce0
sub edx, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10009860
mov ecx, dword [0x100bb5a4]
mov edx, 0x100b48b4
cmp dword [0x100b48c8], 0x10
push 0x100bacf8
cmovae edx, dword [0x100b48b4]
mov eax, dword [ecx]
push edx
call dword [eax + 8]
test eax, eax
jne 0x100098ea
mov ecx, 0x98
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x100a1b40]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x28], al
and ecx, 0x800000ff
jns 0x100098bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x14
jl 0x100098a0
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov eax, dword [0x100b66ec]
mov esi, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x4c]
mov ecx, dword [0x100b66ec]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [esi]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10009900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007dacd
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100b300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea esi, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
cmovae esi, dword [ebp + 8]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10009940
sub esi, ecx
push esi
call fcn.1007cfc2
add esp, 4
xor edx, edx
mov edi, eax
test esi, esi
js 0x1000996b
nop word [eax + eax]
xor byte [edx + edi], dl
lea ecx, [edx + edi]
inc edx
cmp edx, esi
jle 0x10009960
mov edx, dword [ebp + 0x1c]
cmp edx, 0x10
jb 0x100099a1
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10009997
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10009997
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007cfb4
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x1000aa80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
js 0x1000aab7
nop
lea eax, [ebp - 8]
push eax
push 0x40
push 4
lea eax, [ebx + esi]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, edi
jle 0x1000aaa0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007c769
mov esp, ebp
pop ebp
ret 8

Function at 0x1000ad70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100b300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov ebx, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [edi], ecx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.1007c769
mov esp, ebp
pop ebp
ret 8
Function at 0x1000adc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100ab580
push 0x1007c91d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100b300c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
mov edi, dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0xc]
sub eax, esi
sub eax, 5
mov byte [esi], 0xe8
mov dword [esi + 1], eax
mov eax, 5
mov dword [ebp - 0x28], eax
cmp eax, edi
jae 0x1000ae32
mov byte [esi + eax], 0x90
inc eax
jmp 0x1000ae24
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000ae4c
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1007c769
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100179b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100b300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
mov dword [ebp - 0xc], eax
cmp ebx, 0x1000
jbe 0x10017a07
test eax, eax
je 0x10017a07
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10017a06
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push dword [ebp - 0xc]
push ebx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1007c769
mov esp, ebp
pop ebp
ret

Function at 0x10017a20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100b300c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], edi
cmp eax, 0x1000
jbe 0x10017aec
xor ecx, ecx
mov eax, edi
add eax, 5
push ebx
setb cl
neg ecx
or ecx, eax
push esi
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
lea ecx, [edi + 5]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
lea eax, [ebp - 0xc]
mov ebx, esi
push eax
push 0x40
push ecx
push esi
call edi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov ecx, dword [ebp - 0x10]
add esi, edx
mov eax, edx
add ecx, 0xfffffffb
sub eax, esi
add eax, ecx
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push 0x40
mov byte [esi], 0xe9
mov esi, dword [ebp - 0x10]
push edx
push esi
call edi
mov eax, dword [ebp - 0x18]
sub eax, esi
mov byte [esi], 0xe9
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0x14]
push esi
call edi
push 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop esi
mov eax, ebx
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007c769
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.1007c769
mov esp, ebp
pop ebp
ret

Function at 0x10017c90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp ebx, 0x1000
jbe 0x10017cee
test edi, edi
je 0x10017cee
push esi
push edi
call fcn.1007cfc2
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007c769
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.1007c769
mov esp, ebp
pop ebp
ret 8