joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c416
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x64005c
push edi
mov edi, dword [ebp + 0xc]
mov ecx, 0x790073
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x58]
push 1
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x50], 0x53005c
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4c], 0x730079
push eax
mov dword [ebp - 0x48], 0x650074
mov dword [ebp - 0x44], 0x52006d
mov dword [ebp - 0x40], 0x6f006f
mov dword [ebp - 0x3c], 0x5c0074
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], 0x740073
mov dword [ebp - 0x30], 0x6d0065
mov dword [ebp - 0x2c], 0x320033
mov dword [ebp - 0x24], 0x690072
mov dword [ebp - 0x20], 0x650076
mov dword [ebp - 0x1c], 0x730072
mov dword [ebp - 0x14], 0x730069
mov dword [ebp - 0x10], 0x2e006b
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x73
call fcn.00439b16
test eax, eax
jne 0x40c4e3
push ebx
push edi
push esi
push dword [ebp - 0x58]
push dword [ebp - 0x54]
call fcn.00405020
cmp al, 1
jne 0x40c4db
mov bl, al
push dword [ebp - 0x54]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x41eb7c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x60
push 0x48b9c8
call fcn.004011b4
mov esi, dword [ebp + 8]
push 0x4b47
call fcn.004355f2
mov dword [ebp - 0x3c], eax
push 0x4b62
call fcn.004355f2
mov dword [ebp - 0x48], eax
push 0x4af0
call fcn.004355f2
mov edi, eax
push 0x4b4d
call fcn.004355f2
mov ebx, eax
mov dword [ebp - 0x4c], ebx
push 0x4c5e
call fcn.004355f2
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x41ecc9
cmp dword [ebp - 0x48], 0
je 0x41ecc9
test edi, edi
je 0x41ecc9
test ebx, ebx
je 0x41ecc9
test eax, eax
je 0x41ecc9
mov dword [ebp - 0x38], 0x4f005c
mov dword [ebp - 0x34], 0x6a0062
mov dword [ebp - 0x30], 0x630065
mov dword [ebp - 0x2c], 0x540074
mov dword [ebp - 0x28], 0x700079
mov dword [ebp - 0x24], 0x730065
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x70]
push eax
call ecx
mov dword [ebp - 0x68], 0x18
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x5c], 0x240
lea eax, [ebp - 0x70]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x68]
push eax
push 1
lea eax, [ebp - 0x40]
push eax
call dword [ebp - 0x48]
test eax, eax
js 0x41ecc9
push ebx
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
push 0xf000f
push dword [ebp - 0x40]
call edi
test eax, eax
js 0x41ecc3
push 0x80000
push 1
call fcn.00478d6e
mov edx, eax
mov dword [ebp - 0x3c], edx
test edx, edx
je 0x41ecbd
mov ecx, dword [ebp - 0x44]
mov dword [edx], ecx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push esi
push 0x20000
push edx
call fcn.0041ecd4
jmp 0x41ecae
mov dword [ebp - 4], 0xfffffffe
push dword [ebp - 0x3c]
call fcn.00478d8c
mov ecx, dword [ebp - 0x44]
call dword [ebp - 0x4c]
push dword [ebp - 0x40]
call dword [ebp - 0x50]
xor al, al
call fcn.004011fc
ret 8
Function at 0x42221e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x87e
mov dword [ebp - 0x2c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x4222aa
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x45746c46
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x656d756e
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x65746172
push edi
mov dword [ebp - 0x1c], 0x746c6946
mov dword [ebp - 0x18], 0x737265
call fcn.00404e08
cmp al, 1
jne 0x4222aa
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4222aa
cmp eax, dword [ebp + 0xc]
jae 0x4222aa
push eax
push 0x880
call fcn.004356b2
mov eax, dword [ebp - 0x2c]
add eax, esi
push eax
push 0x881
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x42238e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x87e
mov dword [ebp - 0x2c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x42241a
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x55746c46
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x6765726e
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x65747369
push edi
mov dword [ebp - 0x1c], 0x6c694672
mov dword [ebp - 0x18], 0x726574
call fcn.00404e08
cmp al, 1
jne 0x42241a
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x42241a
cmp eax, dword [ebp + 0xc]
jae 0x42241a
push eax
push 0x882
call fcn.004356b2
mov eax, dword [ebp - 0x2c]
add eax, esi
push eax
push 0x883
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x422fea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x46005c
mov dword [ebp - 0x28], 0x6c0069
mov dword [ebp - 0x24], 0x530065
mov dword [ebp - 0x20], 0x730079
mov dword [ebp - 0x1c], 0x650074
mov dword [ebp - 0x18], 0x5c006d
mov dword [ebp - 0x14], 0x6c0046
mov dword [ebp - 0x10], 0x4d0074
mov dword [ebp - 0xc], 0x720067
call fcn.0047a028
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret
Function at 0x423c08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x790073
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x5c]
push 1
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x53005c
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x50], 0x730079
push eax
mov dword [ebp - 0x4c], 0x650074
mov dword [ebp - 0x48], 0x52006d
mov dword [ebp - 0x44], 0x6f006f
mov dword [ebp - 0x40], 0x5c0074
mov dword [ebp - 0x38], 0x740073
mov dword [ebp - 0x34], 0x6d0065
mov dword [ebp - 0x30], 0x320033
mov dword [ebp - 0x2c], 0x64005c
mov dword [ebp - 0x28], 0x690072
mov dword [ebp - 0x24], 0x650076
mov dword [ebp - 0x20], 0x730072
mov dword [ebp - 0x1c], 0x66005c
mov dword [ebp - 0x18], 0x74006c
mov dword [ebp - 0x14], 0x67006d
mov dword [ebp - 0x10], 0x2e0072
mov dword [ebp - 8], 0x73
call fcn.00439b16
test eax, eax
jne 0x423cdf
push ebx
push edi
push esi
push dword [ebp - 0x5c]
push dword [ebp - 0x58]
call fcn.00405020
cmp al, 1
jne 0x423cd7
mov bl, al
push dword [ebp - 0x58]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x4284ba
Capabilities:
Attach user process memory

Disassembly:
push 0x34
push 0x48bcf0
call fcn.004011b4
mov edi, dword [ebp + 8]
mov dword [ebp - 0x40], edi
xor ebx, ebx
cmp byte [ebp + 0xc], bl
jne 0x4284dc
push 0x2b
call fcn.004355f2
jmp 0x4284df
or eax, 0xffffffff
cmp eax, 0xffffffff
je 0x42864d
lea esi, [edi + eax]
push esi
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x42864d
mov esi, dword [esi]
test esi, esi
je 0x42864d
push ebx
push edi
call fcn.0044eb80
cmp al, 1
jne 0x42864d
push edi
call fcn.00479046
mov byte [ebp - 0x36], al
push 0x19
call fcn.00477546
mov byte [ebp - 0x3a], al
push 0xe
call fcn.00477546
mov byte [ebp - 0x44], al
lea eax, [ebp - 0x34]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push dword [ebp - 0x44]
push 0xe
call fcn.0047769a
push dword [ebp - 0x3a]
push 0x19
call fcn.0047769a
mov dword [ebp - 4], ebx
mov eax, dword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov ecx, dword [eax]
cmp byte [ebp + 0xc], 0
jne 0x4285aa
cmp esi, ecx
jae 0x4285f1
lea eax, [esi + 0x30]
cmp eax, ecx
jae 0x4285f1
mov esi, dword [esi + 0xc]
cmp esi, ecx
jae 0x4285f1
lea eax, [esi + 0x28]
cmp eax, ecx
jae 0x4285f1
push dword [ebp + 0x10]
push ebx
lea eax, [esi + 0xc]
push eax
call fcn.00428658
push dword [ebp + 0x10]
push 8
lea eax, [esi + 0x14]
push eax
call fcn.00428658
lea eax, [esi + 0x1c]
push dword [ebp + 0x10]
push 0x10
push eax
call fcn.00428658
jmp 0x4285ec
cmp esi, ecx
jae 0x4285f1
lea eax, [esi + 0x30]
cmp eax, ecx
jae 0x4285f1
mov esi, dword [esi + 0xc]
cmp esi, ecx
jae 0x4285f1
lea eax, [esi + 0x28]
cmp eax, ecx
jae 0x4285f1
push dword [ebp + 0x10]
push ebx
lea eax, [esi + 0xc]
push eax
call fcn.00428658
push dword [ebp + 0x10]
push 8
lea eax, [esi + 0x14]
push eax
call fcn.00428658
lea eax, [esi + 0x1c]
push dword [ebp + 0x10]
push 0x10
push eax
call fcn.00428658
mov bl, 1
mov byte [ebp - 0x35], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x428610
push 0x19
call fcn.00477546
mov byte [ebp - 0x3a], al
push 0xf
call fcn.00477546
mov byte [ebp - 0x40], al
lea eax, [ebp - 0x34]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push dword [ebp - 0x40]
push 0xf
call fcn.0047769a
push dword [ebp - 0x3a]
push 0x19
call fcn.0047769a
cmp byte [ebp - 0x36], 1
jne 0x42864d
push edi
call fcn.004790ec
mov al, bl
call fcn.004011fc
ret 0xc
Function at 0x428bf2
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x61
xor ebx, ebx
call fcn.004355f2
mov edi, eax
test edi, edi
je 0x428c1d
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
push esi
push 0x20
call fcn.004355f2
push 0x21
mov esi, eax
call fcn.004355f2
push 3
mov dword [ebp - 0x24], eax
call fcn.004355f2
push 0x4b10
mov dword [ebp - 0x20], eax
call fcn.0047afa2
push 0x42
mov dword [ebp - 0x28], eax
call fcn.004355f2
mov ecx, eax
test esi, esi
je 0x428c8d
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x428c8d
cmp dword [ebp - 0x20], ebx
je 0x428c8d
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x428c8d
cmp eax, ecx
jae 0x428c8d
push eax
call fcn.0047af20
test eax, eax
je 0x428c8d
cmp eax, esi
jae 0x428c8d
mov ebx, dword [ebp - 0x20]
push eax
add ebx, eax
call fcn.004286cc
push ebx
push 0x38
call fcn.0047700e
pop esi
test edi, edi
je 0x428c9b
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret

Function at 0x428dbc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x46005c
push eax
mov dword [ebp - 0x28], 0x6c0069
mov dword [ebp - 0x24], 0x530065
mov dword [ebp - 0x20], 0x730079
mov dword [ebp - 0x1c], 0x650074
mov dword [ebp - 0x18], 0x5c006d
mov dword [ebp - 0x14], 0x410052
mov dword [ebp - 0x10], 0x57
call fcn.00428cae
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f30
mov esp, ebp
pop ebp
ret 0xc
Function at 0x429022
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], eax
xor al, al
cmp dword [ebp + 0xc], 1
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x50], edi
mov byte [ebp - 0x35], al
jle 0x429231
push ebx
push esi
mov esi, dword [edi]
or ebx, 0xffffffff
xor edi, edi
jmp 0x42921f
push 1
push esi
call fcn.0045afde
cmp al, 1
jne 0x42922c
cmp edi, 0x100000
jae 0x42922c
push 0x914
call fcn.004355f2
cmp eax, 0x1772
ja 0x42908e
mov eax, dword [esi - 0x10]
jmp 0x42909a
lea eax, [esi - 0x18]
push eax
call fcn.0047a84e
movzx eax, al
xor ecx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [esi + ecx*4]
xor edx, edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], edx
test eax, eax
je 0x4291fc
mov cl, byte [ebp - 0x35]
cmp edx, 0x10000
jae 0x4291f9
mov edi, dword [eax + 4]
test edi, edi
je 0x4291e3
push 0x914
call fcn.004355f2
cmp eax, 0x1772
ja 0x4290e8
mov eax, dword [ebp - 0x48]
cmp eax, dword [edi - 0x10]
jmp 0x4290f7
lea eax, [edi - 0x18]
push eax
call fcn.0047a84e
movzx eax, al
cmp dword [ebp - 0x48], eax
jne 0x429117
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp - 0x35]
dec eax
mov edx, dword [ebp - 0x40]
cmp ebx, eax
jge 0x4291e0
mov eax, dword [ebp - 0x50]
inc ebx
mov dword [eax + ebx*4], edi
jmp 0x4291e0
push edi
call fcn.00478e9a
cmp dword [ebp + 0x10], eax
jne 0x4291da
lea eax, [ebp - 0x54]
push eax
push edi
call fcn.00478ed6
cmp al, 1
jne 0x4291da
mov eax, dword [ebp - 0x54]
push 0x30
pop ecx
cmp cx, word [eax]
jne 0x4291da
mov ecx, dword [eax + 4]
mov eax, dword [sym.imp.ntoskrnl.exe_MmSystemRangeStart]
cmp ecx, dword [eax]
jbe 0x4291da
push 1
push ecx
call fcn.0045afde
cmp al, 1
jne 0x4291da
mov ecx, dword [ebp - 0x54]
mov eax, 0x330030
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0x430041
mov dword [ebp - 0x30], 0x490050
mov dword [ebp - 0x2c], 0x500023
mov dword [ebp - 0x28], 0x50004e
mov dword [ebp - 0x1c], 0x320023
mov dword [ebp - 0x18], 0x640026
mov dword [ebp - 0x14], 0x310061
mov dword [ebp - 0x10], 0x330061
mov dword [ebp - 0xc], 0x660066
mov dword [ebp - 8], 0x300026
movzx eax, word [ecx]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ecx + 4]
call fcn.0047d5d2
mov edx, dword [ebp - 0x40]
test eax, eax
jne 0x4291dd
mov eax, dword [ebp - 0x58]
mov byte [ebp - 0x35], 1
mov byte [eax], 1
jmp 0x4291dd
mov edx, dword [ebp - 0x40]
mov cl, byte [ebp - 0x35]
mov eax, dword [ebp - 0x3c]
cmp cl, 1
je 0x42922c
mov eax, dword [eax]
inc edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], edx
test eax, eax
jne 0x4290b8
mov ecx, dword [ebp - 0x44]
mov al, byte [ebp - 0x35]
cmp al, 1
je 0x42922f
inc ecx
mov dword [ebp - 0x44], ecx
cmp ecx, 0x25
jb 0x4290a2
test ebx, ebx
js 0x42922f
mov esi, dword [ebp - 0x50]
mov edi, dword [ebp - 0x4c]
mov esi, dword [esi + ebx*4]
dec ebx
inc edi
mov dword [ebp - 0x4c], edi
test esi, esi
jne 0x42905c
jmp 0x42922f
mov al, byte [ebp - 0x35]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00489f30
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4294ca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x7f8
mov dword [ebp - 0x2c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x429572
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x73707746
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x6944324c
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x74617073
push edi
mov dword [ebp - 0x1c], 0x61546863
mov dword [ebp - 0x18], 0x41656c62
mov dword [ebp - 0x14], 0x6c47646e
mov dword [ebp - 0x10], 0x6c61626f
mov dword [ebp - 0xc], 0x74655373
mov dword [ebp - 8], 0x30
call fcn.00404e08
cmp al, 1
jne 0x429572
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x429572
cmp eax, dword [ebp + 0xc]
jae 0x429572
push eax
push 0x7fe
call fcn.004356b2
mov eax, dword [ebp - 0x2c]
add eax, esi
push eax
push 0x7ff
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x429588
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x34], eax
push 0x7f8
mov dword [ebp - 0x30], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x429683
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], 0x73707746
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x49706354
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x24], 0x73694470
push dword [ebp - 0x34]
mov dword [ebp - 0x20], 0x63746170
mov dword [ebp - 0x1c], 0x62615468
mov dword [ebp - 0x18], 0x6e41656c
mov dword [ebp - 0x14], 0x6f6c4764
mov dword [ebp - 0x10], 0x736c6162
mov dword [ebp - 0xc], 0x30746553
mov dword [ebp - 8], ebx
call fcn.00404e08
cmp al, 1
je 0x42965a
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], 0x73707746
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x49706354
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x24], 0x73694470
push dword [ebp - 0x34]
mov dword [ebp - 0x20], 0x63746170
mov dword [ebp - 0x1c], 0x62615468
mov dword [ebp - 0x18], 0x6553656c
mov dword [ebp - 0x14], 0x3074
call fcn.00404e08
cmp al, 1
jne 0x429683
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x429683
cmp eax, dword [ebp + 0xc]
jae 0x429683
push eax
push 0x7fa
call fcn.004356b2
mov eax, dword [ebp - 0x30]
add eax, esi
push eax
push 0x7fb
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x429bb2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x790073
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x60]
push 1
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x53005c
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x730079
push eax
mov dword [ebp - 0x50], 0x650074
mov dword [ebp - 0x4c], 0x52006d
mov dword [ebp - 0x48], 0x6f006f
mov dword [ebp - 0x44], 0x5c0074
mov dword [ebp - 0x3c], 0x740073
mov dword [ebp - 0x38], 0x6d0065
mov dword [ebp - 0x34], 0x320033
mov dword [ebp - 0x30], 0x64005c
mov dword [ebp - 0x2c], 0x690072
mov dword [ebp - 0x28], 0x650076
mov dword [ebp - 0x24], 0x730072
mov dword [ebp - 0x20], 0x66005c
mov dword [ebp - 0x1c], 0x700077
mov dword [ebp - 0x18], 0x63006b
mov dword [ebp - 0x14], 0x6e006c
mov dword [ebp - 0x10], 0x2e0074
mov dword [ebp - 8], 0x73
call fcn.00439b16
test eax, eax
jne 0x429c90
push ebx
push edi
push esi
push dword [ebp - 0x60]
push dword [ebp - 0x5c]
call fcn.00405020
cmp al, 1
jne 0x429c88
mov bl, al
push dword [ebp - 0x5c]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x434498
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
je 0x43451c
cmp dword [ebp + 0xc], ebx
je 0x43451c
test edi, edi
je 0x43451c
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0x496c6148
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0x5374696e
push ecx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x65747379
push eax
mov dword [ebp - 8], 0x6d
call fcn.00404e08
cmp al, 1
jne 0x43451c
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x43451c
cmp eax, dword [ebp + 0xc]
jae 0x43451c
push eax
push 0x86a
call fcn.004356b2
mov eax, dword [ebp - 0x18]
add eax, edi
push eax
push 0x86b
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 0xc

Function at 0x434530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x56
mov dword [ebp - 0x2c], ebx
call fcn.004355f2
mov esi, eax
test esi, esi
je 0x4345c0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x496c6148
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x6974696e
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x7a696c61
push edi
mov dword [ebp - 0x1c], 0x6f725065
mov dword [ebp - 0x18], 0x73736563
mov dword [ebp - 0x14], 0x726f
call fcn.00404e08
cmp al, 1
jne 0x4345c0
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4345c0
cmp eax, dword [ebp + 0xc]
jae 0x4345c0
push eax
push 0x82f
call fcn.004356b2
mov eax, dword [ebp - 0x2c]
add eax, esi
push eax
push 0x830
call fcn.004356b2
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8

Function at 0x434d9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 1
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x40], 0x53005c
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x3c], 0x730079
push eax
mov dword [ebp - 0x38], 0x650074
mov dword [ebp - 0x34], 0x52006d
mov dword [ebp - 0x30], 0x6f006f
mov dword [ebp - 0x2c], 0x5c0074
mov dword [ebp - 0x28], 0x790073
mov dword [ebp - 0x24], 0x740073
mov dword [ebp - 0x20], 0x6d0065
mov dword [ebp - 0x1c], 0x320033
mov dword [ebp - 0x18], 0x68005c
mov dword [ebp - 0x14], 0x6c0061
mov dword [ebp - 0x10], 0x64002e
mov dword [ebp - 0xc], 0x6c006c
mov dword [ebp - 8], ebx
call fcn.00439b16
test eax, eax
jne 0x434e51
push ebx
push edi
push esi
push dword [ebp - 0x48]
push dword [ebp - 0x44]
call fcn.00405020
cmp al, 1
jne 0x434e49
mov bl, al
push dword [ebp - 0x44]
call fcn.00478d8c
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 8
Function at 0x435740
Capabilities:
Attach user process memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x49dd48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x1cd
mov dword [ebp - 0x20], eax
xor ebx, ebx
call fcn.004355f2
mov esi, eax
test esi, esi
jne 0x4357ae
push 0x61
call fcn.004355f2
mov esi, eax
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov edi, eax
sub edi, esi
neg edi
sbb edi, edi
and edi, esi
je 0x435790
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.ntoskrnl.exe_KeStackAttachProcess
call fcn.00435c06
test edi, edi
je 0x4357a2
lea eax, [ebp - 0x1c]
push eax
call sub.ntoskrnl.exe_KeUnstackDetachProcess
push 0x1cd
call fcn.004355f2
mov esi, eax
mov eax, dword [ebp - 0x20]
mov dword [eax], ebx
test esi, esi
je 0x4357f4
sidt [ebp - 0x28]
mov edi, dword [ebp - 0x26]
add edi, 0x170
push edi
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x4357f4
lea eax, [edi + 7]
push eax
call dword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, 1
jne 0x4357f4
movzx ecx, word [edi + 6]
movzx eax, word [edi]
shl ecx, 0x10
or ecx, eax
cmp ecx, esi
je 0x4357f4
mov eax, dword [ebp - 0x20]
mov bl, 1
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f30
mov esp, ebp
pop ebp
ret 4