joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7cc2a4
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x7cc47e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040b054
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x14], 0xffffffff
xor edx, edx
push ebp
push 0x7cc3ac
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
push 0
push 3
push 0
push 0x7cc498
lea eax, [ebp - 0x234]
movzx edx, word [ebp - 2]
call fcn.0040beec
push dword [ebp - 0x234]
push 0x7cc4b0
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.0040c1b8
mov eax, dword [ebp - 0x230]
call fcn.0040becc
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x7cc360
call fcn.0040a7f4
jmp 0x7cc45e
xor eax, eax
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0xc
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0x2d1080
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x7cc393
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7cc3b3
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7cc485
lea eax, [ebp - 0x23c]
mov edx, 4
call fcn.0040b0b4
pop eax
jmp eax
Function at 0x7fd118
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x7fd27c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 8]
test esi, esi
je 0x7fd15a
or ebx, 0xffff
mov eax, esi
call fcn.0040becc
mov esi, eax
jmp 0x7fd15c
xor esi, esi
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
call sub.kernel32.dll_GetLastError
cmp eax, 0x2f76
jne 0x7fd18c
mov eax, edi
call fcn.0040b054
jmp 0x7fd25f
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
je 0x7fd1dc
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x20]
mov edx, dword [0x8e1574]
call fcn.0043755c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x8ccda8]
mov dl, 1
mov eax, dword [0x800844]
call fcn.00439620
call fcn.0040a700
mov edx, dword [ebp - 0xc]
shr edx, 1
dec edx
mov eax, edi
call fcn.0040c058
mov eax, dword [edi]
test eax, eax
je 0x7fd1f2
mov eax, dword [eax - 4]
test eax, eax
jle 0x7fd25f
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [edi]
call fcn.0040becc
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.winhttp.dll_WinHttpQueryHeaders
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x7fd25f
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x24]
mov edx, dword [0x8e1574]
call fcn.0043755c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x1c]
push eax
push 1
mov ecx, dword [0x8ccda8]
mov dl, 1
mov eax, dword [0x800844]
call fcn.00439620
call fcn.0040a700
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7fd283
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040b0b4
pop eax
jmp eax

Function at 0x7fd48e
Capabilities:
Initialize winhttp library

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x7fd44f
add esp, 0xfffffff0
call fcn.00409790
mov ebx, edx
mov edi, eax
mov eax, edi
call fcn.00807b44
mov dl, 1
mov eax, dword [0x7fb7ec]
call fcn.00800688
mov dword [edi + 0xd8], eax
mov dl, 1
mov eax, dword [0x7f0668]
call fcn.007f8d14
mov dword [edi + 0xd4], eax
mov eax, dword [0x7fa8b4]
call fcn.00800240
push 0
push 0
push 0
push 1
push 0x7fd4f0
call sub.winhttp.dll_WinHttpOpen
mov esi, eax
mov dword [edi + 0xd0], esi
test esi, esi
jne 0x7fd4bd
mov ecx, dword [0x8ccfe0]
mov dl, 1
mov eax, dword [0x8008fc]
call fcn.004395e4
call fcn.0040a700
push 0
push 0x10010
push 0x7fd29c
mov eax, dword [edi + 0xd0]
push eax
call sub.winhttp.dll_WinHttpSetStatusCallback
mov eax, edi
test bl, bl
je 0x7fd4ea
call fcn.004097e8
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x7fea58
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7fec34
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0xc9], 0
mov byte [ebx + 0xc8], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jle 0x7feaa2
mov esi, dword [ebp - 4]
movzx esi, word [esi + 0x10]
jmp 0x7feaa4
xor esi, esi
push 0
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0040becc
push eax
mov eax, dword [ebx + 0x58]
mov eax, dword [eax + 0xd0]
push eax
call sub.winhttp.dll_WinHttpConnect
mov edi, eax
mov dword [ebx + 0xb0], edi
test edi, edi
jne 0x7feaf8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x8cc954]
mov dl, 1
mov eax, dword [0x8009c4]
call fcn.00439620
call fcn.0040a700
xor esi, esi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 0x7fec50
call fcn.0040c2c8
jne 0x7feb11
or esi, 0x800000
push esi
push 0
push 0
push 0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.007fd0d8
mov eax, dword [ebp - 0x10]
call fcn.0040becc
push eax
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.007f5cec
mov eax, dword [ebp - 0x14]
call fcn.0040becc
push eax
mov eax, dword [ebx + 0xb0]
push eax
call sub.winhttp.dll_WinHttpOpenRequest
mov edi, eax
mov dword [ebx + 0xb4], edi
test edi, edi
jne 0x7feb9d
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x28]
mov edx, dword [0x8e1574]
call fcn.0043755c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x24]
push eax
push 1
mov ecx, dword [0x8ccf40]
mov dl, 1
mov eax, dword [0x8009c4]
call fcn.00439620
call fcn.0040a700
mov eax, dword [ebx + 0x14]
push eax
mov eax, ebx
call fcn.007f5e48
push eax
mov esi, dword [ebx + 0xc]
push esi
push esi
mov eax, dword [ebx + 0xb4]
push eax
call sub.winhttp.dll_WinHttpSetTimeouts
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x7fec0a
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x2c]
mov edx, dword [0x8e1574]
call fcn.0043755c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea eax, [ebp - 0x24]
push eax
push 1
mov ecx, dword [0x8cd128]
mov dl, 1
mov eax, dword [0x8009c4]
call fcn.00439620
call fcn.0040a700
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7fec3b
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0040b0b4
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0040b0b4
pop eax
jmp eax
Function at 0x81c758
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040b148
xor eax, eax
push ebp
push 0x81c916
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 0x60]
mov eax, esi
call fcn.0081c6d4
push dword [ebp - 0x60]
push 0x81c934
push edi
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040c1b8
cmp dword [ebp - 4], 0
jne 0x81c7c6
lea edx, [ebp - 0x64]
mov eax, esi
call fcn.00432118
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 4]
call fcn.0043aeb8
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004083a8
mov dword [ebp - 0x4c], 0x44
movzx eax, word [ebp + 0xc]
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x20], 1
cmp dword [ebp - 4], 0
je 0x81c7fd
mov eax, dword [ebp - 4]
call fcn.0040becc
mov esi, eax
jmp 0x81c7ff
xor esi, esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push esi
push 0
push 4
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040becc
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x81c837
xor ebx, ebx
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp + 8]
mov dword [edx], eax
jmp 0x81c8ec
mov edi, dword [0x8ccfcc]
lea esi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x54]
push eax
call fcn.006121b8
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x81c866
mov eax, dword [ebp - 0x5c]
push eax
call fcn.006121a4
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x81c8ad
push 0x10
push 0
mov eax, dword [0x8cd4e0]
mov eax, dword [eax]
mov eax, dword [eax + 0x68]
mov edx, 0x81c944
call fcn.00768774
push eax
mov eax, dword [0x8cd3e4]
mov eax, dword [eax]
call fcn.0040becc
mov ecx, eax
xor eax, eax
pop edx
call fcn.007096ec
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle
xor ebx, ebx
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_ResumeThread
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
cmp byte [ebp + 0x14], 0
je 0x81c8e3
call fcn.0081c6a0
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x5c]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x81c8c5
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x81c91d
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.0040b0b4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b0b4
pop eax
jmp eax
Function at 0x81c98c
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov ebp, edx
mov esi, eax
test esi, esi
je 0x81c9ca
mov ebx, edi
test ebx, ebx
je 0x81c9a3
mov ebx, dword [ebx - 4]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, edi
call fcn.0040becc
push eax
push 1
push 0
mov eax, ebp
call fcn.0040becc
push eax
push esi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
jmp 0x81c9cc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x81fb78
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 1], 0
xor edx, edx
mov dword [ebp - 8], edx
xor edx, edx
mov dword [ebp - 0xc], edx
mov edx, 0x20
call fcn.004314ec
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x81fc51
xor eax, eax
push ebp
push 0x81fc4a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
setne al
neg al
sbb eax, eax
call fcn.0043bd7c
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne al
neg al
sbb eax, eax
call fcn.0043bd7c
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
add eax, 4
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp word [eax], 0x14c
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x81fc51
cmp dword [ebp - 8], 0
je 0x81fc2f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
cmp dword [ebp - 0xc], 0
je 0x81fc3e
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x820c54
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x820d26
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x821eb4]
call fcn.0082af7c
mov edi, eax
xor ebx, ebx
mov esi, ebx
add si, 0x61
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.0040beec
lea eax, [ebp - 0xc]
mov edx, 0x820d40
call fcn.0040c0d8
mov eax, dword [ebp - 0xc]
call fcn.0040becc
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 1
jne 0x820cc2
mov word [ebp - 6], si
lea edx, [ebp - 6]
lea eax, [edi + 4]
call fcn.00455960
inc ebx
cmp ebx, 0x1a
jne 0x820c83
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x820cdc
mov eax, dword [ebp - 4]
mov edx, 0x820d54
call fcn.0040b444
mov eax, ebx
call fcn.00407ad4
mov ebx, eax
mov eax, dword [edi + 8]
cmp eax, ebx
ja 0x820cf8
mov edx, eax
dec edx
mov ecx, edi
mov eax, ebx
call fcn.00454f90
mov eax, dword [ebp - 4]
mov edx, dword [edi + 4]
movzx edx, word [edx + ebx*2]
call fcn.0040beec
mov eax, edi
call fcn.00409258
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x820d2d
lea eax, [ebp - 0xc]
call fcn.0040b054
pop eax
jmp eax
Function at 0x821508
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x821510
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x821797
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.008ec0c4
jle 0x82156b
mov ah, 0x49
dec ecx
sbb edi, dword [ebx - 0x73]
cmpsb byte [esi], byte es:[edi]
jns 0x821596
add ch, byte [eax - 0x2b5359ba]
xchg edx, eax
cmp ecx, edi
jb 0x821584
push ecx
mov cl, 0xca
sub eax, 0xad351167
fld xword [edx + ebx + 0x5a8af1ea]
mov al, 0x4f
aad 0x48
xor edi, dword [eax]
xlatb
pop esi
lodsd eax, dword [esi]
pop es
mov bx, 0x7f01
daa
rcl byte [0xa7bbdb69], cl
and bl, dl
xchg edx, eax
and ch, byte [ecx]
pushal
pop esp
test dl, dl
or byte [esi + eax*8 + 0x37], ch
pop ds
pop ebp
xchg ecx, eax
xor eax, 0x48f246ae
add byte [edi], 0xb3
xor dword [ebx + ebx*8], esi
xor al, 0xdb
scasd eax, dword es:[edi]
mov word [ebp - 0x5fbc1409], ds
cmp ecx, 0xd1bdcf90
adc esp, esp
ja 0x821579
loop 0x821533
wait
sahf
cdq
and byte [ecx - 0x151b5649], 0x3b
inc eax
invalid

Function at 0x822e3c
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040b148
xor eax, eax
push ebp
push 0x822f0e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004083a8
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.004083a8
mov dword [ebp - 0x48], 0x44
push 0
push 2
call fcn.00612178
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
call sub.kernel32.dll_GetCommandLineW
push eax
mov eax, dword [ebp - 4]
call fcn.0040becc
push eax
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x822ec6
call fcn.0043bcbc
jmp 0x822ef6
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.0081c6a0
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x822ecf
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x822f15
lea eax, [ebp - 4]
call fcn.0040b054
pop eax
jmp eax

Function at 0x82b160
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
test esi, esi
jne 0x82b16d
xor eax, eax
pop esi
pop ebx
ret
movzx ecx, byte [esi]
mov eax, esi
test eax, eax
je 0x82b179
mov eax, dword [eax - 4]
sub eax, 2
jl 0x82b18f
inc eax
mov edx, 2
movzx ebx, byte [esi + edx - 1]
xor cl, bl
inc edx
dec eax
jne 0x82b184
mov eax, ecx
pop esi
pop ebx
ret
Function at 0x410880
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x4108a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4108a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x410898
mov eax, 1
add ebx, ebx
jne 0x4108bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4108b0
jne 0x4108cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4108b0
xor ecx, ecx
sub eax, 3
jb 0x4108e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x410952
mov ebp, eax
add ebx, ebx
jne 0x4108eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4108f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41091c
inc ecx
add ebx, ebx
jne 0x410908
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4108fd
jne 0x410919
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4108fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41093c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41092d
jmp 0x41089e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41093c
add edi, ecx
jmp 0x41089e
pop esi
mov edi, esi
mov ecx, 0x53
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41095a
cmp byte [edi], 1
jne 0x41095a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41095f
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x4109d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10060]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10124]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41098c
mov ecx, edi
jns 0x4109bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1012c]
or eax, eax
je 0x4109d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4109a9
call dword [esi + 0x10128]
mov ebp, dword [esi + 0x10130]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x410a0b
sub esp, 0xffffff80
jmp 0x402674
Function at 0x10001790
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
mov dword [esi], 0
test edx, edx
jne 0x100017ae
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [edx + 0x3c]
mov ecx, 0x5a4d
push ebx
cmp word [edx], cx
jne 0x100017df
test eax, eax
jle 0x100017df
cmp eax, 0x10000000
jae 0x100017df
cmp dword [eax + edx], 0x4550
jne 0x100017df
lea ebx, [edx + 4]
add ebx, eax
add eax, 0x18
mov dword [ebp - 4], ebx
add eax, edx
jmp 0x100017e7
mov ebx, edx
mov dword [ebp - 4], edx
lea eax, [edx + 0x14]
movzx ecx, word [eax]
sub ecx, 0x107
je 0x10001854
sub ecx, 4
je 0x10001842
sub ecx, 0x100
jne 0x10001905
movzx ecx, word [ebp + 0x10]
cmp ecx, dword [eax + 0x6c]
jae 0x10001905
add ecx, 0xe
cmp dword [eax + ecx*8], 0
lea ecx, [eax + ecx*8]
je 0x10001905
cmp dword [ecx + 4], 0
je 0x10001905
push eax
push ebx
push ecx
push dword [eax + 0x3c]
push esi
push dword [ebp + 0xc]
push edx
call fcn.10001910
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
movzx ecx, word [ebp + 0x10]
cmp ecx, dword [eax + 0x5c]
jae 0x10001905
add ecx, 0xc
jmp 0x10001813
cmp word [ebx + 2], 0
jbe 0x10001905
movzx ecx, word [ebx + 0x10]
test cx, cx
je 0x10001905
mov bx, word [ebp + 0x10]
lea esi, [eax + ecx]
mov edx, dword [ebp - 4]
push edi
xor edi, edi
nop dword [eax]
cmp bx, 3
jne 0x100018b3
push str..pdata
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x100018cc
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp di, word [eax + 2]
pop edi
jae 0x10001905
mov eax, dword [esi + 0x14]
pop ebx
add eax, edx
pop esi
mov esp, ebp
pop ebp
ret 0x10
cmp bx, 6
jne 0x100018cf
push 0x1001f118
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x100018db
mov edx, dword [ebp - 4]
inc edi
add esi, 0x28
cmp di, word [edx + 2]
jb 0x10001880
jmp 0x10001899
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
mov dword [ebx], 0
mov eax, dword [esi + 0x14]
add eax, 0xc
add eax, edx
cmp dword [eax], 0
je 0x1000189c
xor ecx, ecx
add ecx, 0x1c
lea eax, [eax + 0x1c]
mov dword [ebx], ecx
cmp dword [eax], 0
jne 0x100018f6
jmp 0x1000189c
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001ce60
Capabilities:
Allocate or change rwx memory
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
mov dword [ebp - 0xc], 0
xorps xmm0, xmm0
mov dword [ebp - 0x20], ebx
push str.ntdll.dll
movq qword [ebp - 0x14], xmm0
call fcn.10001430
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push eax
push ebx
call sub.KERNEL32.dll_K32GetModuleInformation
mov ebx, dword [ebp - 0x14]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push str.c:windows_syswow64_ntdll.dll
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
push 0
push 0x1000002
push 0
push eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
push 0
push 0
push 4
push eax
mov dword [ebp - 0x28], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, dword [ebx + 0x3c]
xor esi, esi
add edi, ebx
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp ax, word [edi + 6]
jae 0x1001cf9d
movzx eax, si
lea ecx, [eax + eax*4]
movzx eax, word [edi + 0x14]
add eax, edi
lea ebx, [eax + ecx*8]
mov eax, str..text
lea ecx, [ebx + 0x18]
nop word [eax + eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1001cf40
test dl, dl
je 0x1001cf3c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1001cf40
add ecx, 2
add eax, 2
test dl, dl
jne 0x1001cf20
xor eax, eax
jmp 0x1001cf45
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1001cf92
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x24]
add eax, dword [ebp - 0x18]
push 0x40
push dword [ebx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebx + 0x20]
mov eax, dword [ebp - 0x1c]
add eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebx + 0x24]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov eax, dword [ebx + 0x24]
push dword [ebx + 0x20]
add eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp si, word [edi + 6]
jb 0x1001cf03
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d1f0
mov esp, ebp
pop ebp
ret