joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001869
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push str.ADVAPI32.dll
mov dword [ebp - 4], ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x100018dd
push esi
push str.ConvertStringSecurityDescriptorToSecurityDescriptorA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0xc
mov dword [eax + 0xbc], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
mov eax, dword [ebp - 4]
mov edx, str.D:_D_OICI_GA___BG__D_OICI_GA___AN__A_OICI_GA___AU__A_OICI_GA___BA_
mov ecx, str.S:_ML__NW___LW_
cmovbe ecx, edx
push edi
add eax, 0xb8
push eax
xor eax, eax
inc eax
push eax
push ecx
call esi
push 1
test eax, eax
pop eax
push ebx
cmovne edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x10001971
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x804]
push eax
mov edi, ecx
xor esi, esi
mov dword [ebp - 4], 0x400
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x100019de
lea ecx, [ebp - 0x804]
call fcn.10006aa0
mov esi, eax
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
call fcn.10006b40
add esi, esi
push esi
lea edx, [ebp - 0x804]
mov ecx, eax
mov dword [edi + 0xc], eax
call fcn.10006ae0
mov eax, dword [edi + 0xc]
xor ecx, ecx
mov word [esi + eax], cx
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x10002598
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push esi
push edi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 8]
xor esi, esi
mov edi, ecx
mov dword [ebp - 4], esi
call dword [sym.imp.msi.dll_MsiOpenProductW]
test eax, eax
jne 0x1000272d
push ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntdll.dll_RtlRandom]
xor edx, edx
mov ecx, 0xff
div ecx
lea eax, [edx + 1]
mov ecx, eax
mov dword [ebp + 8], eax
call fcn.10006b40
push dword [ebp + 8]
mov ebx, eax
xor eax, eax
mov ecx, ebx
lea edx, [eax + 1]
call fcn.10006a20
test ebx, ebx
je 0x10002723
push dword [edi + 4]
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, ebx
call fcn.10003b1e
mov edx, dword [edi + 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push ecx
push dword [ebp + 0xc]
mov ecx, dword [edi]
call fcn.100055dc
test eax, eax
je 0x10002714
lea eax, [ebp - 0x424]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x21c]
push eax
push esi
push 0x100073ec
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edx, str..exe
lea ecx, [ebp - 0x21c]
call fcn.100068e0
push esi
push 0x80
push 4
push esi
push esi
push 0x40000000
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000270c
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x10]
mov dword [ebp + 0xc], esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 1
test eax, eax
pop eax
push edi
cmovne esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1000270c
lea eax, [ebp - 0x21c]
push eax
push ecx
push dword [ebp - 4]
call fcn.10002277
test eax, eax
je 0x100026ff
sub esp, 0x10
push dword [ebp - 4]
call fcn.10002203
test eax, eax
je 0x100026ff
sub esp, 0xc
push dword [ebp - 4]
call fcn.10002191
test eax, eax
je 0x100026ff
push dword [ebp - 4]
call dword [sym.imp.msi.dll_MsiDatabaseGenerateTransformW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 8]
call fcn.10006b50
mov ecx, dword [ebp - 8]
call fcn.10006b50
mov ecx, ebx
call fcn.10006b50
push dword [ebp - 4]
call dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
pop ebx
pop edi
pop esi
leave
ret 0xc
Function at 0x10002733
Capabilities:
Clear file content
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1818
call sub.ntdll.dll__chkstk
push ebx
push esi
xor esi, esi
push esi
push 0x8000000
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100028b2
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov ecx, edi
call fcn.10006b40
push 0
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10002797
cmp dword [ebp - 0x14], edi
je 0x100027a2
mov ecx, esi
call fcn.10006b50
xor esi, esi
xor edi, edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
test esi, esi
je 0x100028b1
mov eax, dword [ebp - 8]
mov edx, edi
push dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.10003b1e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 8]
push dword [ebp - 0xc]
mov edx, dword [eax + 4]
push ecx
push dword [ebp + 0xc]
mov ecx, dword [eax]
call fcn.100052a0
test eax, eax
je 0x100028a2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
push ecx
lea eax, [ebp - 0x1818]
push eax
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x1018]
call fcn.10006ce6
lea edx, [ebp - 0x1018]
lea ecx, [ebp - 0x818]
call fcn.100068b0
mov edx, 0x10007314
lea ecx, [ebp - 0x818]
call fcn.100068e0
lea edx, [ebp - 0x1818]
lea ecx, [ebp - 0x818]
call fcn.100068e0
mov edx, str..exe
lea ecx, [ebp - 0x818]
call fcn.100068e0
xor eax, eax
push eax
push 0x80
push 4
push eax
push eax
push 0x40000000
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000289a
and dword [ebp + 8], 0
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x18]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push edi
call ebx
mov ecx, dword [ebp - 4]
call fcn.10006b50
mov ecx, dword [ebp - 0xc]
call fcn.10006b50
mov ecx, esi
call fcn.10006b50
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100028b8
Capabilities:
Clear file content
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1814
call sub.ntdll.dll__chkstk
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlRandom]
xor edx, edx
mov ecx, 0xff
div ecx
lea esi, [edx + 1]
mov ecx, esi
call fcn.10006b40
mov edi, eax
push esi
mov dl, 1
mov ecx, edi
call fcn.10006a20
test edi, edi
je 0x100029f5
push dword [ebx + 4]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov edx, esi
mov ecx, edi
call fcn.10003b1e
mov edx, dword [ebx + 4]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push ecx
push dword [ebp + 0xc]
mov ecx, dword [ebx]
call fcn.10004f74
test eax, eax
je 0x100029e6
push ecx
push ecx
lea eax, [ebp - 0x1814]
push eax
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x1014]
call fcn.10006ce6
lea edx, [ebp - 0x1014]
lea ecx, [ebp - 0x814]
call fcn.100068b0
mov edx, 0x10007314
lea ecx, [ebp - 0x814]
call fcn.100068e0
lea edx, [ebp - 0x1814]
lea ecx, [ebp - 0x814]
call fcn.100068e0
mov edx, str..exe
lea ecx, [ebp - 0x814]
call fcn.100068e0
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100029de
push ebx
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x14]
mov dword [ebp + 0xc], ebx
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
call fcn.10006b50
mov ecx, dword [ebp - 8]
call fcn.10006b50
mov ecx, edi
call fcn.10006b50
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10002af7
Capabilities:
Enumerate pe sections
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call sub.ntdll.dll__chkstk
push ecx
push ecx
lea eax, [ebp - 0x80c]
push eax
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x100c]
call fcn.10006ce6
mov edx, str.setup
lea ecx, [ebp - 0x80c]
call fcn.10006920
test eax, eax
jne 0x10002b5c
mov edx, str.install
lea ecx, [ebp - 0x80c]
call fcn.10006920
test eax, eax
jne 0x10002b5c
mov edx, str.update
lea ecx, [ebp - 0x80c]
call fcn.10006920
test eax, eax
je 0x10002cc5
push ebx
push esi
xor ebx, ebx
push ebx
push 0x8000000
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10002cc3
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov ecx, ebx
call fcn.10006b40
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10002bb0
cmp dword [ebp - 0xc], ebx
je 0x10002bb9
mov ecx, edi
call fcn.10006b50
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x10002cc2
mov eax, 0x5a4d
xor esi, esi
xor edx, edx
cmp word [edi], ax
jne 0x10002c18
mov ecx, dword [edi + 0x3c]
add ecx, edi
cmp dword [ecx], 0x4550
jne 0x10002c18
movzx edx, word [ecx + 0x14]
movzx eax, word [ecx + 6]
add edx, 0x18
add edx, ecx
xor ebx, ebx
test eax, eax
je 0x10002c15
mov eax, dword [edx + 0x24]
and eax, 0x60000020
cmp eax, 0x60000020
je 0x10002c13
movzx eax, word [ecx + 6]
inc ebx
add edx, 0x28
cmp ebx, eax
jb 0x10002bf6
jmp 0x10002c15
mov esi, edx
mov edx, dword [ecx + 0x28]
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, dword [eax + 0x3c]
and dword [ebp + 0xc], ecx
add ebx, eax
mov dword [ebp - 4], ebx
movzx eax, word [ebx + 0x14]
add ebx, 0x18
add ebx, eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 6]
mov dword [ebp - 8], eax
test eax, eax
je 0x10002c61
mov eax, dword [ebx + 0x24]
and eax, 0x60000020
cmp eax, 0x60000020
je 0x10002c5f
mov eax, dword [ebp + 0xc]
inc eax
add ebx, 0x28
mov dword [ebp + 0xc], eax
cmp eax, dword [ebp - 8]
jb 0x10002c3f
jmp 0x10002c61
mov ecx, ebx
test esi, esi
je 0x10002cbb
test ecx, ecx
je 0x10002cbb
mov eax, dword [esi + 0x10]
cmp eax, dword [ecx + 0x10]
jne 0x10002c81
mov eax, dword [ebp - 4]
sub edx, dword [esi + 0xc]
mov eax, dword [eax + 0x28]
sub eax, dword [ecx + 0xc]
cmp edx, eax
je 0x10002cbb
push 0x14
pop ecx
call fcn.10006b40
mov esi, eax
test esi, esi
je 0x10002ca5
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi], 0x10007634
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
jmp 0x10002ca7
xor esi, esi
mov ecx, dword [ebp + 0x14]
push esi
call fcn.10006c40
mov edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
call fcn.10006b60
mov ecx, edi
call fcn.10006b50
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10002cc9
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
lea eax, [ebp - 0xc]
push eax
push 2
push dword [ebp + 8]
xor esi, esi
xor ebx, ebx
inc esi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.msi.dll_MsiOpenProductW]
test eax, eax
jne 0x10002d85
push edi
lea eax, [ebp - 4]
push eax
push 0x10007318
push dword [ebp - 0xc]
mov dword [ebp - 4], ebx
call dword [sym.imp.msi.dll_MsiEnumClientsA]
mov edi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test eax, eax
jne 0x10002d7b
push esi
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
mov dword [ebp - 8], eax
test eax, eax
je 0x10002d76
push eax
push dword [ebp - 4]
call dword [sym.imp.msi.dll_MsiViewModify]
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x10002d71
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x50]
push eax
push esi
push dword [ebp - 8]
mov dword [ebp - 0x10], 0x20
call dword [sym.imp.msi.dll_MsiRecordSetStreamA]
test eax, eax
jne 0x10002d68
cmp word [ebp - 0x50], 0x32
jne 0x10002d68
cmp word [ebp - 0x4e], ax
cmove esi, eax
push dword [ebp - 4]
call dword [sym.imp.msi.dll_MsiViewGetErrorW]
push dword [ebp - 8]
call edi
push dword [ebp - 4]
call edi
push dword [ebp - 0xc]
call edi
pop edi
test esi, esi
je 0x10002dbd
push 0x14
pop ecx
call fcn.10006b40
mov esi, eax
test esi, esi
je 0x10002da7
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi], 0x10007634
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
jmp 0x10002da9
mov esi, ebx
mov ecx, dword [ebp + 0x14]
push esi
call fcn.10006c40
mov edx, dword [ebp + 8]
lea ecx, [esi + 0xc]
call fcn.10006b60
pop esi
pop ebx
leave
ret 0x10
Function at 0x10002ee5
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x14], ecx
mov ecx, edi
call fcn.10006aa0
lea eax, [edi + eax*2]
mov edx, 0x1000730c
mov ecx, eax
mov dword [esp + 0x10], eax
call fcn.100068b0
push 0x250
xor dl, dl
lea ecx, [esp + 0x1c]
call fcn.10006a20
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10002fc3
mov esi, dword [ebp + 0x14]
push 0x2e
pop eax
cmp word [esp + 0x44], ax
jne 0x10002f60
cmp word [esp + 0x46], 0
je 0x10002fa9
cmp word [esp + 0x46], ax
jne 0x10002f60
cmp word [esp + 0x48], 0
je 0x10002fa9
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x44]
call fcn.100068b0
test byte [esp + 0x18], 0x10
je 0x10002f95
mov ecx, dword [esp + 0x10]
mov edx, 0x10007314
call fcn.100068e0
mov ecx, dword [esp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.10002ee5
jmp 0x10002fa0
push esi
push ecx
push dword [ebp + 0xc]
push edi
call fcn.10002e06
cmp dword [esi + 8], 0x3e8
je 0x10002fbc
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x10002f42
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10002fcc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x800
push ebx
mov ebx, ecx
push edi
lea ecx, [ebp - 0x800]
call fcn.100068b0
mov ecx, dword [ebp + 8]
call fcn.10006aa0
lea edi, [ebp - 0x800]
mov edx, str.Temp.exe
lea edi, [edi + eax*2]
mov ecx, edi
call fcn.100068b0
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push 0x80000000
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x10003079
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10003080
push esi
push 0x14
pop ecx
call fcn.10006b40
mov esi, eax
test esi, esi
je 0x10003056
and dword [esi + 4], 0
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
mov dword [esi], 0x10007634
jmp 0x10003058
xor esi, esi
mov ecx, dword [ebp + 0x18]
push esi
call fcn.10006c40
lea ecx, [esi + 0xc]
lea edx, [ebp - 0x800]
call fcn.10006b60
mov dword [esi + 0x10], 1
pop esi
jmp 0x10003080
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x18]
xor eax, eax
push dword [ebp + 0x14]
mov word [edi], ax
push dword [ebp + 0x10]
lea eax, [ebp - 0x800]
push eax
mov ecx, ebx
call fcn.10002ee5
pop edi
pop ebx
leave
ret 0x14

Function at 0x100030e1
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
xor ebx, ebx
inc ebx
push ebx
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 8], eax
test eax, eax
je 0x10003114
push esi
push esi
push edi
push 0x10002033
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [edi + 0xc], eax
cmovne esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x10003aa1
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
push esi
push esi
push ecx
push 0x10003363
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10003ac0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
mov eax, esi
pop esi
ret

Function at 0x10003ac4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
mov dword [ebp - 4], edi
test ebx, ebx
je 0x10003b0a
mov edi, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov edx, dword [esi]
add al, bl
cmp dword [ebp + 0x10], 0
movzx ecx, al
je 0x10003af9
add edx, ebx
xor edx, edi
rol edx, cl
jmp 0x10003aff
ror edx, cl
xor edx, edi
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x10003ae1
mov edi, dword [ebp - 4]
test edi, edi
je 0x10003b17
mov eax, dword [ebp + 8]
xor byte [esi], al
inc esi
dec edi
jne 0x10003b11
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10003b9f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x1c
push esi
mov esi, ecx
xor ecx, ecx
mov edx, dword [esi + 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
add edx, esi
mov dword [eax], ecx
mov eax, 0x14c
push edi
mov edi, ecx
cmp word [edx + 4], ax
jne 0x10003cf5
push ebx
mov ebx, dword [edx + 0x88]
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x10003cf4
cmp dword [edx + 0x8c], ecx
je 0x10003cf4
movzx eax, word [edx + 0x14]
add eax, 0x18
add eax, edx
movzx edx, word [edx + 6]
test edx, edx
je 0x10003cf4
cmp dword [eax + 0xc], ebx
je 0x10003c10
inc ecx
add eax, 0x28
cmp ecx, edx
jb 0x10003bfe
jmp 0x10003cf4
mov edx, dword [eax + 0x14]
add edx, esi
push 0
movzx ecx, word [edx + 0xe]
movzx eax, word [edx + 0xc]
add ecx, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ecx
pop ebx
je 0x10003cf4
xor eax, eax
mov esi, dword [edx + eax*8 + 0x14]
and esi, 0x7fffffff
add esi, edx
mov dword [ebp - 0x10], 0
movzx eax, word [esi + 0xe]
mov dword [ebp - 4], eax
movzx eax, word [esi + 0xc]
add dword [ebp - 4], eax
je 0x10003ce8
xor eax, eax
mov ecx, dword [ebp + 8]
cmp word [esi + eax*8 + 0x10], cx
mov ecx, dword [ebp - 4]
jne 0x10003ccf
mov ecx, dword [esi + eax*8 + 0x14]
and ecx, 0x7fffffff
add ecx, edx
mov dword [ebp - 0xc], 0
movzx eax, word [ecx + 0xe]
mov dword [ebp - 8], eax
movzx eax, word [ecx + 0xc]
add dword [ebp - 8], eax
je 0x10003cc8
xor eax, eax
mov edx, 0x409
cmp word [ecx + eax*8 + 0x10], dx
mov edx, dword [ebp - 0x14]
je 0x10003cab
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
movzx eax, ax
cmp eax, dword [ebp - 8]
jb 0x10003c8b
jmp 0x10003cc8
mov ecx, dword [ecx + eax*8 + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [ecx + edx]
sub eax, dword [ebp - 0x18]
add eax, edx
mov dword [edi], eax
mov eax, dword [ecx + edx + 4]
mov ecx, dword [ebp + 0x10]
xor edi, edi
mov dword [ecx], eax
inc edi
test edi, edi
jne 0x10003cf4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
movzx eax, ax
cmp eax, ecx
jb 0x10003c59
test edi, edi
jne 0x10003cf4
mov ecx, dword [ebp - 0x1c]
inc ebx
movzx eax, bx
cmp eax, ecx
jb 0x10003c30
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret 0xc
Function at 0x10003d6c
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0x3c]
add ebx, esi
push 0x40
lea eax, [ebx + 0x18]
push 0x3000
push dword [eax + 0x38]
mov dword [ebp - 4], ecx
push 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x10003ed6
push 0x40
mov edx, esi
mov ecx, edi
call fcn.10006ae0
mov esi, dword [edi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, edi
push eax
mov edx, ebx
mov ecx, esi
call fcn.10006ae0
mov eax, dword [ebp - 8]
lea ebx, [esi + 0x18]
movzx ecx, word [eax + 0x14]
movzx esi, word [esi + 0x14]
lea edx, [eax + 0x18]
movzx eax, word [eax + 6]
add ecx, edx
add esi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x10003e34
mov ebx, ecx
sub ebx, esi
mov edi, eax
push 0x28
lea edx, [ebx + esi]
mov ecx, esi
call fcn.10006ae0
add esi, 0x28
dec edi
jne 0x10003df2
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x10003e34
lea esi, [ecx + 0x14]
mov ebx, eax
mov edx, dword [esi]
mov ecx, dword [esi - 8]
push dword [esi - 4]
add edx, dword [ebp + 8]
add ecx, edi
call fcn.10006ae0
lea esi, [esi + 0x28]
dec ebx
jne 0x10003e19
mov ebx, dword [ebp - 0xc]
push ebx
mov edx, edi
mov ecx, edi
call fcn.1000152d
push dword [ebp - 0x18]
mov ecx, dword [0x10008440]
mov edx, edi
call fcn.100015ce
mov edx, dword [ebx + 0x60]
test edx, edx
je 0x10003ed3
cmp dword [ebx + 0x64], 0
je 0x10003ed3
xor eax, eax
lea ecx, [edx + edi]
inc eax
sub eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 0x14]
jae 0x10003e7b
push eax
push ecx
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100014ff
mov ecx, eax
xor eax, eax
jmp 0x10003e7f
xor eax, eax
mov ecx, eax
mov edx, dword [ebp - 4]
push 2
mov dword [edx + 4], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x10003ea8
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100014ff
mov ecx, eax
xor eax, eax
jmp 0x10003eaa
mov ecx, eax
mov edx, dword [ebp - 4]
push 3
mov dword [edx + 8], ecx
mov edx, dword [ebx + 0x60]
pop ecx
lea esi, [edx + edi]
sub ecx, dword [esi + 0x10]
cmp ecx, dword [esi + 0x14]
jae 0x10003ecd
push ecx
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100014ff
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10003f1f
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0x3c]
add ebx, esi
push 0x40
lea eax, [ebx + 0x18]
push 0x3000
push dword [eax + 0x38]
mov dword [ebp - 0xc], ecx
push 0
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
je 0x1000405e
push 0x40
mov edx, esi
mov ecx, edi
call fcn.10006ae0
mov esi, dword [edi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, edi
push eax
mov edx, ebx
mov ecx, esi
call fcn.10006ae0
mov eax, dword [ebp - 4]
lea ebx, [esi + 0x18]
movzx ecx, word [eax + 0x14]
movzx esi, word [esi + 0x14]
lea edx, [eax + 0x18]
movzx eax, word [eax + 6]
add ecx, edx
add esi, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x10003fe7
mov ebx, ecx
sub ebx, esi
mov edi, eax
push 0x28
lea edx, [ebx + esi]
mov ecx, esi
call fcn.10006ae0
add esi, 0x28
dec edi
jne 0x10003fa5
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x10003fe7
lea esi, [ecx + 0x14]
mov ebx, eax
mov edx, dword [esi]
mov ecx, dword [esi - 8]
push dword [esi - 4]
add edx, dword [ebp + 8]
add ecx, edi
call fcn.10006ae0
lea esi, [esi + 0x28]
dec ebx
jne 0x10003fcc
mov ebx, dword [ebp - 8]
push ebx
mov edx, edi
mov ecx, edi
call fcn.1000152d
push dword [ebp - 0x18]
mov ecx, dword [0x10008440]
mov edx, edi
call fcn.100015ce
mov edx, dword [ebx + 0x60]
test edx, edx
je 0x1000405b
cmp dword [ebx + 0x64], 0
je 0x1000405b
xor eax, eax
lea ecx, [edx + edi]
inc eax
sub eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 0x14]
jae 0x1000402c
push eax
push ecx
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100014ff
xor ecx, ecx
jmp 0x10004030
xor ecx, ecx
mov eax, ecx
mov edx, dword [ebp - 0xc]
push 2
mov dword [edx + 4], eax
mov edx, dword [ebx + 0x60]
pop eax
lea esi, [edx + edi]
sub eax, dword [esi + 0x10]
cmp eax, dword [esi + 0x14]
jae 0x10004055
push eax
push esi
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100014ff
mov ecx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], ecx
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8