joyce8/EMBER2024-capa huggingface dataset:
Function at 0x539744
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 4], edx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x53989c
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 1
push 0
push 0
call sub.wtsapi32.dll_WTSEnumerateProcessesA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x53979c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5398e2
cmp dword [ebp - 0x24], 0
jne 0x5397af
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5398e2
imul eax, dword [ebp - 0x24], 0x19c
add eax, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.00402784
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00407a78
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov dword [eax], edx
mov eax, dword [ebp - 0x24]
dec eax
test eax, eax
jb 0x539884
inc eax
mov dword [ebp - 0x2c], eax
xor edi, edi
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x14]
add ebx, 4
imul edx, edi, 0x19c
add ebx, edx
mov edx, dword [eax + 4]
mov dword [ebx], edx
mov dword [ebp - 0x18], 0x38
mov dword [ebp - 0x1c], 0x38
lea edx, [ebp - 0x28]
push edx
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebx + 0x164]
push edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebx + 0x12c]
push edx
mov eax, dword [eax + 0xc]
push eax
push 0
call sub.advapi32.dll_LookupAccountSidA
mov eax, dword [ebx]
push eax
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x53987a
push 0x28
lea ecx, [ebx + 4]
xor edx, edx
mov eax, esi
call fcn.00528c38
push pe_nt_image_headers32
lea ecx, [ebx + 0x2c]
xor edx, edx
mov eax, esi
call fcn.00528c7c
push esi
call sub.kernel32.dll_CloseHandle_1
inc edi
dec dword [ebp - 0x2c]
jne 0x5397f2
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5398e2
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5457f4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x545848
push dword fs:[eax]
mov dword fs:[eax], esp
push edx
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
jne 0x54582d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x545880
push 1
push ebx
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 4], eax
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x545880
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x54f258
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
cmp dword [0x577600], 0
je 0x54f31c
xor eax, eax
push ebp
push 0x54f2e6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [0x577600]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
mov dword [0x577600], eax
mov eax, dword [0x577504]
mov eax, dword [eax + 0xc63]
push eax
mov eax, dword [0x577504]
lea ecx, [eax + 0x470]
mov edx, 0x40a
mov eax, dword [0x577504]
call fcn.00567f04
mov eax, dword [0x577504]
mov eax, dword [eax + 0xc63]
push eax
mov eax, dword [0x577504]
lea ecx, [eax + 0x478]
mov edx, 0x40b
mov eax, dword [0x577504]
call fcn.00567f04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54f31c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x54f35c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, 0x5775fc
xor eax, eax
push ebp
push 0x54f3ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x577504]
call fcn.0054f258
cmp dword [ebx], 0
jbe 0x54f39f
push 0
mov eax, dword [ebx]
mov eax, dword [eax*4 + 0x5775cc]
push eax
call sub.kernel32.dll_TerminateThread
dec dword [ebx]
cmp dword [ebx], 0
ja 0x54f387
call sub.xantiarp.dll_StopProtect
xor edx, edx
mov eax, dword [0x577504]
call fcn.0055d128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54f3f0
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x55f2d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x55f487
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x55f436
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x577504]
cmp dword [eax + 0xe5f], 1
sbb eax, eax
inc eax
test al, al
jne 0x55f31d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55f46c
call sub.xantiarp.dll_GetSwitchAttackCount
test eax, eax
jne 0x55f340
mov eax, dword [0x577504]
xor edx, edx
mov dword [eax + 0x9df], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55f46c
mov eax, dword [0x577504]
mov dword [eax + 0x9df], 0xffffffff
call sub.kernel32.dll_GetTickCount
mov edx, dword [0x577504]
sub eax, dword [edx + 0xeab]
mov edx, dword [0x577504]
cmp eax, dword [edx + 0x9db]
jae 0x55f37b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55f46c
call sub.kernel32.dll_GetTickCount
mov edx, dword [0x577504]
mov dword [edx + 0xeab], eax
lea eax, [ebp - 4]
call fcn.00404794
mov eax, dword [0x577504]
mov eax, dword [eax + 0x99d]
mov ebx, dword [eax]
test ebx, ebx
je 0x55f3dc
cmp dword [ebx + 0x38], 0
je 0x55f3d5
push dword [ebp - 4]
push 0x55f4a0
lea eax, [ebp - 8]
push eax
mov edx, ebx
xor ecx, ecx
mov eax, dword [0x577504]
call fcn.00556e44
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404b14
mov ebx, dword [ebx + 0x2c]
test ebx, ebx
jne 0x55f3a5
push 0x1388
call sub.kernel32.dll_Sleep_1
cmp dword [ebp - 4], 0
jne 0x55f406
mov eax, dword [0x577504]
mov edx, dword [eax + 0xd1f]
or ecx, 0xffffffff
mov eax, dword [0x577504]
call fcn.0056a150
jmp 0x55f42c
mov eax, dword [0x577504]
mov edx, dword [eax + 0xd1b]
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
call fcn.00404aa0
mov edx, dword [ebp - 0xc]
or ecx, 0xffffffff
mov eax, dword [0x577504]
call fcn.0056a150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x55f46c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f48e
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004047b8
ret
Function at 0x56ac94
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404c44
xor eax, eax
push ebp
push 0x56adc3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x56ad72
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x577504]
cmp dword [eax + 0xb7b], 0
jne 0x56ace4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56ada8
mov eax, dword [0x577504]
push dword [eax + 0xb7b]
push 0x56addc
push dword [ebp - 4]
push 0x56ade8
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404b14
push 0
mov eax, dword [ebp - 8]
call fcn.00404c54
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
jbe 0x56ad3e
push 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea ecx, [ebp - 0x10]
mov edx, 0x56adf4
mov eax, dword [0x577504]
call fcn.00554bfc
jmp 0x56ad68
push 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea ecx, [ebp - 0x20]
mov edx, 0x56ae28
mov eax, dword [0x577504]
call fcn.00554bfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x56ada8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56adca
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047b8
ret
Function at 0x100020c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1138
call fcn.10014220
push ebx
push esi
push edi
lea edi, [ebp - 0x1138]
mov ecx, 0x44e
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1001f140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1001f190], 0
je 0x100020fc
xor eax, eax
jmp 0x10002285
mov dword [0x1001f190], 1
mov esi, esp
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, esp
call fcn.10014010
mov dword [ebp - 0x24], eax
mov esi, esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp esi, esp
call fcn.10014010
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
mov ax, word [0x1001b5a0]
mov word [ebp - 0x1044], ax
push 0xffe
push 0
lea eax, [ebp - 0x1042]
push eax
call sub.MSVCR100D.dll_memset
add esp, 0xc
mov dword [ebp - 0x1050], 0
mov dword [ebp - 0x105c], 0x28
mov esi, esp
push 0
lea eax, [ebp - 0x1044]
push eax
push 0x800
push str._Settings.ini
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp esi, esp
call fcn.10014010
test eax, eax
je 0x10002211
mov esi, esp
lea eax, [ebp - 0x1044]
push eax
push 0x28
push 0x1001b57c
push str.Screen
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp esi, esp
call fcn.10014010
mov dword [ebp - 0x105c], eax
mov esi, esp
lea eax, [ebp - 0x1044]
push eax
push 0
push str.FullScreen
push str.Screen
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp esi, esp
call fcn.10014010
mov dword [ebp - 0x1050], eax
cmp dword [ebp - 0x105c], 0x384
jle 0x100021fe
mov dword [ebp - 0x105c], 0x384
cmp dword [ebp - 0x105c], 0x28
jge 0x10002211
mov dword [ebp - 0x105c], 0x28
xor eax, eax
cmp dword [ebp - 0x1050], 0
setne al
mov dword [ebp - 0x1068], eax
cmp dword [ebp - 0x1068], 0
jne 0x1000223a
mov dword [ebp - 0x30], 0x400
mov dword [ebp - 0x3c], 0x300
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.10001020
add esp, 8
cmp dword [ebp - 0x1068], 0
je 0x10002263
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.10005ce0
add esp, 8
cmp dword [ebp - 0x105c], 0x28
jle 0x1000227b
mov eax, dword [ebp - 0x105c]
push eax
call fcn.10005da0
add esp, 4
call fcn.100059e0
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x100022b4]
call fcn.10014040
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10014000
add esp, 0x1138
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret
Function at 0x10002350
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10014010
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push section..data
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10014010
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x1001f008
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10014010
push 5
push section..data
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR100D.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x100023df
mov eax, 0xb
jmp 0x10002400
push 5
push 0x1001f008
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR100D.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x100023fd
mov eax, 5
jmp 0x10002400
mov eax, dword [ebp + 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x10002428]
call fcn.10014040
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret
Function at 0x10002450
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push ebx
push esi
push edi
lea edi, [ebp - 0xf8]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1001f140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10002350
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
call sub.MSVCR100D.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0xf4], eax
mov edx, dword [ebp - 0xf4]
mov dword [ebp - 0x18], edx
mov esi, esp
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
add edx, 5
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10014010
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.MSVCR100D.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov byte [edx + ecx], 0xe9
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x18]
add eax, dword [edx + 4]
push eax
call fcn.10002710
add esp, 8
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + edx + 1], eax
mov byte [ebp - 0x28], 0xe9
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10002710
add esp, 8
mov dword [ebp - 0x27], eax
push 5
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR100D.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
push edx
mov ecx, ebp
push eax
lea edx, [0x10002584]
call fcn.10014040
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10014000
add esp, 0xf8
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret

Function at 0x10002bd0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov dword [0x1001f340], 0xffffffff
mov esi, esp
push 0
push 0
push 0x10002860
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
cmp esi, esp
call fcn.10014010
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], eax
call fcn.10002a70
mov esi, esp
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp esi, esp
call fcn.10014010
mov esi, esp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.10014010
xor al, al
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret
Function at 0x100039c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
mov esi, esp
push 0
push 0
push 1
push 0x5d
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp esi, esp
call fcn.10014010
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret
Function at 0x100048e0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
lea edi, [ebp - 0x104]
mov ecx, 0x41
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1001f140]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10020c08], 0
jne 0x10004ac2
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x2c], 0xb8
mov byte [ebp - 0x2b], 0xa8
mov byte [ebp - 0x2a], 0x2b
mov byte [ebp - 0x29], 0x83
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x27], 0xe8
mov byte [ebp - 0x26], 0x3f
mov byte [ebp - 0x25], 0x5c
mov byte [ebp - 0x24], 9
mov byte [ebp - 0x23], 0
mov byte [ebp - 0x22], 0x51
push 0xb
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.10003350
add esp, 0xc
mov dword [0x10020bf8], eax
mov byte [ebp - 0x40], 0xb8
mov byte [ebp - 0x3f], 0xb4
mov byte [ebp - 0x3e], 0x2b
mov byte [ebp - 0x3d], 0x83
mov byte [ebp - 0x3c], 0
mov byte [ebp - 0x3b], 0xe8
mov byte [ebp - 0x3a], 0xc3
mov byte [ebp - 0x39], 0x59
mov byte [ebp - 0x38], 9
mov byte [ebp - 0x37], 0
mov byte [ebp - 0x36], 0x51
push 0xb
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x40]
push ecx
call fcn.10003350
add esp, 0xc
mov dword [0x10020c04], eax
mov dword [0x10020c08], 1
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push fcn.10004270
push 0x10020bf8
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x10004a2b
mov eax, dword [0x1001f068]
push eax
push str.SEND_MSG
call fcn.100053c0
add esp, 8
jmp 0x10004ac2
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push 0x10004700
push 0x10020c04
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x10004a72
mov eax, dword [0x1001f068]
push eax
push str.RECV_MSG
call fcn.100053c0
add esp, 8
jmp 0x10004ac2
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push 0x10004140
push 0x10020c28
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x10004ac2
push str.ReadMemory_didnt_attach_properly
call fcn.10005e10
add esp, 4
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
push edx
mov ecx, ebp
push eax
lea edx, [0x10004af4]
call fcn.10014040
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10014000
add esp, 0x104
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret
Function at 0x100053c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov dword [0x10020c00], 1
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0x1001f7d8
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 8
cmp esi, esp
call fcn.10014010
mov esi, esp
push 0
push 0
push 0
push 0x10004890
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.10014010
mov dword [ebp - 8], eax
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret

Function at 0x10005640
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1300
call fcn.10014220
push ebx
push esi
push edi
lea edi, [ebp - 0x1300]
mov ecx, 0x4c0
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1001f140]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, esp
call fcn.10014010
mov dword [ebp - 0x1014], eax
lea eax, [ebp - 0x1020]
push eax
push 0x1000
lea ecx, [ebp - 0x1008]
push ecx
mov edx, dword [ebp - 0x1014]
push edx
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x10005723
mov dword [ebp - 0x102c], 0
jmp 0x100056bf
mov eax, dword [ebp - 0x102c]
add eax, 1
mov dword [ebp - 0x102c], eax
mov eax, dword [ebp - 0x1020]
shr eax, 2
cmp dword [ebp - 0x102c], eax
jae 0x10005723
push 0x104
lea eax, [ebp - 0x123c]
push eax
mov ecx, dword [ebp - 0x102c]
mov edx, dword [ebp + ecx*4 - 0x1008]
push edx
mov eax, dword [ebp - 0x1014]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x10005721
push 0x1001b970
lea eax, [ebp - 0x123c]
push eax
call fcn.100057b0
add esp, 8
test eax, eax
je 0x10005721
push 0x1001b960
call fcn.100047e0
add esp, 4
jmp 0x10005739
jmp 0x100056b0
mov esi, esp
mov eax, dword [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.10014010
push edx
mov ecx, ebp
push eax
lea edx, [0x10005768]
call fcn.10014040
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10014000
add esp, 0x1300
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret
Function at 0x10005800
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push 0x10004f70
push 0x10020c20
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x10005873
push str.Debugger_didnt_attach_properly
call fcn.10005e10
add esp, 4
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
jmp 0x100059bf
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push 0x10005550
push 0x10020c1c
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x100058c8
push str.WriteMem_didnt_attach_properly
call fcn.10005e10
add esp, 4
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
jmp 0x100059bf
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push 0x10004b50
push 0x10020c24
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x1000591d
push str.Connect_didnt_attach_properly
call fcn.10005e10
add esp, 4
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
jmp 0x100059bf
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push 0x10004cc0
push 0x10020c14
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x1000596f
push 0x1001b998
call fcn.10005e10
add esp, 4
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
jmp 0x100059bf
call fcn.100179b0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp esi, esp
call fcn.10014010
push eax
call fcn.10017e80
push 0x10004d50
push 0x10020c2c
call fcn.100171e0
call fcn.10017a10
test eax, eax
je 0x100059bf
push 0x1001b97c
call fcn.10005e10
add esp, 4
mov esi, esp
push 0
call dword [sym.imp.MSVCR100D.dll_exit]
cmp esi, esp
call fcn.10014010
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.10014010
mov esp, ebp
pop ebp
ret