joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4140a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x248
mov eax, dword [0x427008]
xor eax, esp
mov dword [esp + 0x244], eax
mov eax, dword [ebp + 0x14]
mov ecx, edx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0xc0
mov dword [esp + 0x6c], 0x1000000
push dword [ebp + 8]
mov edx, ecx
lea ecx, [esp + 0x74]
call fcn.00413e20
push 0x40
mov edx, edi
lea ecx, [esp + 0x74]
call fcn.00413c50
push 4
lea edx, [esp + 0x70]
lea ecx, [esp + 0x74]
call fcn.00413c50
lea edx, [esp + 0x1c0]
lea ecx, [esp + 0x70]
call fcn.00413fa0
movaps xmm0, xmmword [esp + 0x1c0]
mov edi, 0x3e7
mov esi, dword [esp + 0x18]
movaps xmmword [esp + 0x20], xmm0
movaps xmm0, xmmword [esp + 0x1d0]
movaps xmmword [esp + 0x30], xmm0
movaps xmm0, xmmword [esp + 0x1e0]
movaps xmmword [esp + 0x40], xmm0
movaps xmm0, xmmword [esp + 0x1f0]
movaps xmmword [esp + 0x50], xmm0
push dword [ebp + 8]
mov edx, esi
lea ecx, [esp + 0x74]
call fcn.00413e20
push 0x40
lea edx, [esp + 0x1c4]
lea ecx, [esp + 0x74]
call fcn.00413c50
lea edx, [esp + 0x1c0]
lea ecx, [esp + 0x70]
call fcn.00413fa0
movaps xmm0, xmmword [esp + 0x1c0]
pxor xmm0, xmmword [esp + 0x20]
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x200], xmm0
movaps xmm0, xmmword [esp + 0x30]
pxor xmm0, xmmword [esp + 0x1d0]
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x210], xmm0
movaps xmm0, xmmword [esp + 0x40]
pxor xmm0, xmmword [esp + 0x1e0]
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x220], xmm0
movaps xmm0, xmmword [esp + 0x50]
pxor xmm0, xmmword [esp + 0x1f0]
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x230], xmm0
sub edi, 1
jne 0x414157
mov eax, dword [esp + 0x6c]
mov edi, 0x40
mov esi, dword [esp + 0x14]
bswap eax
inc eax
cmp esi, edi
bswap eax
cmovb edi, esi
mov dword [esp + 0x6c], eax
push edi
lea eax, [esp + 0x204]
push eax
push dword [esp + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add dword [esp + 0x1c], edi
add esp, 0xc
mov ecx, dword [esp + 0x18]
sub esi, edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], esi
jne 0x4140e0
xor eax, eax
lea edi, [esp + 0x70]
mov ecx, 0x54
rep stosd dword es:[edi], eax
lea edi, [esp + 0x200]
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea edi, [esp + 0x1c0]
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
xor ecx, esp
call fcn.0041c61b
mov esp, ebp
pop ebp
ret 0x14
Function at 0x417190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x427008]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x1c]
xorps xmm0, xmm0
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
shrd edx, ecx, 9
push ebx
lea ebx, [eax + 0x4670]
shr ecx, 9
push esi
mov esi, dword [ebp + 0xc]
add eax, 0x19e0
push edi
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
push ebx
add edx, 1
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x38], edx
adc ecx, 0
push eax
mov dword [esp + 0x40], ecx
call fcn.004028f0
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], 0x20
nop dword [eax]
mov edx, dword [ebp + 8]
push dword [esp + 0x18]
push esi
xor eax, dword [edx]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 4]
xor eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov eax, dword [edx + 0xc]
xor edi, dword [edx + 8]
xor eax, ebx
mov dword [esi + 8], edi
push esi
mov dword [esi + 0xc], eax
call fcn.004028f0
mov edx, dword [esp + 0x20]
xor dword [esi], edx
mov edi, dword [esp + 0x24]
xor dword [esi + 4], edi
mov eax, dword [esp + 0x28]
xor dword [esi + 8], eax
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
xor dword [esi + 0xc], ebx
add esi, 0x10
add dword [ebp + 8], 0x10
shld ebx, eax, 1
mov dword [esp + 0x10], edi
add eax, eax
shr edi, 0x1f
or edi, eax
shr ecx, 0x1f
mov eax, dword [esp + 0x10]
shld eax, edx, 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], eax
add edx, edx
mov dword [esp + 0x24], eax
imul eax, ecx, 0x87
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], edi
xor eax, edx
sub dword [esp + 0x14], 1
mov dword [esp + 0x20], eax
jne 0x417210
sub dword [ebp + 0x10], 0x200
je 0x4172c5
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x1c]
jmp 0x4171d6
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c61b
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4172e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x427008]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x1c]
xorps xmm0, xmm0
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
shrd edx, ecx, 9
push ebx
lea ebx, [eax + 0x4670]
shr ecx, 9
push esi
mov esi, dword [ebp + 0xc]
add eax, 0x19e0
push edi
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
push ebx
add edx, 1
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x38], edx
adc ecx, 0
push eax
mov dword [esp + 0x40], ecx
call fcn.004028f0
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], 0x20
nop dword [eax]
mov edx, dword [ebp + 8]
push dword [esp + 0x18]
push esi
xor eax, dword [edx]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 4]
xor eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov eax, dword [edx + 0xc]
xor edi, dword [edx + 8]
xor eax, ebx
mov dword [esi + 8], edi
push esi
mov dword [esi + 0xc], eax
call fcn.00403011
mov edx, dword [esp + 0x20]
xor dword [esi], edx
mov edi, dword [esp + 0x24]
xor dword [esi + 4], edi
mov eax, dword [esp + 0x28]
xor dword [esi + 8], eax
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
xor dword [esi + 0xc], ebx
add esi, 0x10
add dword [ebp + 8], 0x10
shld ebx, eax, 1
mov dword [esp + 0x10], edi
add eax, eax
shr edi, 0x1f
or edi, eax
shr ecx, 0x1f
mov eax, dword [esp + 0x10]
shld eax, edx, 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], eax
add edx, edx
mov dword [esp + 0x24], eax
imul eax, ecx, 0x87
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], edi
xor eax, edx
sub dword [esp + 0x14], 1
mov dword [esp + 0x20], eax
jne 0x417360
sub dword [ebp + 0x10], 0x200
je 0x417415
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x1c]
jmp 0x417326
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c61b
mov esp, ebp
pop ebp
ret 0x18
Function at 0x417430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x427008]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x1c]
xorps xmm0, xmm0
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
shrd edx, ecx, 9
push ebx
lea ebx, [eax + 0x5710]
shr ecx, 9
push esi
mov esi, dword [ebp + 0xc]
add eax, 0x2a80
push edi
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
push ebx
add edx, 1
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x38], edx
adc ecx, 0
push eax
mov dword [esp + 0x40], ecx
call fcn.00410b70
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], 0x20
nop dword [eax]
mov edx, dword [ebp + 8]
push dword [esp + 0x18]
push esi
xor eax, dword [edx]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 4]
xor eax, ecx
mov ecx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], eax
mov eax, dword [edx + 0xc]
xor edi, dword [edx + 8]
xor eax, ebx
mov dword [esi + 8], edi
push esi
mov dword [esi + 0xc], eax
call fcn.00410b70
mov edx, dword [esp + 0x20]
xor dword [esi], edx
mov edi, dword [esp + 0x24]
xor dword [esi + 4], edi
mov eax, dword [esp + 0x28]
xor dword [esi + 8], eax
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
xor dword [esi + 0xc], ebx
add esi, 0x10
add dword [ebp + 8], 0x10
shld ebx, eax, 1
mov dword [esp + 0x10], edi
add eax, eax
shr edi, 0x1f
or edi, eax
shr ecx, 0x1f
mov eax, dword [esp + 0x10]
shld eax, edx, 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], eax
add edx, edx
mov dword [esp + 0x24], eax
imul eax, ecx, 0x87
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], edi
xor eax, edx
sub dword [esp + 0x14], 1
mov dword [esp + 0x20], eax
jne 0x4174b0
sub dword [ebp + 0x10], 0x200
je 0x417565
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x1c]
jmp 0x417476
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c61b
mov esp, ebp
pop ebp
ret 0x18
Function at 0x417580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x427008]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 0x1c]
xorps xmm0, xmm0
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
shrd edx, ecx, 9
push ebx
lea ebx, [eax + 0x5710]
shr ecx, 9
push esi
mov esi, dword [ebp + 0xc]
add eax, 0x2a80
push edi
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
push ebx
add edx, 1
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
mov dword [esp + 0x38], edx
adc ecx, 0
push eax
mov dword [esp + 0x40], ecx
call fcn.00410b70
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], 0x20
nop dword [eax]
mov edx, dword [ebp + 8]
push dword [esp + 0x18]
xor eax, dword [edx]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 4]
xor eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esi], ecx
mov ecx, esi
mov dword [esi + 4], eax
mov eax, dword [edx + 0xc]
xor edi, dword [edx + 8]
xor eax, ebx
mov dword [esi + 8], edi
mov edx, esi
mov dword [esi + 0xc], eax
call fcn.00411a60
mov edx, dword [esp + 0x20]
xor dword [esi], edx
mov edi, dword [esp + 0x24]
xor dword [esi + 4], edi
mov eax, dword [esp + 0x28]
xor dword [esi + 8], eax
mov ebx, dword [esp + 0x2c]
mov ecx, ebx
xor dword [esi + 0xc], ebx
add esi, 0x10
add dword [ebp + 8], 0x10
shld ebx, eax, 1
mov dword [esp + 0x10], edi
add eax, eax
shr edi, 0x1f
or edi, eax
shr ecx, 0x1f
mov eax, dword [esp + 0x10]
shld eax, edx, 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], eax
add edx, edx
mov dword [esp + 0x24], eax
imul eax, ecx, 0x87
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x28], edi
xor eax, edx
sub dword [esp + 0x14], 1
mov dword [esp + 0x20], eax
jne 0x417600
sub dword [ebp + 0x10], 0x200
je 0x4176b7
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x1c]
jmp 0x4175c6
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041c61b
mov esp, ebp
pop ebp
ret 0x18
Function at 0x418450
Capabilities:
Encrypt data using aes via x86 extensions
Reference processor manufacturer constants

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x10]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov ecx, dword [ebp - 8]
test ecx, 0x2000000
je 0x41849f
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
test ecx, ecx
jns 0x418517
mov eax, 0x40000000
lea edi, [ebp - 0x10]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp dword [ebp - 0xc], 0x7263694d
jne 0x418517
cmp dword [ebp - 8], 0x666f736f
jne 0x418517
cmp dword [ebp - 4], 0x76482074
jne 0x418517
movaps xmm0, xmmword [0x424a70]
aesenc xmm0, xmmword [0x424a80]
movd eax, xmm0
movaps xmmword [ebp - 0x10], xmm0
cmp eax, 0x4b7b7b54
jne 0x418517
cmp dword [ebp - 0xc], 0x5f77774d
jne 0x418517
cmp dword [ebp - 8], 0x427c7c58
jne 0x418517
cmp dword [ebp - 4], 0x63636367
je 0x418491
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x418700
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x427008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
cmp eax, 0xffffffff
je 0x41873e
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 0xc]
or eax, dword [ebp - 8]
jne 0x41873e
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c61b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.0041c61b
mov esp, ebp
pop ebp
ret
Function at 0x41b780
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x427008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebx + 4]
mov dword [edx + 0x20], eax
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebx + 4]
push 0x20
push dword [eax + 0x20]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41b8e0
lea eax, [ebp - 0x14]
push eax
push str.SeLockMemoryPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x41b8e0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x41b8e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41b8e0
push dword [ebp - 0x40]
call dword [sym.imp.ntdll.dll_NtClose]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebx + 4]
xor edx, edx
mov eax, dword [ecx + 8]
div dword [ebp - 0x38]
mov dword [ecx + 0x24], eax
test eax, eax
jne 0x41b844
mov eax, 7
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c61b
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [ebx + 4]
mov eax, dword [edi + 0xc]
cdq
mov esi, eax
mov ecx, edx
mov eax, dword [edi + 8]
add esi, dword [edi]
cdq
adc ecx, dword [edi + 4]
push edx
push eax
push ecx
push esi
call fcn.0041d3f0
mov dword [edi + 0x14], eax
mov ecx, dword [ebx + 4]
mov esi, dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
push 4
push 0x3000
mov eax, dword [ecx + 0x24]
imul eax, dword [ecx + 0x14]
shl eax, 2
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ecx + 0x28]
push eax
push 0xffffffffffffffff
call esi
mov ecx, dword [ebx + 4]
push 4
push 0x3000
mov eax, dword [ecx + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ecx + 0x1c]
push eax
push 0xffffffffffffffff
call esi
mov ecx, dword [ebx + 4]
push 4
push 0x402000
mov eax, dword [ecx + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ecx + 0x18]
push eax
push 0xffffffffffffffff
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c61b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 6
xor ecx, ebp
pop ebx
call fcn.0041c61b
mov esp, ebp
pop ebp
ret
Function at 0x10011810
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push 0x401000
call fcn.100119f0
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
call fcn.100166c0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x10011871
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x53ec8b55
jne 0x10011883
mov eax, 0x3e9
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x401000
call fcn.10016630
cmp eax, 0x16197be9
jne 0x1001189e
mov eax, 0x3ea
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8245bc
call fcn.10016630
cmp eax, 0x94bf
jne 0x100118b9
mov eax, 0x3f3
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x8252fc
call fcn.10016630
cmp eax, 0x94bf
jne 0x100118d4
mov eax, 0x44d
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x82533c
call fcn.10016630
cmp eax, 0x94bf
jne 0x100118ef
mov eax, 0x457
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858d51
call fcn.10016630
cmp eax, 0x3539f633
jne 0x1001190a
mov eax, 0xc80
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, 0x858c61
call fcn.10016630
xor ecx, ecx
mov edx, 0xc8a
cmp eax, 0x3539f633
pop esi
cmove ecx, edx
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x10015c70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor ecx, ecx
mov dword [ebp - 0x10], 0
cmp byte [ebp + 0x14], cl
cmovne ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x10015c8f
mov byte [ebp - 4], cl
jmp 0x10015cac
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10103390
add esp, 0xc
cmp byte [ebp - 4], 0
je 0x10015cda
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x14]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x14], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x10015ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor ecx, ecx
cmp byte [ebp + 0x14], cl
push ebx
cmovne ecx, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 0x10], esi
test ecx, ecx
jne 0x10015cfe
xor bl, bl
jmp 0x10015d1d
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [ebp - 0x10]
test eax, eax
setne bl
push dword [ebp + 0x10]
mov byte [ebp - 4], bl
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.10103390
add esp, 0xc
test bl, bl
je 0x10015d4a
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x14]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x14], eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015d50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub eax, 1
je 0x10015d84
sub eax, 1
je 0x10015ddd
sub eax, 2
je 0x10015e3d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov bl, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
sub bl, al
mov bh, byte [ebp + 0x14]
dec bl
mov dword [ebp - 4], eax
movzx ecx, bh
mov dword [ebp - 0x18], 0
test bh, bh
jne 0x10015da9
mov byte [ebp - 0xc], bh
mov byte [eax], bl
jmp 0x10015de0
lea edx, [ebp - 0x10]
mov dword [ebp - 0x14], ecx
push edx
push 0x40
push ecx
push eax
mov dword [ebp - 0x18], eax
call edi
mov ecx, dword [ebp - 4]
test eax, eax
setne byte [ebp - 0xc]
mov byte [ecx], bl
test eax, eax
je 0x10015de0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call edi
jmp 0x10015de0
mov bh, byte [ebp + 0x14]
mov eax, dword [ebp - 8]
sub eax, esi
mov dword [ebp - 0x18], 0
mov esi, dword [ebp + 8]
sub eax, esi
movzx eax, ax
mov dword [ebp - 8], eax
movzx ecx, ax
movzx eax, bh
add eax, eax
jne 0x10015e0a
mov byte [ebp - 0xc], 0
mov word [esi], cx
jmp 0x10015e3d
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call edi
mov ecx, dword [ebp - 8]
test eax, eax
setne byte [ebp - 0xc]
mov word [esi], cx
test eax, eax
je 0x10015e3d
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
add eax, esi
mov ebx, dword [ebp + 0xc]
sub ebx, eax
mov dword [ebp - 0x18], 0
movzx eax, byte [ebp + 0x14]
shl eax, 2
test eax, eax
jne 0x10015e68
mov byte [ebp - 0xc], al
mov dword [esi], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x18], esi
call edi
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], ebx
test eax, eax
je 0x10015e97
mov eax, dword [ebp - 0x10]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x18]
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015ea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
push ebx
movzx ebx, cl
push esi
mov esi, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test cl, cl
jne 0x10015ec7
xor cl, cl
jmp 0x10015ee2
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push ecx
push 0x40
push ebx
push eax
mov dword [ebp - 0x18], eax
call edi
mov edx, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp + 0xc]
setne cl
mov byte [ebp - 0xc], cl
mov ch, byte [esi]
mov byte [ebp - 1], ch
test cl, cl
je 0x10015f05
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push edx
call edi
mov eax, dword [ebp + 0xc]
mov ch, byte [ebp - 1]
movzx ecx, ch
sub ecx, 0xe8
je 0x10015fa1
sub ecx, 1
je 0x10015fa1
sub ecx, 0x16
jne 0x10015f91
push dword [ebp + 0x10]
inc eax
push ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.10016740
add esp, 8
cmp al, 0x15
je 0x10015f3b
cmp al, 0x25
jne 0x10015f91
mov esi, dword [ebp + 0xc]
xor ecx, ecx
shl ebx, 2
add esi, 2
mov dword [ebp - 0x18], ecx
test ebx, ebx
jne 0x10015f51
xor al, al
jmp 0x10015f69
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x18], esi
call edi
mov ecx, dword [ebp - 0x18]
test eax, eax
setne al
mov byte [ebp - 0xc], al
mov esi, dword [esi]
test al, al
je 0x10015f83
mov eax, dword [ebp - 0x10]
lea edx, [ebp + 0x10]
push edx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
push ecx
call edi
mov eax, dword [ebp + 8]
mov ecx, dword [esi]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
shl ebx, 2
lea esi, [eax + 1]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
test ebx, ebx
jne 0x10015fb4
xor al, al
jmp 0x10015fcc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x18], esi
call edi
mov ecx, dword [ebp - 0x18]
test eax, eax
setne al
mov byte [ebp - 0xc], al
mov ebx, dword [esi]
test al, al
je 0x10015fe6
mov eax, dword [ebp - 0x10]
lea edx, [ebp + 0x10]
push edx
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0x10], eax
push ecx
call edi
mov eax, dword [ebp + 8]
lea ecx, [esi + 4]
pop edi
add ecx, ebx
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret