joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001010
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call fcn.10001c20
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x1000107d
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x94
call esi
test eax, eax
jne 0x1000107d
xor al, al
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.10001c06
add esp, 0xa0
ret
cmp dword [esp + 8], 6
mov ecx, dword [esp + 0xa0]
sete al
pop esi
xor ecx, esp
call fcn.10001c06
add esp, 0xa0
ret

Function at 0x100010a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x61c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x618], eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0x10]
push eax
push str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318
push 0x80000002
call ebp
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push eax
mov byte [esp + 0x27], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x100011fc
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push edi
lea ecx, [esp + 0x28]
push ecx
push str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318
lea edx, [esp + 0x230]
push str._s_s_ndi
push edx
call ebx
add esp, 0x10
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x22c]
push ecx
push 0x80000002
call ebp
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x42c]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0x10008184
push edx
mov dword [esp + 0x2c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000117e
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100011a0
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x10008180
lea esi, [esp + 0x428]
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x100011db
mov eax, dword [esp + 0x20]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
add eax, 1
lea edx, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x38]
push eax
mov dword [esp + 0x34], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10001111
jmp 0x100011f9
lea ecx, [esp + 0x28]
push ecx
push str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318
push str._s_s
push 0x1000bcc0
call ebx
add esp, 0x10
mov byte [esp + 0x13], 1
pop edi
pop esi
pop ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x61c]
mov al, byte [esp + 7]
pop ebp
xor ecx, esp
call fcn.10001c06
add esp, 0x61c
ret
Function at 0x10001230
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x52c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x528], eax
push esi
mov esi, dword [esp + 0x534]
lea eax, [esp + 8]
push eax
push 0x1000bcc0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x330]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.InfPath
push ecx
mov dword [esp + 0x24], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100012b4
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x528]
xor ecx, esp
call fcn.10001c06
add esp, 0x52c
ret
push 0x104
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
test eax, eax
mov dword [esp + 4], eax
je 0x1000129c
cmp eax, 0x104
jae 0x1000129c
lea ecx, [esp + 0x32c]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x134]
push str._sinf_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push esi
push 0x104
lea edx, [esp + 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
mov dword [esp + 4], eax
je 0x1000129c
cmp eax, 0x104
jae 0x1000129c
mov eax, dword [esp + 0x10]
push 0
push 2
push 0
lea ecx, [esp + 0x138]
push ecx
mov byte [eax], 0
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileA]
cmp eax, 0xffffffff
je 0x1000129c
lea edx, [esp + 0x18]
push edx
push str.OriginalInfSourcePath
push str.Attansic_CoInfo
push eax
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineA]
test eax, eax
je 0x1000129c
lea eax, [esp + 4]
push eax
push 0x104
push esi
push 1
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldA]
test eax, eax
je 0x1000129c
cmp dword [esp + 4], 1
jbe 0x1000129c
mov ecx, dword [esp + 0x52c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10001c06
add esp, 0x52c
ret

Function at 0x10001400
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push 0x44
lea eax, [esp + 0x18]
push 0
push eax
call fcn.10001c20
mov eax, dword [esp + 0x6c]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push eax
push ecx
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x68], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1000147d
push eax
push str.Info
push str.CreateProcess_Fail
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 4]
push eax
call esi
pop esi
add esp, 0x54
ret
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 4]
push edx
call esi
pop esi
add esp, 0x54
ret
Function at 0x100015f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x698
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x694], eax
mov eax, dword [esp + 0x6a4]
push ebx
push esi
push edi
xor esi, esi
test eax, eax
je 0x10001635
push 0x20
push eax
mov dword [esp + esi*4 + 0x14], eax
call fcn.10001ac0
add esp, 8
test eax, eax
je 0x1000162d
mov byte [eax], 0
add eax, 1
add esi, 1
cmp esi, 3
jl 0x10001610
mov eax, dword [esp + 0xc]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea ecx, [esp + 0x2a4]
push ecx
call ebx
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
call ebx
mov ecx, dword [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
push edx
call ebx
add esp, 0x18
lea edi, [esp + 0x18]
mov esi, 0x100082bc
mov ecx, 4
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x100016a4
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xa4]
push str._f_remove___s_
push edx
call ebx
lea eax, [esp + 0x2ac]
push eax
push str._s_v32Inst.exe
lea ecx, [esp + 0x4b4]
push ecx
jmp 0x100016cd
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0xa4]
push str._f_remove___s_
push eax
call ebx
lea ecx, [esp + 0x2ac]
push ecx
push str._s_v64Inst.exe
lea edx, [esp + 0x4b4]
push edx
call ebx
add esp, 0x18
push 5
push 0
lea eax, [esp + 0xa8]
push eax
lea ecx, [esp + 0x4ac]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
pop edi
pop esi
pop ebx
jg 0x1000170c
push 0
push str.Info
push str.ShellCall_Fail
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x694]
xor ecx, esp
call fcn.10001c06
add esp, 0x698
ret
Function at 0x10001c06
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10001c10
repz ret
jmp fcn.10001fbb

Function at 0x100062eb
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10002504
xor ebx, ebx
cmp dword [0x1000c848], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x100063c0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1000632b
xor eax, eax
jmp 0x10006484
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10008cd0
push edi
call esi
cmp eax, ebx
je 0x10006324
push eax
call fcn.100024a1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1000c848], eax
call esi
push eax
call fcn.100024a1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1000c84c], eax
call esi
push eax
call fcn.100024a1
mov dword [0x1000c850], eax
lea eax, [ebp - 8]
push eax
call fcn.10002262
test eax, eax
pop ecx
pop ecx
je 0x1000638e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10003c69
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x100063c0
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.100024a1
cmp eax, ebx
pop ecx
mov dword [0x1000c858], eax
je 0x100063c0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100024a1
pop ecx
mov dword [0x1000c854], eax
mov eax, dword [0x1000c854]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x10006439
cmp dword [0x1000c858], esi
je 0x10006439
push eax
call fcn.1000250d
pop ecx
call eax
cmp eax, ebx
je 0x10006406
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1000c858]
call fcn.1000250d
pop ecx
call eax
test eax, eax
je 0x10006406
test byte [ebp - 0x18], 1
jne 0x10006439
lea eax, [ebp - 0xc]
push eax
call fcn.10002299
test eax, eax
pop ecx
je 0x10006421
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10003c69
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x10006430
or dword [ebp + 0x10], 0x200000
jmp 0x1000646a
or dword [ebp + 0x10], 0x40000
jmp 0x1000646a
mov eax, dword [0x1000c84c]
cmp eax, esi
je 0x1000646a
push eax
call fcn.1000250d
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1000646a
mov eax, dword [0x1000c850]
cmp eax, esi
je 0x1000646a
push dword [ebp - 4]
push eax
call fcn.1000250d
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1000c848]
call fcn.1000250d
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401510
Capabilities:
Create process on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push ebx
push ecx
sub esp, 0xac
mov ebx, ecx
call fcn.00401740
cmp dword [ebx], 4
jne 0x401697
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
movzx eax, al
test eax, eax
jne 0x401553
mov dword [ebp - 0x1c], 0
mov eax, dword [ebx + 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
movzx eax, al
test eax, eax
jne 0x401570
mov dword [ebp - 0x20], 0
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
movzx eax, al
test eax, eax
jne 0x40158d
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x84]
mov eax, 0
mov ecx, 0x11
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x84], 0x44
lea eax, [ebp - 0x3c]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x84]
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x200
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x401625
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov dword [esp], section..rdata
call sub.msvcrt.dll_printf
mov eax, 0
jmp 0x40169c
mov dword [ebp - 0x40], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x2c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
lea eax, [ebp - 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1300
mov eax, dword [sym.imp.KERNEL32.dll_FormatMessageA]
call eax
sub esp, 0x1c
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_puts
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
call eax
sub esp, 4
mov eax, 1
jmp 0x40169c
mov eax, 0
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop edi
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x401ac0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0xe053a0]
test esi, esi
jle 0x401bd0
mov edi, dword [0xe053a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401af4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401b75
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x401ae0
mov dword [esp], eax
mov ebx, eax
call fcn.004023b0
test eax, eax
mov edi, eax
je 0x401bf7
mov eax, dword [0xe053a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.004024b0
add eax, dword [edi + 0xc]
mov edx, dword [0xe053a4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401bd7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401b6e
sub eax, 4
and eax, 0xfffffffb
jne 0x401b80
add dword [0xe053a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0xe053a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401b6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 0xe041e8
mov dword [esp + 4], eax
call fcn.00402730
lea esi, [esi]
xor esi, esi
jmp 0x401afe
mov eax, dword [0xe053a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], 0xe041b4
mov dword [esp + 4], eax
call fcn.00402730
mov dword [esp + 4], ebx
mov dword [esp], 0xe04194
call fcn.00402730
lea esi, [esi]
nop

Function at 0x402030
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xe053b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xe053b0]
sub esp, 4
test ebx, ebx
je 0x402085
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40207e
test esi, esi
je 0x40207e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402060
mov dword [esp], 0xe053b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402730
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402700
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0xe04178
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402700
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014e0
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6c9128c6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x59a70f9b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x5db0ae
Capabilities:
Encode data using xor

Disassembly:
or ebp, dword [edx + 0x281d8ef4]
cmp dword [0x11bd], ebx
sbb dword [0x28e16728], 0x1c
loope fcn.005db095
and dl, ch
lahf
dec eax
sbb eax, 0x9d0a6816
push ss
push 0xe82e9d0a
je 0x5db0db
and ah, cl
in al, dx
and byte [eax - 0x2d9a23a1], cl
sub bh, byte [ebx]
shr byte [ebp - 0x18], cl
outsb dx, byte [esi]
fsub qword [edx]
loope 0x5db122
inc ebp
pop dword [edx - 0x68d8def2]
or byte [esi], 0x21
daa
xchg edi, eax
lodsb al, byte [esi]
dec esi
stosd dword es:[edi], eax
add eax, 0x682720e9
sub dl, byte [0xaeebe0b4]
adc eax, 0xaeebe0b4
shr ch, cl
pop ecx
push ecx
sub byte [edi - 0xb], ah
and byte [ebp + 0x275104fd], bh
loope 0x5db0d9
adc byte [eax], ch
shr dword [bx + si], 1
imul ecx, edx, 0xffffffeb
and byte [edx], bl
dec esi
scasb al, byte es:[edi]
pop edi
into
loopne 0x5db176
enter 0x628d, 0xffffffffffffffe5
inc ebx
sbb eax, 0x27200146
loope 0x5db0f5
std
mov eax, dword [0x714fd9fe]
adc ah, byte [esp + ebx*8 + 0x20ece022]
daa
out dx, al
pop ecx
inc ebp
invalid
pop ecx
mul dword [eax]
daa
xchg edi, eax
lodsb al, byte [esi]
dec esi
stosd dword es:[edi], eax
adc al, 0xe9
and byte [edi], ah
enter 0x1d94, 0x27
loope 0x5db1a2
xchg esp, eax
sbb eax, 0x5e75e127
pop esi
loop 0x5db152
dec edi
jb 0x5db164
sbb edi, ebp
xlatb
xchg ebx, eax
in al, 0x20
daa
loope 0x5db128
scasb al, byte es:[edi]
sub cl, cl
loopne 0x5db0cb
and ah, cl
add al, 0x27
mov ch, dh
jmp 0x5db0fb
sub byte [edi - 0x1f], ah
sub byte [eax], bh
int1
jmp 0x5db17a
in al, dx
and byte [0xa7455a6a], bl
pop edx
inc ebp
cmpsd dword [esi], dword es:[edi]
sub ebp, ecx
dec ebp
stosd dword es:[edi], eax
adc ebp, ecx
and byte [edi], ah
push edi
push cs
xor esp, dword [edi]
loope 0x5db160
mov byte [0x7c22e1a8], al
test al, 0xe1
and bh, byte [edx + edi*4 + 0x74]
cmp al, 0x9c
xor cl, ah
in al, dx
mov edx, 0x309c3c74
loope 0x5db16d
and byte [ebp + 0x271d73c7], al
loope 0x5db11b
or eax, 0x4d516212
daa
push ds
push 0x4e
daa
loope 0x5db181
rcl dword [edi - 0x73]
in eax, 0xa
fldenv [edi + 0x21]
cmp eax, 0x30c16928
jno 0x5db1b6
enter 0x2f05, 0x68
adc byte [0xc7ed2553], 0x6d
in al, 0x8a
mov al, byte [0x4e735b7a]
stosd dword es:[edi], eax
adc al, 0xe9
and byte [edi], ah
leave
cmc
loope 0x5db23e
cmc
daa
cmp eax, 0xd4888f0d
sbb eax, 0xd2865027
adc eax, 0x3adcc7f9
enter 0xfffffffffffff693, 0x26
loope 0x5db256
cmc
mov dword [edi - 0x17], edx
and byte [edi], ah
leave
int1
daa
daa
loope 0x5db25a
pop esi
loop 0x5db20a
dec edi
jb 0x5db21c
jb 0x5db23f
xor dword gs:[ecx + 0x12], esi
xchg dword [esi - 0x52], ecx
dec esi
scasb al, byte es:[edi]
pop edi
salc
loopne 0x5db2be
invalid
enter 0x468d, 1
adc ecx, esp
jmp 0x5db208
stosd dword es:[edi], eax
notrack jmp 0x86aed9e5
Function at 0x5e6a3e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5e6a59
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124abc7e]
pop edx
test eax, eax
je 0x5e6b2b
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5e6b1a
test dword [ebp - 0x2a8], 1
jne 0x5e6b1a
and dword [ebp - 0x2a8], 0x100
jne 0x5e6b1a
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3ec8]
pop edx
pop esi
test eax, eax
je 0x5e6abd
jmp 0x5e6b1a
cmp word [esi], 0x5a4d
jne 0x5e6b1a
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5e6b1a
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d3d48]
pop edx
test eax, eax
je 0x5e6b1a
lea eax, [ebp - 0x28c]
push eax
call fcn.005e699a
test eax, eax
jne 0x5e6b13
jmp 0x5e6b1a
mov eax, esi
jmp 0x5e6b2b
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5e6a59
pop esi
leave
ret 4
Function at 0x106bd0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.106bd200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x106bd0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106bd0c2
add dl, dl
jne 0x106bd0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106bd134
xor eax, eax
add dl, dl
jne 0x106bd0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106bd1d5
add dl, dl
jne 0x106bd0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106bd108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106bd113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106bd11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106bd12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x106bd0cd
mov eax, 1
add dl, dl
jne 0x106bd142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106bd14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106bd139
sub eax, ebx
mov ebx, 1
jne 0x106bd180
mov ecx, 1
add dl, dl
jne 0x106bd166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106bd171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106bd15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106bd0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x106bd197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x106bd1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106bd18e
cmp eax, 0x7d00
jae 0x106bd1c5
cmp eax, 0x500
jb 0x106bd1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106bd0cd
cmp eax, 0x7f
ja 0x106bd1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x106bd0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x106bd1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x106bd0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1000ae40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x58aa2d
mov dword [ebp - 4], 0xe9
call esi
mov dl, byte [ebp - 4]
mov ecx, 0x58aa2d
lea eax, [ebp - 8]
push eax
mov byte [ecx], dl
mov ecx, dword [ebp - 0xc]
push ecx
push 1
push 0x58aa2d
call esi
lea edx, [ebp - 0xc]
push edx
push 0x40
push 4
mov edi, sym.plugin.dll_void___cdecl_plugin::Core::DrawBlipsFuncExe_void_
push 0x58aa2e
sub edi, 0x58aa32
call esi
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 8]
push ecx
push edx
mov eax, 0x58aa2e
push 4
push eax
mov dword [eax], edi
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret