joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002000
Capabilities:
Get common file path
Write file on windows

Disassembly:
call fcn.10001f50
test al, al
jne 0x1000200a
ret
push esi
mov esi, dword [0x1001d3c0]
cmp esi, 0x10
jae 0x1000201a
xor al, al
pop esi
ret
push edi
mov edi, dword [0x1001d3bc]
mov eax, 0x1001a3a4
mov edx, edi
mov ecx, 0x10
sub edx, eax
push ebx
mov ebx, dword [edx + eax]
cmp ebx, dword [eax]
jne 0x10002051
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x10002030
add esi, 0xfffffff0
xor ecx, ecx
test esi, esi
jle 0x100020cf
jmp 0x10002066
pop ebx
pop edi
xor al, al
pop esi
ret
mov edi, dword [0x1001d3bc]
mov eax, 0x100b9490
lea esi, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10002070
sub eax, esi
mov esi, eax
xor edx, edx
mov eax, ecx
div esi
mov esi, 0x18
movsx eax, byte [edx + 0x100b9490]
xor edx, edx
div esi
mov al, byte [edx + str._mX]
sub byte [edi + ecx + 0x10], al
mov esi, dword [0x1001d3bc]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 4
lea edx, [edx + edx*2]
add edx, edx
add edx, edx
add edx, edx
mov eax, ecx
sub eax, edx
mov dl, byte [eax + str._mX]
xor byte [esi + ecx + 0x10], dl
mov eax, dword [0x1001d3c0]
inc ecx
add eax, 0xfffffff0
cmp ecx, eax
jl 0x10002060
pop ebx
pop edi
pop esi
jmp fcn.100020e0

Function at 0x100020e0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x1000211c
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0x3e8
idiv ecx
push edx
push str.vorks_d
push 0x1001d3c4
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x10106
push 2
push 0
push 7
push 0x40000000
push 0x1001d3c4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000219b
mov eax, dword [0x1001d3c0]
mov ecx, dword [0x1001d3bc]
push 0
lea edx, [ebp - 0x10c]
push edx
add eax, 0xfffffff0
push eax
add ecx, 0x10
push ecx
push esi
mov dword [ebp - 0x10c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x100021ac
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
Function at 0x10002260
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [esi + 0x14], 0x10
jb 0x10002270
mov eax, dword [esi]
jmp 0x10002272
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x100022b1
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
push eax
push ecx
push esi
push ecx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push str.Archivo_eliminado:
push ecx
call fcn.10002c50
add esp, 0xc
push eax
call fcn.10002ea0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov al, 1
mov esp, ebp
pop ebp
ret
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
push edx
push ecx
push esi
push ecx
push str.Error_al_eliminar_el_archivo:
push eax
call fcn.10002c50
add esp, 0xc
push eax
call fcn.10002ea0
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x100022f0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001984b
mov eax, dword fs:[0]
push eax
sub esp, 0x194
mov eax, dword [0x1001d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x1a0], esi
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], ebx
mov dword [ebp - 0x194], ebx
push str..
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 4], ebx
call fcn.100030d0
add esp, 0xc
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c]
mov edi, 0x10
cmp dword [ebp - 0x18], edi
jae 0x1000236c
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x188]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x18c], eax
cmp eax, 0xffffffff
jne 0x100023b1
lea edx, [ebp - 0x19c]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
cmp esi, edx
je 0x1000239f
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
cmp dword [ebp - 0x18], edi
jb 0x100024b7
mov eax, dword [ebp - 0x2c]
push eax
jmp 0x100024ae
test byte [ebp - 0x188], 0x10
jne 0x10002417
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100023d0
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x15c]
lea esi, [ebp - 0x48]
call fcn.10001e40
mov ecx, esi
lea edi, [ebp - 0x19c]
mov byte [ebp - 4], 2
call fcn.10002840
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], 0x10
jb 0x10002411
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov esi, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x18c]
lea edx, [ebp - 0x188]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100023b1
mov ecx, dword [ebp - 0x18c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [ebp - 0x19c]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
cmp esi, edx
je 0x10002472
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0x198]
mov edx, dword [ebp - 0x194]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [ebp - 0x19c], ebx
xor edi, edi
jmp 0x10002478
mov edi, dword [ebp - 0x198]
cmp dword [ebp - 0x18], 0x10
jb 0x1000248b
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
cmp dword [ebp - 0x19c], ebx
je 0x100024b7
mov ebx, dword [ebp - 0x19c]
mov eax, ebx
call fcn.10002bb0
push ebx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10018a8d
mov esp, ebp
pop ebp
ret
Function at 0x10003a50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x1015e800]
fld qword [eax]
push esi
fsub qword [0x1001ab90]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [0x1015e804]
lea ecx, [esp + 0xc]
fabs
push ecx
fstp qword [esp + 0x14]
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
fmul qword [0x1001ab88]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0xc]
push edx
fadd qword [0x1001ab80]
push eax
push 8
push edi
fstp qword [edi]
call esi
mov ecx, dword [0x1015e800]
fld qword [ecx]
mov edi, dword [0x1015e808]
fsub qword [0x1001ab90]
lea edx, [esp + 0xc]
push edx
push 0x40
push 8
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
fmul qword [0x1001ab88]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
fadd qword [0x1001ab80]
push ecx
push 8
push edi
fstp qword [edi]
call esi
mov edx, dword [0x1015e800]
fld qword [edx]
mov edi, dword [0x1015e80c]
fsub qword [0x1001ab90]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea ecx, [esp + 0xc]
fmul qword [0x1001ab88]
push ecx
push edx
push 4
fadd qword [0x1001ab78]
push edi
fstp dword [edi]
call esi
mov eax, dword [0x1015e800]
fld qword [eax]
mov edi, dword [0x1015e810]
fsub qword [0x1001ab90]
lea ecx, [esp + 0xc]
fabs
fstp qword [esp + 0x10]
push ecx
push 0x40
push 4
push edi
call esi
fld qword [esp + 0x10]
mov eax, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea edx, [esp + 0xc]
fmul qword [0x1001ab88]
push edx
push eax
push 4
fadd qword [0x1001ab78]
push edi
fstp dword [edi]
call esi
mov ecx, dword [0x1015e800]
fld qword [ecx]
mov edi, dword [0x1015e814]
fsub qword [0x1001ab90]
lea edx, [esp + 0xc]
push edx
push 0x40
push 4
fabs
push edi
fstp qword [esp + 0x20]
call esi
fld qword [esp + 0x10]
mov ecx, dword [esp + 0xc]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea eax, [esp + 0xc]
fmul qword [0x1001ab88]
push eax
push ecx
push 4
fadd qword [0x1001ab70]
push edi
fstp dword [edi]
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003be0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp dword [0x1015e818], 0
push esi
push edi
je 0x10003db7
mov edi, dword [0x1015e7f4]
fld dword [0x1015e81c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1015e820]
mov edi, dword [0x1015e7f8]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1015e824]
mov edi, dword [0x1015e7fc]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld qword [0x1015e828]
mov edi, dword [0x1015e800]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld qword [0x1015e830]
mov edi, dword [0x1015e804]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld qword [0x1015e838]
mov edi, dword [0x1015e808]
fstp qword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 8
push edi
call esi
fld qword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp qword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 8
push edi
call esi
fld dword [0x1015e840]
mov edi, dword [0x1015e80c]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1015e844]
mov edi, dword [0x1015e810]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x1015e848]
mov edi, dword [0x1015e814]
fstp dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push edi
call esi
fld dword [esp + 0x10]
mov edx, dword [esp + 0xc]
fstp dword [edi]
lea ecx, [esp + 0xc]
push ecx
push edx
push 4
push edi
call esi
push 1
push 3
call fcn.10008350
push eax
mov eax, 0x597630
call eax
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10003e70
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x10003e80
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x10003e8c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10003e96
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10003ea0
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x10003eaa
or eax, 8
shr ecx, 1
test cl, 1
je 0x10003eb4
or eax, 4
shr ecx, 1
test cl, 1
je 0x10003ebe
or eax, 2
test cl, 2
je 0x10003ec6
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor edi, edi
mov dword [esi + edx*4], ecx
mov eax, ecx
lea ecx, [edi + 0x1f]
jmp 0x10003f80
test al, 1
je 0x10003f8d
mov ebx, 1
shl ebx, cl
or edi, ebx
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10003f80
mov dword [esi + edx*4], edi
inc edx
cmp edx, 0xff
jle 0x10003e74
pop edi
pop ebx
ret

Function at 0x10003fb0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x1001a49c
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10003fe2
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10004010
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10004073
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x10004059
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10004038
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10004030
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10005ac0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x10005d60
push 0x4d9d0e
mov bl, 0xe8
call fcn.10017e50
push 0x10005f00
push 0x40b154
mov bl, 0xe9
call fcn.10017e50
push 0x10005f80
push 0x64a79a
or bl, 0xff
call fcn.10017e50
push 0x10005f80
push 0x64a85f
or bl, 0xff
call fcn.10017e50
push 0x10005f80
push 0x656e03
or bl, 0xff
call fcn.10017e50
push 0x10005f80
push 0x64ab3d
or bl, 0xff
call fcn.10017e50
push 0x10005f80
push 0x64ac02
or bl, 0xff
call fcn.10017e50
push 0x10005f80
push 0x63ddf2
or bl, 0xff
call fcn.10017e50
add esp, 0x40
push 0x10005f80
push 0x63df89
or bl, 0xff
call fcn.10017e50
push 0x10005f80
push 0x63ea4c
or bl, 0xff
call fcn.10017e50
push 0x10005f80
push 0x64ca0c
or bl, 0xff
call fcn.10017e50
push 0x10005f80
push 0x77faf9
or bl, 0xff
call fcn.10017e50
push 0x10005f80
push 0x81071b
or bl, 0xff
call fcn.10017e50
push 0x10005f80
push 0x81079b
or bl, 0xff
call fcn.10017e50
push 0x10005e40
push 0x47fe31
or bl, 0xff
call fcn.10017e50
push 0x10005e40
push 0x59890d
or bl, 0xff
call fcn.10017e50
add esp, 0x40
push 0x10005e40
push 0x59a399
or bl, 0xff
call fcn.10017e50
push 0x10005e40
push 0x59a93c
or bl, 0xff
call fcn.10017e50
push 0x10005e40
push 0x59b13b
or bl, 0xff
call fcn.10017e50
push 0x10005e40
push 0x5a4261
or bl, 0xff
call fcn.10017e50
push 0x10005e40
push 0x5a4d52
or bl, 0xff
call fcn.10017e50
push 0x10005e40
push 0x5b6117
or bl, 0xff
call fcn.10017e50
push 0x10005e40
push 0x65a6ce
or bl, 0xff
call fcn.10017e50
push 0x10005e40
push 0x727987
or bl, 0xff
call fcn.10017e50
add esp, 0x40
push 0x10005e40
push 0x7861f1
or bl, 0xff
call fcn.10017e50
push 0x10005e40
push 0x7d32fa
or bl, 0xff
call fcn.10017e50
push 0x10005e40
push 0x7d3b0d
or bl, 0xff
call fcn.10017e50
push 0x10005ec0
push 0x7d2b0c
mov bl, 0xe8
call fcn.10017e50
push 0x10005fb0
push 0x8317bd
mov bl, 0xe9
call fcn.10017e50
push 0x59b00e
push 0x59affa
mov bl, 0xe8
call fcn.10017e50
push 0x720894
push 0x71ae92
mov bl, 0xe9
call fcn.10017e50
push 0x720894
push 0x71b1a3
call fcn.10017e50
add esp, 0x40
push 0x58811f
push 0x5880f0
call fcn.10017e50
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x588447
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x588447], 0xfff
mov edx, dword [ebp - 4]
push edx
push 4
push 0x588447
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008df0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.10008d80
test eax, eax
je 0x10008ee6
push ebx
push esi
push 0x100090d0
push 0x4d2882
mov bl, 0xe8
call fcn.10017e50
push 0x10009050
push 0x4d28eb
call fcn.10017e50
push 0x10009090
push 0x4d2957
call fcn.10017e50
push 0x100090d0
push 0x4d29c1
call fcn.10017e50
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x20
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d2887
call esi
mov bl, 0x90
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d2887], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d2887
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d28f0
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d28f0], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d28f0
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d295c
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d295c], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d295c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d29c6
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4d29c6], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4d29c6
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call fcn.10009b80
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
add esp, 4
test al, al
je 0x10009cb0
xor ecx, ecx
test edi, edi
jle 0x10009cb0
mov dl, byte [0x10155475]
mov al, dl
imul byte [0x10155474]
push ebx
mov bl, byte [ecx + esi]
add bl, al
xor bl, dl
mov byte [ecx + esi], bl
inc ecx
cmp ecx, edi
jl 0x10009ca0
pop ebx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call dword [0x10155478]
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x10009cd0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ecx, ecx
mov edi, 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x14], edi
lea esi, [ecx + 1]
mov eax, 0xf0f0f0f1
mul ecx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100b9490]
mov byte [ebp - 1], al
mov eax, 0xf0f0f0f1
mul esi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100b9491]
movzx edx, byte [edi + 0x100b9423]
mov byte [ebp - 3], al
mov byte [ebp - 2], dl
mov eax, 0xf0f0f0f1
mul edi
mov edi, dword [ebp - 0xc]
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100b9492]
movzx edx, byte [edi + 0x100b9423]
mov byte [ebp - 5], al
mov byte [ebp - 4], dl
mov bl, byte [esi + 0x100b9423]
mov eax, 0xf0f0f0f1
mul edi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100b9493]
movzx edx, byte [ecx + 0x100b9427]
mov byte [ebp - 6], al
mov al, byte [ebp - 1]
mov byte [ebp - 7], dl
mov dl, bl
sub bl, al
xor dl, al
movzx eax, bl
movzx edi, dl
add di, word [ebp - 0x10]
mov dl, byte [ebp - 3]
xor di, ax
mov al, byte [ebp - 2]
mov bl, al
xor bl, dl
sub al, dl
movzx ebx, bl
add di, bx
movzx edx, al
mov al, byte [ebp - 4]
xor di, dx
mov dl, byte [ebp - 5]
mov bl, al
xor bl, dl
movzx ebx, bl
sub al, dl
mov dl, byte [ebp - 6]
add di, bx
movzx eax, al
xor di, ax
mov al, byte [ebp - 7]
mov bl, dl
xor bl, al
movzx ebx, bl
add di, bx
sub al, dl
add dword [ebp - 0xc], 4
movzx edx, al
xor di, dx
movzx eax, di
mov edi, dword [ebp - 0x14]
add esi, 4
add edi, 4
add ecx, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp esi, 0x21
jb 0x10009cf0
mov edx, dword [0xd227b0]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [eax - 0x56]
mov byte [0x10155475], cl
lea ecx, [ebp - 0x14]
push ecx
shr eax, 8
sub al, 0x45
push 0x40
mov byte [0x10155474], al
mov eax, dword [0xd227f8]
push 4
push 0xd227b0
mov dword [0x1015547c], edx
mov dword [0x10155478], eax
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0xd227b0], 0x10009c10
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0xd227b0
call esi
lea ecx, [ebp - 0x14]
push ecx
push 0x40
push 4
push 0xd227f8
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0xd227f8], 0x10009c70
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0xd227f8
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a240
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
call fcn.10005fe0
push 0x1000a210
push 0x614aef
mov bl, 0xe8
call fcn.10017e50
push 0x1000a210
push 0x772460
call fcn.10017e50
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x10
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x1000a340
push 5
sub eax, 0x7c1d83
xor edi, edi
push 0x7c1d7e
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1000a2c7
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x7c1d7e
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x7c1d7e
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1000a2cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x1000a350
push 5
sub ecx, 0x80f803
push 0x80f7fe
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1000a31c
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x80f7fe
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x80f7fe
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1000a322
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1000a3e0
push 0x860af2
call fcn.10017e50
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret