joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479a7a
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push eax
mov dword [ebp - 0x2c], eax
call fcn.004355f2
mov ebx, eax
test ebx, ebx
jne 0x479b4b
push esi
push edi
push 0x61
call fcn.004355f2
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, eax
sub edi, esi
neg edi
sbb edi, edi
and edi, esi
je 0x479ac8
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push 0x20
call fcn.004355f2
push 0x21
mov esi, eax
call fcn.004355f2
push 3
mov dword [ebp - 0x24], eax
call fcn.004355f2
push dword [ebp + 8]
mov dword [ebp - 0x20], eax
call fcn.0047afa2
push 0x42
mov dword [ebp - 0x28], eax
call fcn.004355f2
mov ecx, eax
test esi, esi
je 0x479b3c
cmp dword [ebp - 0x24], 0
je 0x479b3c
cmp dword [ebp - 0x20], 0
je 0x479b3c
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x479b3c
cmp eax, ecx
jae 0x479b3c
push eax
call fcn.0047af20
mov esi, eax
test esi, esi
je 0x479b3c
cmp esi, dword [ebp - 0x24]
jae 0x479b3c
push esi
push dword [ebp + 0xc]
call fcn.004356b2
mov ebx, dword [ebp - 0x20]
add ebx, esi
push ebx
push dword [ebp - 0x2c]
call fcn.004356b2
test edi, edi
pop edi
pop esi
je 0x479b4b
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47a414
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor eax, eax
push edi
mov dword [ebp - 0x2c], eax
call fcn.00479046
push 0x19
mov bl, al
call fcn.00477546
push 0xe
mov byte [ebp - 0x24], al
call fcn.00477546
mov byte [ebp - 0x20], al
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push dword [ebp - 0x20]
push 0xe
call fcn.0047769a
push dword [ebp - 0x24]
push 0x19
call fcn.0047769a
xor eax, eax
lea ecx, [ebp - 0x28]
push eax
push ecx
push eax
mov eax, dword [sym.imp.ntoskrnl.exe_MmSectionObjectType]
push dword [eax]
push 0x80000000
push esi
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
push 0x19
mov esi, eax
call fcn.00477546
push 0xf
mov byte [ebp - 0x24], al
call fcn.00477546
mov byte [ebp - 0x20], al
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push dword [ebp - 0x20]
push 0xf
call fcn.0047769a
push dword [ebp - 0x24]
push 0x19
call fcn.0047769a
cmp bl, 1
jne 0x47a4d1
push edi
call fcn.004790ec
pop edi
test esi, esi
pop esi
pop ebx
jne 0x47a4f2
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x28]
call fcn.0047a506
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 0x2c], al
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47a634
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], 0x44005c
and dword [ebp - 8], ebx
push 0x4b47
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], 0x690072
mov dword [ebp - 0x18], 0x650076
mov dword [ebp - 0x14], 0x5c0072
mov dword [ebp - 0x10], 0x690044
mov dword [ebp - 0xc], 0x6b0073
call fcn.004355f2
push 0x4a8a
mov dword [ebp - 0x34], eax
call fcn.004355f2
push 0x4b44
mov esi, eax
call fcn.004355f2
push 0x4b4a
mov edi, eax
call fcn.004355f2
push 0x4b4d
mov dword [ebp - 0x28], eax
call fcn.004355f2
mov ecx, eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
test eax, eax
je 0x47a80e
test esi, esi
je 0x47a80e
test edi, edi
je 0x47a80e
cmp dword [ebp - 0x28], ebx
je 0x47a80e
test ecx, ecx
je 0x47a80e
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x40]
push ecx
call eax
lea eax, [ebp - 0x30]
push eax
xor eax, eax
push eax
push eax
push dword [esi]
push eax
push eax
push 0x40
lea eax, [ebp - 0x40]
push eax
call edi
test eax, eax
jne 0x47a80e
mov ecx, dword [ebp - 0x30]
mov esi, dword [ecx + 4]
test esi, esi
je 0x47a80b
cmp dword [esi + 0x2c], 7
jne 0x47a7fd
test dword [esi + 0x1c], 0x40
je 0x47a7fd
xor ecx, ecx
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push esi
mov dword [ebp - 0x24], ecx
call dword [ebp - 0x28]
cmp eax, 0xc0000004
jne 0x47a7fd
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x47a7fd
lea edi, [eax + 0x100]
push edi
push 0
call fcn.00478d6e
mov ebx, eax
test ebx, ebx
je 0x47a7fa
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push ebx
push esi
call dword [ebp - 0x28]
test eax, eax
jne 0x47a7eb
mov edx, dword [ebx + 4]
lea eax, [ebx + 8]
cmp edx, eax
jne 0x47a7eb
movzx ecx, word [ebx]
lea eax, [ecx + 8]
cmp eax, edi
jae 0x47a7eb
shr ecx, 1
xor eax, eax
push 0x5c
mov word [edx + ecx*2], ax
push dword [ebx + 4]
call fcn.0047d940
mov edi, eax
test edi, edi
je 0x47a7eb
add edi, 2
push edi
call fcn.0047d80c
cmp eax, 3
jne 0x47a7eb
movzx eax, word [edi]
push 0x44
pop ecx
cmp cx, ax
je 0x47a7cb
push 0x64
pop ecx
cmp cx, ax
jne 0x47a7eb
movzx eax, word [edi + 2]
push 0x52
pop ecx
cmp cx, ax
je 0x47a7df
push 0x72
pop ecx
cmp cx, ax
jne 0x47a7eb
push 0x30
pop eax
cmp ax, word [edi + 4]
jne 0x47a7eb
mov dword [ebp - 0x2c], esi
push ebx
call fcn.00478d8c
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
jne 0x47a808
jmp 0x47a7fd
mov ebx, dword [ebp - 0x2c]
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x47a71a
mov ecx, dword [ebp - 0x30]
call dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x47aa9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
push esi
movzx esi, word [eax]
cmp esi, 0x47ba
jb 0x47ab32
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x740052
push eax
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x1c], 0x47006c
push eax
mov dword [ebp - 0x18], 0x740065
mov dword [ebp - 0x14], 0x650056
mov dword [ebp - 0x10], 0x730072
mov dword [ebp - 0xc], 0x6f0069
mov dword [ebp - 8], 0x6e
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test eax, eax
je 0x47ab32
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x134], 0x114
push ecx
call eax
test eax, eax
js 0x47ab32
mov esi, dword [ebp - 0x128]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x47ecb6
Capabilities:
Attach user process memory

Disassembly:
push 0x7c
push 0x48d630
call fcn.004011b4
mov esi, dword [ebp + 8]
mov dword [ebp - 0x7c], esi
push 0x4ccd
call fcn.004355f2
mov dword [ebp - 0x68], eax
push 0x4b08
call fcn.004355f2
mov ebx, eax
mov dword [ebp - 0x6c], ebx
push 0x4b0e
call fcn.004355f2
mov dword [ebp - 0x84], eax
push 0x4b0b
call fcn.004355f2
mov dword [ebp - 0x80], eax
push 0x27
call fcn.004355f2
mov edi, eax
push 0x4b05
call fcn.004355f2
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x68], 0
je 0x47eedb
test ebx, ebx
je 0x47eedb
cmp dword [ebp - 0x84], 0
je 0x47eedb
cmp dword [ebp - 0x80], 0
je 0x47eedb
cmp edi, 0xffffffff
je 0x47eedb
test eax, eax
je 0x47eedb
push 0
push esi
call fcn.0044eb80
cmp al, 1
jne 0x47eedb
push 0x2c
push 0
lea eax, [ebp - 0x48]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
call dword [sym.imp.ntoskrnl.exe_KeGetCurrentThread]
mov esi, eax
push 7
call fcn.00477546
mov byte [ebp - 0x70], al
mov bl, byte [esi + edi]
xor ecx, ecx
mov byte [esi + edi], cl
push ecx
push 0x2c
lea eax, [ebp - 0x48]
push eax
push ecx
call dword [ebp - 0x6c]
mov byte [esi + edi], bl
push dword [ebp - 0x70]
push 7
call fcn.0047769a
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x34]
jbe 0x47edb4
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x40]
imul ecx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x6c], edx
mov esi, dword [ebp - 0x7c]
push esi
call fcn.00479046
mov byte [ebp - 0x61], al
mov ebx, 0x1000
mov dword [ebp - 0x78], ebx
mov eax, dword [ebp - 0x68]
mov edi, dword [eax]
mov dword [ebp - 0x74], edi
push 0x19
call fcn.00477546
mov byte [ebp - 0x68], al
push 0xe
call fcn.00477546
mov byte [ebp - 0x70], al
lea eax, [ebp - 0x60]
push eax
push esi
call sub.ntoskrnl.exe_KeStackAttachProcess
push dword [ebp - 0x70]
push 0xe
call fcn.0047769a
push dword [ebp - 0x68]
push 0x19
call fcn.0047769a
and dword [ebp - 4], 0
cmp ebx, edi
jae 0x47ee95
push ebx
call dword [ebp - 0x84]
mov edi, eax
mov esi, edx
test edi, edi
jne 0x47ee2b
test esi, esi
je 0x47ee80
cmp esi, dword [ebp - 0x6c]
jg 0x47ee80
jl 0x47ee3a
cmp edi, dword [ebp - 0x88]
jae 0x47ee80
push esi
push edi
push dword [ebp - 0x8c]
call fcn.00479478
cmp al, 1
jne 0x47ee80
push esi
push edi
call dword [ebp - 0x80]
cmp ebx, eax
jne 0x47ee80
push eax
push ebx
cli
mov eax, cr0
mov ebx, eax
and eax, 0xfffeffff
mov cr0, eax
push ecx
push edi
mov edi, dword [ebp - 0x78]
mov ecx, 0x400
mov eax, 0xcccccccc
repne stosd dword es:[edi], eax
pop edi
pop ecx
mov cr0, ebx
sti
pop ebx
pop eax
mov ebx, dword [ebp - 0x78]
add ebx, 0x1000
mov dword [ebp - 0x78], ebx
mov edi, dword [ebp - 0x74]
jmp 0x47ee14
mov dword [ebp - 4], 0xfffffffe
push 0x19
call fcn.00477546
mov byte [ebp - 0x68], al
push 0xf
call fcn.00477546
mov byte [ebp - 0x74], al
lea eax, [ebp - 0x60]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push dword [ebp - 0x74]
push 0xf
call fcn.0047769a
push dword [ebp - 0x68]
push 0x19
call fcn.0047769a
cmp byte [ebp - 0x61], 1
jne 0x47eedb
push dword [ebp - 0x7c]
call fcn.004790ec
call fcn.004011fc
ret 4
Function at 0x47efe4
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x914
call fcn.004355f2
cmp eax, 0x3839
je 0x47f17e
push ebx
push esi
push edi
push 0x61
call fcn.004355f2
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, eax
sub edi, esi
neg edi
sbb edi, edi
and edi, esi
je 0x47f031
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push 0x4af5
call fcn.004355f2
push 0x20
mov esi, eax
call fcn.004355f2
push 0x21
mov dword [ebp - 0x28], eax
call fcn.004355f2
push 0x22
mov ebx, eax
call fcn.004355f2
push 3
mov dword [ebp - 0x20], eax
call fcn.004355f2
push 2
mov dword [ebp - 0x24], eax
call fcn.004355f2
mov dword [ebp - 0x2c], eax
test esi, esi
je 0x47f16e
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x47f16e
test ebx, ebx
je 0x47f16e
cmp dword [ebp - 0x20], 0
je 0x47f16e
cmp dword [ebp - 0x24], 0
je 0x47f16e
test eax, eax
je 0x47f16e
cmp esi, eax
jae 0x47f16e
cmp esi, ebx
jae 0x47f16e
lea eax, [ebx + ecx]
add esi, ecx
mov dword [ebp - 0x20], eax
xor ebx, ebx
lea ecx, [ebp - 0x50]
push ecx
push eax
push esi
call fcn.0041d7e6
test al, al
je 0x47f16e
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0x10b3
je 0x47f16e
add esi, dword [ebp - 0x38]
push 0x914
call fcn.004355f2
cmp eax, 0x2580
je 0x47f100
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0x107c
je 0x47f11c
push 0x914
call fcn.004355f2
cmp eax, 0x2580
jne 0x47f148
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0x107e
jne 0x47f148
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x20]
push esi
call fcn.0041d7e6
cmp al, 1
jne 0x47f148
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0x10cd
jne 0x47f148
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x38]
add eax, esi
cmp eax, dword [ebp - 0x2c]
jb 0x47f156
inc ebx
cmp ebx, 0x64
jae 0x47f16e
mov eax, dword [ebp - 0x20]
jmp 0x47f0bf
mov esi, dword [ebp - 0x24]
add esi, eax
push esi
push 0x23f
call fcn.004356b2
push esi
push 0x61
call fcn.0047700e
test edi, edi
pop edi
pop esi
pop ebx
je 0x47f17e
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x47f5ba
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x26
call fcn.004355f2
cmp eax, 1
je 0x47f739
push ebx
push esi
push edi
push 0x61
call fcn.004355f2
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, eax
sub edi, esi
neg edi
sbb edi, edi
and edi, esi
je 0x47f602
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push 0x63
call fcn.004355f2
push 0x20
mov esi, eax
call fcn.004355f2
push 0x21
mov dword [ebp - 0x24], eax
call fcn.004355f2
push 0x22
mov dword [ebp - 0x2c], eax
call fcn.004355f2
push 3
mov dword [ebp - 0x20], eax
call fcn.004355f2
push 2
mov ebx, eax
call fcn.004355f2
test esi, esi
je 0x47f729
cmp dword [ebp - 0x24], 0
je 0x47f729
mov edx, dword [ebp - 0x2c]
test edx, edx
je 0x47f729
cmp dword [ebp - 0x20], 0
je 0x47f729
test ebx, ebx
je 0x47f729
test eax, eax
je 0x47f729
or ecx, 0xffffffff
cmp esi, ebx
jbe 0x47f67b
mov ecx, esi
sub ecx, ebx
cmp ecx, edx
jae 0x47f729
lea eax, [ecx + ebx]
cmp esi, eax
jne 0x47f729
mov eax, dword [ebp - 0x24]
lea esi, [ecx + eax]
add eax, edx
and dword [ebp - 0x20], 0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x50]
push ecx
push eax
push esi
call fcn.0041d7e6
test al, al
je 0x47f729
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0x1009
jne 0x47f6bd
cmp byte [ebp - 0x4c], 1
je 0x47f6d1
mov eax, dword [ebp - 0x20]
add esi, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x64
jae 0x47f729
mov eax, dword [ebp - 0x28]
jmp 0x47f69d
add esi, dword [ebp - 0x38]
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x28]
push esi
call fcn.0041d7e6
cmp al, 1
jne 0x47f729
add esi, dword [ebp - 0x38]
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x28]
push esi
call fcn.0041d7e6
cmp al, 1
jne 0x47f729
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0x10cd
jne 0x47f729
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x38]
add eax, esi
je 0x47f729
cmp eax, dword [ebp - 0x2c]
jae 0x47f729
lea esi, [eax + ebx]
push esi
push 0x64
call fcn.004356b2
push esi
push 0x37
call fcn.0047700e
test edi, edi
pop edi
pop esi
pop ebx
je 0x47f739
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x47f846
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x61
xor ebx, ebx
call fcn.004355f2
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, eax
sub edi, esi
neg edi
sbb edi, edi
and edi, esi
je 0x47f880
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push 0x20
call fcn.004355f2
push 0x21
mov esi, eax
call fcn.004355f2
push 3
mov dword [ebp - 0x24], eax
call fcn.004355f2
push 0x4af8
mov dword [ebp - 0x20], eax
call fcn.0047afa2
push 0x42
mov dword [ebp - 0x28], eax
call fcn.004355f2
mov ecx, eax
test esi, esi
je 0x47f900
cmp dword [ebp - 0x24], ebx
je 0x47f900
cmp dword [ebp - 0x20], ebx
je 0x47f900
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x47f900
cmp eax, ecx
jae 0x47f900
push eax
call fcn.0047af20
mov esi, eax
test esi, esi
je 0x47f900
cmp esi, dword [ebp - 0x24]
jae 0x47f900
push esi
push 0x234
call fcn.004356b2
mov ebx, dword [ebp - 0x20]
add ebx, esi
push ebx
push 0x186
call fcn.004356b2
push ebx
push 0x32
call fcn.0047700e
test edi, edi
je 0x47f90d
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret

Function at 0x47f920
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x61
xor ebx, ebx
call fcn.004355f2
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, eax
sub edi, esi
neg edi
sbb edi, edi
and edi, esi
je 0x47f95a
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push 0x20
call fcn.004355f2
push 0x21
mov esi, eax
call fcn.004355f2
push 3
mov dword [ebp - 0x24], eax
call fcn.004355f2
push 0x42
mov dword [ebp - 0x20], eax
call fcn.004355f2
push 0x235
mov dword [ebp - 0x28], eax
call fcn.004355f2
test esi, esi
je 0x47f9d6
cmp dword [ebp - 0x24], ebx
je 0x47f9d6
cmp dword [ebp - 0x20], ebx
je 0x47f9d6
test eax, eax
je 0x47f9d6
cmp eax, dword [ebp - 0x28]
jae 0x47f9d6
push eax
call fcn.0047af20
mov esi, eax
test esi, esi
je 0x47f9d6
cmp esi, dword [ebp - 0x24]
jae 0x47f9d6
push esi
push 0x236
call fcn.004356b2
mov ebx, dword [ebp - 0x20]
add ebx, esi
push ebx
push 0x237
call fcn.004356b2
push ebx
push 0x52
call fcn.0047700e
test edi, edi
je 0x47f9e3
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x480a74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
push 0x10
pop ebx
push ecx
mov edi, ebx
call fcn.0047d80c
mov edx, eax
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], edx
test edx, edx
je 0x480aa9
mov ebx, esi
movzx ecx, word [eax + ebx*2]
add edi, ecx
xor edi, ecx
inc ebx
cmp ebx, edx
jb 0x480a99
push 0x10
pop ebx
mov ecx, esi
test edx, edx
je 0x480ab2
movzx ecx, byte [eax]
shl edi, 0xe
or edi, ecx
shl edi, 2
push edi
push 0x1e0
call fcn.004356b2
mov eax, dword [ebp - 4]
lea edx, [eax + eax]
test edx, edx
je 0x480aec
mov ecx, dword [ebp + 8]
mov al, byte [esi + ecx]
test al, al
jne 0x480ae5
mov al, bl
shr bl, 4
shl al, 4
add bl, al
jmp 0x480ae7
xor bl, al
inc esi
cmp esi, edx
jb 0x480ad2
movzx eax, bl
push eax
push 0x1e1
call fcn.004356b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x480b04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1e1
call fcn.004355f2
mov esi, dword [ebp + 8]
xor edx, edx
mov cl, byte [edx + esi]
xor cl, al
not cl
mov byte [edx + esi], cl
inc edx
cmp edx, 0x20
jb 0x480b17
pop esi
pop ebp
ret 4
Function at 0x483834
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 0x4b8f
mov dword [ebp - 0x38], esi
mov edi, dword [esi + 4]
call fcn.004355f2
push 0x4af0
mov dword [ebp - 0x28], eax
call fcn.004355f2
push 0x4b14
mov dword [ebp - 0x3c], eax
call fcn.004355f2
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x3c], ebx
je 0x4839fc
test eax, eax
je 0x4839fc
push ebx
push edi
call fcn.0044eb80
cmp al, 1
jne 0x4839fc
mov esi, dword [esi + 8]
push 0x914
mov dword [ebp - 0x34], esi
call fcn.004355f2
cmp eax, 0x1db0
jb 0x4838c4
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4838c4
cmp dword [eax], edi
jne 0x4838c4
or esi, 0x80000000
mov dword [ebp - 0x34], esi
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp eax, edi
setne al
mov byte [ebp - 0x1d], al
cmp al, 1
jne 0x483913
push edi
call fcn.00479046
push 0x19
mov byte [ebp - 0x1e], al
call fcn.00477546
push 0xe
mov byte [ebp - 0x28], al
call fcn.00477546
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push dword [ebp - 0x2c]
push 0xe
call fcn.0047769a
push dword [ebp - 0x28]
push 0x19
call fcn.0047769a
jmp 0x483919
mov al, byte [ebp - 0x1d]
mov byte [ebp - 0x1e], al
push edi
call fcn.00479022
cmp al, 1
jne 0x4839b9
push 2
call fcn.00477546
push ebx
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0x40]
push eax
push ebx
push ebx
push 0x80000000
push esi
call dword [ebp - 0x3c]
push dword [ebp - 0x2c]
mov esi, eax
push 2
call fcn.0047769a
test esi, esi
js 0x4839b3
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
cmp eax, dword [ecx + 0xc]
jne 0x4839aa
mov esi, dword [ebp - 0x34]
lea eax, [ebp - 0x24]
push ebx
push 2
push eax
push 4
push esi
call dword [ebp - 0x30]
test eax, eax
js 0x4839aa
mov eax, dword [ebp - 0x38]
cmp byte [eax + 0x10], bl
jne 0x48397f
cmp byte [ebp - 0x23], bl
jne 0x4839aa
jmp 0x4839a1
cmp byte [ebp - 0x23], 1
jne 0x4839a1
push 0x4b17
call fcn.004355f2
test eax, eax
je 0x4839a1
push 2
lea ecx, [ebp - 0x24]
mov byte [ebp - 0x23], bl
push ecx
push 4
push esi
call eax
push esi
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov bl, 1
mov ecx, dword [ebp - 0x40]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push edi
call fcn.00478e94
cmp byte [ebp - 0x1d], 1
jne 0x4839fc
push 0x19
call fcn.00477546
push 0xf
mov byte [ebp - 0x28], al
call fcn.00477546
mov byte [ebp - 0x30], al
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push dword [ebp - 0x30]
push 0xf
call fcn.0047769a
push dword [ebp - 0x28]
push 0x19
call fcn.0047769a
cmp byte [ebp - 0x1e], 1
jne 0x4839fc
push edi
call fcn.004790ec
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 4
Function at 0x483f2c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4b47
call fcn.004355f2
mov esi, eax
push 0x4b1d
mov dword [ebp - 0x88], esi
call fcn.004355f2
push 0x4c5e
mov edi, eax
call fcn.004355f2
mov ebx, eax
mov dword [ebp - 0x8c], ebx
test esi, esi
je 0x484153
test edi, edi
je 0x484153
test ebx, ebx
je 0x484153
mov eax, 0x740066
mov dword [ebp - 0x84], 0x52005c
mov dword [ebp - 0x5c], eax
mov ecx, 0x6e0069
mov dword [ebp - 0x40], eax
xor esi, esi
lea eax, [ebp - 0x84]
mov dword [ebp - 0x80], 0x670065
push eax
lea eax, [ebp - 0xb4]
mov dword [ebp - 0x7c], 0x730069
push eax
mov dword [ebp - 0x78], 0x720074
mov dword [ebp - 0x74], 0x5c0079
mov dword [ebp - 0x70], 0x61004d
mov dword [ebp - 0x6c], 0x680063
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], 0x5c0065
mov dword [ebp - 0x60], 0x6f0053
mov dword [ebp - 0x58], 0x610077
mov dword [ebp - 0x54], 0x650072
mov dword [ebp - 0x50], 0x4d005c
mov dword [ebp - 0x4c], 0x630069
mov dword [ebp - 0x48], 0x6f0072
mov dword [ebp - 0x44], 0x6f0073
mov dword [ebp - 0x3c], 0x57005c
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], 0x6f0064
mov dword [ebp - 0x30], 0x730077
mov dword [ebp - 0x2c], 0x4e0020
mov dword [ebp - 0x28], 0x5c0054
mov dword [ebp - 0x24], 0x750043
mov dword [ebp - 0x20], 0x720072
mov dword [ebp - 0x1c], 0x6e0065
mov dword [ebp - 0x18], 0x560074
mov dword [ebp - 0x14], 0x720065
mov dword [ebp - 0x10], 0x690073
mov dword [ebp - 0xc], 0x6e006f
mov dword [ebp - 8], esi
call dword [ebp - 0x88]
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xac], 0x18
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0xac]
push eax
push 0x20019
lea eax, [ebp - 0x90]
mov dword [ebp - 0xa8], esi
push eax
mov dword [ebp - 0xa0], 0x240
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], esi
call edi
test eax, eax
js 0x484153
push 0x10
call fcn.0047afee
mov edi, eax
test edi, edi
je 0x48414b
mov eax, dword [edi]
push 0x878
mov dword [ebp - 0x88], eax
call fcn.004355f2
mov edx, eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x94], edx
test eax, eax
je 0x484145
lea ebx, [edi + 4]
mov cx, word [ebx + 6]
cmp cx, word [ebp - 0x90]
jne 0x484123
movzx eax, word [ebx]
push edx
push eax
call fcn.0047b25e
cmp al, 1
je 0x48412d
mov eax, dword [ebp - 0x88]
mov edx, dword [ebp - 0x94]
inc esi
add ebx, 0x10
cmp esi, eax
jb 0x4840fc
jmp 0x48413f
add esi, esi
movzx eax, byte [edi + esi*8 + 8]
push eax
push 0x316
call fcn.004356b2
mov ebx, dword [ebp - 0x8c]
push edi
call fcn.00478d8c
push dword [ebp - 0x90]
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret