joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f250
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x47f29f
lea edx, [esi + 8]
mov edi, eax
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x47f262
mov eax, dword [esi]
jmp 0x47f388
cmp eax, 0x4e0
jb 0x47f388
push ebx
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
push ebp
mov ebp, 0xe3
nop dword [eax]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x47f2c0
mov ebx, dword [esi + 0xd50]
lea edi, [esi + 0xd50]
mov ebp, 0x18c
nop dword [eax]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x47f310
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x4813f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c658b
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x67c3c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x220], esi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x48145c
xorps xmm0, xmm0
mov ecx, esi
push 0
movups xmmword [esi], xmm0
push 0x5d5a64
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00442860
jmp 0x4815c9
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x220], 0
call fcn.0059c4a0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0
push 0
lea eax, [ebp - 0x220]
push eax
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHELL32.dll_SHParseDisplayName]
push edi
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
push eax
push dword [ebp - 0x220]
push dword [0x68516c]
call fcn.00481ec0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x481549
mov eax, dword [ebp - 0x220]
xorps xmm0, xmm0
movlpd qword [ebp - 0x228], xmm0
mov dword [ebp - 0x228], eax
mov eax, dword [0x68516c]
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x248]
push eax
movlpd qword [ebp - 0x244], xmm0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x238], 0x251
mov dword [ebp - 0x234], 0x482070
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov dword [ebp - 0x21c], eax
jmp 0x48154f
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x4815a1
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x224], ecx
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 1
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x481591
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.004606f0
push dword [ebp - 0x21c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x4815c3
push dword [ebp - 0x21c]
mov byte [ebp - 4], 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xorps xmm0, xmm0
mov ecx, esi
push 0
movups xmmword [esi], xmm0
push 0x5d5a64
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00442860
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059a5ad
mov esp, ebp
pop ebp
ret
Function at 0x481d50
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0
call fcn.004820c0
add esp, 4
test al, al
je 0x481e31
push dword [0x68516c]
mov esi, dword [sym.imp.USER32.dll_IsIconic]
call esi
test eax, eax
je 0x481dd6
mov ecx, dword [0x6851a8]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x44]
cmp eax, 0x88760868
jne 0x481dbc
mov eax, dword [0x6851a8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp eax, 0x88760869
jne 0x481dbc
call fcn.0045b650
mov eax, dword [0x6851a8]
push 0x6851ac
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
call fcn.0045b4c0
push 0
call fcn.004820c0
add esp, 4
test al, al
je 0x481e31
push dword [0x68516c]
call esi
test eax, eax
jne 0x481d75
push edi
call fcn.0040e260
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov edi, eax
push 0x11
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xf4], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xf5], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xf7], 0
mov byte [edi + 0xf6], al
call fcn.0045b6c0
push 0
call fcn.0045c300
add esp, 4
call fcn.00413fd0
pop edi
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x482430
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x348
mov eax, dword [0x67c3c0]
xor eax, esp
mov dword [esp + 0x344], eax
mov eax, dword [esp + 0x34c]
mov dword [esp + 8], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push ebx
mov ebx, dword [esp + 0x358]
mov dword [esp + 0x20], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebp
mov ebp, dword [esp + 0x358]
mov dword [esp + 0x28], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov dword [esp + 0x30], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov dword [esp + 0x38], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x208
mov dword [esp + 0x40], eax
lea eax, [esp + 0x44]
push 0
push eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call fcn.0059c4a0
push 0x104
lea eax, [esp + 0x258]
push 0
push eax
call fcn.0059c4a0
add esp, 0x18
lea eax, [esp + 0x40]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
je 0x482527
push 0x40
push 0x3000
push ebx
push 0
push dword [esp + 0x28]
call edi
mov esi, eax
test esi, esi
je 0x482527
push 0
push ebx
push dword [esp + 0x18]
push esi
push dword [esp + 0x28]
call ebp
push 0
mov dword [esp + 0x28], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, 0x6851e8
sub ecx, eax
mov dword [esp + 0x28], ecx
push 0x40
push 0x3000
push 0x328
push 0
push dword [esp + 0x28]
call edi
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x48254a
xor al, al
jmp 0x482640
push 0
push 0x328
lea ecx, [esp + 0x2c]
push ecx
push eax
push dword [esp + 0x28]
lea esi, [esp + 0x30]
call ebp
push 0x40
push 0x3000
push 0x300
push 0
push dword [esp + 0x28]
call edi
mov dword [esp + 0x20], eax
test eax, eax
jne 0x482584
xor bl, bl
jmp 0x482621
push 0
push 0x300
push 0x66ad30
push eax
push dword [esp + 0x28]
lea edi, [esp + 0x34]
call ebp
push 0
push 0
push dword [esp + 0x24]
push dword [esp + 0x2c]
push 0
push 0
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
je 0x482602
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x34c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea eax, [esp + 0x350]
push eax
push 0x328
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x28]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp word [esp + 0x34c], 0
jne 0x482602
mov bl, 1
jmp 0x482604
xor bl, bl
push 0x8000
push 0
push dword [edi]
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0x8000
push 0
push dword [esi]
lea eax, [esp + 0x24]
mov dword [esp + 0x20], 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, bl
mov ecx, dword [esp + 0x354]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059a5ad
add esp, 0x348
ret
Function at 0x482eb0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x94
mov eax, dword [0x67c3c0]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push ebp
push esi
push edi
call fcn.0040e260
mov ebp, dword [sym.imp.GDI32.dll_GetFontData]
xor esi, esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], esi
nop dword [eax]
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push 0
movq qword [esp + 0x20], xmm0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esi*4 + 0x66b0e0]
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push edi
call ecx
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x4830b6
push ebx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push 0
push 0
push 0x66637474
push edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x482f5e
push 0
push 0
push 0
push 0
push edi
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x483082
push esi
call fcn.00410c10
add esp, 4
mov ebx, eax
push esi
push ebx
push 0
push 0
jmp 0x482f72
push esi
call fcn.00410c10
add esp, 4
mov ebx, eax
push esi
push ebx
push 0
push 0x66637474
push edi
call ebp
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [esp + 0x28]
call fcn.0041c930
movss xmm0, dword [esp + 0x24]
mulss xmm0, dword [esp + 0xa8]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
push ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x70], 0x3fa00000
mov dword [esp + 0x40], 5
mov dword [esp + 0x44], 5
movss dword [esp + 0x18], xmm0
call fcn.00482c30
movss xmm0, dword [esp + 0x18]
add esp, 4
push eax
lea eax, [esp + 0x2c]
push eax
push ecx
movss dword [esp], xmm0
push esi
push ebx
mov ebx, dword [esp + 0x2c]
mov ecx, dword [ebx + 0x90]
call fcn.0041d820
mov esi, dword [esp + 0x10]
mov dword [esi*4 + 0x6851f8], eax
inc esi
mov dword [esp + 0x10], esi
cmp esi, 3
jb 0x482ee0
mov esi, dword [ebx + 0x90]
call fcn.00424d30
mov ecx, esi
mov dword [esi + 0x458], eax
mov dword [esi + 0x45c], 0
call fcn.0041ecf0
cmp byte [0x6851ec], 0
jne 0x483055
call fcn.0040e260
mov ecx, dword [eax + 0x90]
mov edx, dword [ecx + 0x3c]
mov ecx, dword [0x66b030]
mov ecx, dword [edx + ecx*4]
mov dword [eax + 0x9c], ecx
mov eax, dword [0x6851f0]
test eax, eax
je 0x4830b2
cmp eax, 7
jne 0x48309e
push 0x10
push str.Fatal_error
push str.No_font_can_be_loaded._nthprac_will_now_terminate.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x570
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [0x6851f0]
mov ecx, dword [esp + 0x10]
bts eax, ecx
jmp 0x4830be
push 0x30
push str.Warning
push str.One_or_more_fonts_failed_to_load__which_will_cause_certain_non_Latin_characters_to_not_render_properly._nIf_you_are_running_thprac_under_wine_Crossover__seek_help_to_link_the_appropriate_fonts_or_try_using_wine_staging.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov al, 1
jmp 0x4830c5
mov eax, dword [0x6851f0]
bts eax, esi
mov dword [0x6851f0], eax
xor al, al
mov ecx, dword [esp + 0xa0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059a5ad
add esp, 0x94
ret
Function at 0x4830e0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
call fcn.0040e260
mov ecx, dword [esp + 0x10]
mov ebx, eax
mov dword [0x66b030], ecx
sub ecx, 0
je 0x48311a
sub ecx, 1
je 0x483110
sub ecx, 1
je 0x483109
pop edi
pop esi
xor al, al
pop ebx
ret
xor edi, edi
lea eax, [edi + 2]
jmp 0x483121
xor esi, esi
lea edi, [esi + 2]
lea eax, [esi + 1]
jmp 0x483126
mov edi, 2
xor eax, eax
mov esi, 1
movss xmm0, dword [esp + 0x14]
push 0
push eax
push ecx
movss dword [esp], xmm0
call fcn.00482ce0
movss xmm0, dword [esp + 0x20]
add esp, 0xc
push 1
push edi
push ecx
movss dword [esp], xmm0
call fcn.00482ce0
movss xmm0, dword [esp + 0x20]
add esp, 0xc
push 1
push esi
push ecx
movss dword [esp], xmm0
call fcn.00482ce0
mov esi, dword [ebx + 0x90]
add esp, 0xc
call fcn.00424d30
mov ecx, esi
mov dword [esi + 0x458], eax
mov dword [esi + 0x45c], 0
call fcn.0041ecf0
mov eax, dword [0x6851f0]
mov byte [0x6851ec], 1
test eax, eax
je 0x4831d5
cmp eax, 7
jne 0x4831c1
push 0x10
push str.Fatal_error
push str.No_font_can_be_loaded._nthprac_will_now_terminate.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0x570
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x30
push str.Warning
push str.One_or_more_fonts_failed_to_load__which_will_cause_certain_non_Latin_characters_to_not_render_properly._nIf_you_are_running_thprac_under_wine_Crossover__seek_help_to_link_the_appropriate_fonts_or_try_using_wine_staging.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x483350
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c665d
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x67c3c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
xor ebx, ebx
mov dword [ebp - 0x58], esi
push eax
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
xor eax, eax
mov dword [ebp - 0x60], edi
cmp edi, 0xffffffff
je 0x483405
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push eax
push esi
push 2
push esi
push edi
mov dword [ebp - 0x5c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
mov dword [ebp - 0x64], ebx
test ebx, ebx
jne 0x4833db
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
xor eax, eax
jmp 0x483405
push dword [ebp - 0x5c]
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
jne 0x483405
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov dword [ebp - 4], 0
test eax, eax
je 0x48343f
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x5c]
push esi
call fcn.0046e310
mov edx, dword [ebp + 8]
add esp, 0xc
xor ecx, ecx
add edx, 0x4c
mov eax, dword [ebp + ecx*4 - 0x20]
cmp eax, dword [edx]
jne 0x48343f
inc ecx
add edx, 4
cmp ecx, 4
jl 0x483428
mov byte [ebp - 0x51], 1
jmp 0x483443
mov byte [ebp - 0x51], 0
test esi, esi
je 0x48344e
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test ebx, ebx
je 0x48345d
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
jmp 0x483463
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
je 0x48346b
push edi
call ebx
mov al, byte [ebp - 0x51]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059a5ad
mov esp, ebp
pop ebp
ret
Function at 0x4834c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov eax, dword [0x67c3c0]
xor eax, esp
mov dword [esp + 0x6c], eax
mov edx, dword [esp + 0x74]
mov eax, 0x5d6718
push ebx
mov ebx, dword [esp + 0x7c]
push esi
push edi
lea ecx, [edx + 0x24]
mov si, word [eax]
cmp si, word [ecx]
jne 0x483507
test si, si
je 0x483503
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x483507
add eax, 4
add ecx, 4
test si, si
jne 0x4834e1
xor eax, eax
jmp 0x48350c
sbb eax, eax
or eax, 1
test eax, eax
je 0x4835da
lea ecx, [edx + 0x24]
mov eax, str.alcostg.exe
nop dword [eax]
mov si, word [eax]
cmp si, word [ecx]
jne 0x483546
test si, si
je 0x483542
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x483546
add eax, 4
add ecx, 4
test si, si
jne 0x483520
xor eax, eax
jmp 0x48354b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4835da
cmp word [edx + 0x24], 0x74
jne 0x4836d7
cmp word [edx + 0x26], 0x68
jne 0x4836d7
mov ax, word [edx + 0x28]
sub ax, 0x30
cmp ax, 9
ja 0x4836d7
mov ax, word [edx + 0x2a]
sub ax, 0x30
cmp ax, 9
ja 0x4836d7
movzx eax, word [edx + 0x2c]
mov ecx, eax
cmp eax, 0x2e
jne 0x4835ab
cmp dword [edx + 0x2e], 0x780065
jne 0x4836d7
cmp dword [edx + 0x32], 0x65
jmp 0x4835d4
lea eax, [ecx - 0x30]
cmp ax, 9
ja 0x4836d7
cmp word [edx + 0x2e], 0x2e
jne 0x4836d7
cmp dword [edx + 0x30], 0x780065
jne 0x4836d7
cmp dword [edx + 0x34], 0x65
jne 0x4836d7
push dword [edx + 8]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4836d7
push 0
push 0x18
lea eax, [esp + 0x18]
push eax
push 0
push esi
call sub.ntdll.dll_NtQueryInformationProcess
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [esp + 0x34]
push eax
push 4
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0
push eax
mov eax, dword [esp + 0x20]
add eax, 8
push eax
push esi
call edi
mov eax, dword [esp + 0x2c]
mov dword [ebx], eax
test eax, eax
je 0x4836d7
lea ecx, [esp + 0x28]
mov dword [esp + 0xc], 0
push ecx
push 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0
push ecx
add eax, 0x3c
push eax
push esi
call edi
cmp dword [esp + 0x28], 4
jne 0x4836d0
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4836d0
lea eax, [esp + 0x28]
add ecx, 0xfffffffc
push eax
push 4
lea eax, [esp + 0x38]
push eax
mov eax, dword [ebx]
add eax, ecx
push eax
push esi
call edi
cmp dword [esp + 0x28], 4
jne 0x4836d0
cmp dword [esp + 0x30], 0
jne 0x4836d0
lea eax, [esp + 0x38]
push eax
push dword [ebx]
push esi
call fcn.0046e620
add esp, 0xc
test al, al
je 0x4836d0
mov edx, dword [esp + 0x3c]
mov eax, 0x67b6a0
mov edi, dword [esp + 0x38]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x4836bc
cmp ecx, 1
jne 0x4836c6
cmp dword [eax + 0x20], edx
jne 0x4836c6
cmp dword [eax + 0x1c], edi
je 0x4836d9
add eax, 0x5c
cmp eax, 0x67c0b0
jne 0x4836b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x78]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0059a5ad
add esp, 0x70
ret
Function at 0x4839c0
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x330]
sub esp, 0x330
push 0xffffffffffffffff
push 0x5c66e0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x67c3c0]
xor eax, ebp
mov dword [ebp + 0x32c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor bl, bl
call fcn.00483280
test al, al
je 0x483aad
push 0x228
lea eax, [ebp + 4]
push 0
push eax
call fcn.0059c4a0
add esp, 0xc
mov dword [ebp], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x483aad
nop dword [eax]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
call fcn.004834c0
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x483a9f
imul eax, dword [0x66b030], 0xe2c
mov bl, 1
push dword [ecx]
push dword [eax + 0x66baf0]
lea eax, [ebp + 0x22c]
push eax
call fcn.00442c90
imul eax, dword [0x66b030], 0xe2c
lea ecx, [ebp + 0x22c]
push 0x1024
push ecx
push dword [eax + 0x66baec]
call fcn.00483bf0
add esp, 0x18
cmp eax, 6
je 0x483aeb
lea eax, [ebp]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x483a40
cmp byte [ebp + 0x338], 0
je 0x483ac6
test bl, bl
jne 0x483ac6
push 0
push 2
call fcn.00483d10
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x32c]
xor ecx, ebp
call fcn.0059a5ad
lea esp, [ebp + 0x330]
pop ebp
ret
push dword [ebp + 8]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x483b5d
push dword [ebp - 0x10]
push esi
call fcn.00484150
add esp, 8
test al, al
je 0x483b5a
push 0
push 0
push esi
call fcn.00482430
add esp, 0xc
test al, al
je 0x483b5a
push esi
mov esi, ebx
call esi
imul eax, dword [0x66b030], 0xe2c
push 0x1040
push dword [eax + 0x66bb18]
push dword [eax + 0x66baf8]
call fcn.00483bf0
add esp, 0xc
push edi
call esi
mov al, 1
jmp 0x483ac8
push esi
call ebx
imul eax, dword [0x66b030], 0xe2c
push 0x1010
push dword [eax + 0x66bb04]
push dword [eax + 0x66bb00]
call fcn.00483bf0
add esp, 0xc
push edi
call ebx
mov al, 1
jmp 0x483ac8
Function at 0x483f90
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Inject thread
Resume thread
Spawn thread to rwx shellcode
Terminate thread
Use process replacement

Disassembly:
sub esp, 0x78
mov eax, dword [0x67c3c0]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
mov ebx, dword [esp + 0x80]
push esi
mov esi, dword [esp + 0x88]
push edi
push str._Initialize_4
push dword [ebx + 0x10]
call fcn.005430c0
cmp dword [esi + 0x14], 7
xorps xmm0, xmm0
mov edi, eax
movlpd qword [esp + 0x40], xmm0
movlpd qword [esp + 0x48], xmm0
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x58], xmm0
movlpd qword [esp + 0x60], xmm0
movlpd qword [esp + 0x68], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
mov dword [esp + 0x3c], 0x44
jbe 0x484001
mov esi, dword [esi]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x40]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push 0
push 0x18
push eax
push 0
push esi
call sub.ntdll.dll_NtQueryInformationProcess
lea eax, [esp + 0x38]
mov dword [esp + 0x34], 0
push eax
push 4
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x2c]
add eax, 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test edi, edi
je 0x4840db
mov ecx, dword [ebx + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x484062
sub ecx, edx
sar ecx, 1
push 0x40
push 0x3000
lea edi, [ecx*2 + 2]
push edi
push 0
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x4840db
push 0
push edi
push dword [ebx + 0x10]
push esi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push esi
push dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x4840c9
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push esi
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [esp + 0x34]
push dword [esp + 0x10]
call fcn.00484150
add esp, 8
test al, al
je 0x484111
push 0
push 0
push dword [esp + 0x14]
call fcn.00482430
add esp, 0xc
test al, al
je 0x484111
push dword [esp + 0x10]
mov bl, 1
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x484122
push 0x65b
push dword [esp + 0x14]
xor bl, bl
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0xc]
call esi
mov ecx, dword [esp + 0x80]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0059a5ad
add esp, 0x78
ret