joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419746
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x419820
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x164b4]
cmp eax, ecx
je 0x41981f
mov ecx, dword [ebp + 0x10]
lea edx, [ecx - 0x10]
cmp edx, 0x1ef
ja 0x41981f
push ecx
push eax
push edi
call fcn.00419696
add esp, 0xc
test eax, eax
je 0x41981f
push esi
lea esi, [edi + 0x3e0c]
push 0x200
push esi
mov dword [ebp - 8], 0xa0d0a0d
mov byte [ebp - 4], bl
mov dword [ebp - 0x18], 0x66696e53
mov dword [ebp - 0x14], 0x72662066
mov dword [ebp - 0x10], 0x93a6d6f
mov dword [ebp - 0xc], ebx
call fcn.0041c8e6
push 0xe
lea ecx, [ebp - 0x18]
push ecx
push esi
invalid
in eax, 0x30
invalid

Function at 0x419866
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
push edi
mov dword [ebp - 0x23], eax
mov word [ebp - 0x1f], ax
mov byte [ebp - 0x1d], al
movzx eax, word [esi + 0x1c]
push 0x7ff

Function at 0x41bee6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41bf4c
cmp dword [esi + 0x18], 0
je 0x41bf67
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041d7f6
add esp, 8
test eax, eax
jne 0x41bf44
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41bf26
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x41bf67
mov eax, dword [esi + 0x18]
test eax, eax
je 0x41bf67
cmp eax, ecx
je 0x41bf44
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41bf5a
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41bf76
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41bfce
cmp dword [esi + 0x18], 0
je 0x41bfce
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041d7f6
add esp, 8
test eax, eax
jne 0x41bfd6
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41bfb6
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41bfe6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x41c03e
cmp dword [esi + 0x18], 0
je 0x41c03e
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041d7f6
add esp, 8
test eax, eax
jne 0x41c046
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41c026
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41c0f6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x41c13a
cmp dword [eax + 0x18], 0
je 0x41c13a
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x41c12d
mov esp, ebp
pop ebp
ret

Function at 0x41c146
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0041c936
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x41c1d1
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0041cf56
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.004167e6
add esp, 0x10
test eax, eax
jne 0x41c1d9
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x41c1a6
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41c616
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x41c624
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c620
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x41c620
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret
Function at 0x41c666
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x41c68a
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x41c68a
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x41c692
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.0041ca66
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.0041c8e6
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.0041c8b6
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x41c724
mov dword [ebp + 0xc], edx
jmp 0x41c6cf
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x41c6e6
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x41c6fc
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x41c709
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.0041c8b6
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41c6cd
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c736
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x41c756
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x41c756
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x41c75a
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x41c7d6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x41c7f6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c7f6
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x41c7fa
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x41c7f6
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x41d4d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x41d712
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0041c936
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x41d6a2
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x41d698
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.0040c8e6
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x41d6c3
inc eax
cmp byte [esi + eax], 0
jne 0x41d6bc
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0041c8b6
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x41d6e0
inc edi
cmp byte [edi + ebx], 0
jne 0x41d6d9
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x41d6f0
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x41d6e8
test esi, esi
je 0x41d705
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0041c906
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x421938
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x608f0df3
sub dword [edi - 0x5d], ebx
pop es
daa
push ss
cmp dh, al
invalid
invalid
shr dword [ecx + 0x63], cl
jbe 0x4218ec
stosd dword es:[edi], eax
insb byte es:[edi], dx
adc al, 0x6c
test dword [ebp - 0x76], eax
setns byte [ebx]
lodsb al, byte [esi]
sub eax, 0xd08ff240
xor edi, ecx
loopne 0x4218e2
bound ebp, qword [edx + 3]
clc
movsb byte es:[edi], byte [esi]
push ebp
or al, 0xd3
inc esi
xchg edx, eax
sub dl, byte [eax - 0x14]
push eax
in al, dx
scasb al, byte es:[edi]
xor byte [edx], bl
jno 0x42195d

Function at 0x4248ec
Capabilities:
Encode data using xor

Disassembly:
pushal
sar byte [edx + 0x14fc73f7], 1
into
xchg esi, eax
imul ecx, dword [esp + 0x9effc03], 0x41ef35f9
or eax, 0x81fafcb1
add bl, byte [eax]
sbb byte [ecx + 0x5449eac], bh
add dword [edx], 0x9eacb918
inc esp
add eax, 0x3544de78
std
xor ecx, dword [edi + ebp*4 - 0x99d035d]
in eax, dx
sbb byte [ecx + 0x5449eac], bh
js 0x4248d2
inc esp
xor eax, 0xaf8c33fd
mov dword [0xedf662fc], eax
fstp dword [edi + 0x2ef18609]
adc eax, 0xe24dc664
insb byte es:[edi], dx
invalid
mov dh, 0x43
std
xchg edi, eax

Function at 0x42bddc
Capabilities:
Encode data using xor

Disassembly:
imul edx, edx, 0xffffffc4
push ds
mov edx, 0x627cc5e0
je 0x42bdc2
lds edi, [edx + 0x74]
dec edi
and byte [ebx + 0x287aeec4], bh
xchg byte [ebx + 0x1d74c91b], cl
mov byte [ecx + 0x489465b7], 0x74
ret 0x48f2
mov eax, 0xcabce760
int 0x31
fdiv qword [ebp + edx*2 + 0x1d]
pop ss
sbb edi, ecx
enter 0x56b1, 0xffffffffffffffb4
pop edx
jbe 0x42bd6e
or byte [eax], al
sbb byte [edx + 0x65d73b63], al
arpl word [ebx], di
xlatb
invalid
mov dh, 0xa5
lea ecx, [ebx]
dec edi
xor ebp, dword [eax + 0x4c]
xor eax, 0xeee274fd
insd dword es:[edi], dx
jp 0x42bde0
push ebx
mov dword [edi + ebp*4 + 0x53], esp
mov ch, byte [ebx - 5]
xor esp, ebx
inc ebx
xor al, 0x17
cmp ch, ah
iretd

Function at 0x42d018
Capabilities:
Encode data using xor

Disassembly:
and dword [edi + 0x3277362b], eax
xchg ebx, eax
jle 0x42d02b
or ch, byte [esi - 0x3f]
lcall 0xf9fe, 0x50b54d13
outsb dx, byte [esi]
rcr dword [edx + 0x50b54d13], 0xfe
stc
add al, 0x93
xchg ebx, eax
and byte [ebp + 0x7a9453bf], ah
xor ah, byte [esi + 0x5f]
adc bl, byte [eax - 0x4853d9c4]
rcl esi, 1
mov edx, 0x8df0698f
mov al, 0x3b
jnp 0x42d020
or dh, byte [eax + ebp*4]
or esi, dword [edx]
lodsd eax, dword [esi]
in eax, dx
invalid
Function at 0x43bdc4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43b375
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405824
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x43b38c
call fcn.00405488
mov eax, ebx
call fcn.00421964
mov edi, eax
dec edi
test edi, edi
jl 0x43be7c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00421938
mov edx, dword [0x430128]
call fcn.00404580
test al, al
je 0x43be78
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00421938
lea edx, [ebp - 0x14]
call fcn.0044350c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405824
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004054fc
inc esi
dec edi
jne 0x43be2a
mov al, byte [0x43b390]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43b39c
mov eax, dword [ebp - 0xc]
call fcn.0040e988
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.0040521c
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044350c
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43b38c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f0]
call fcn.0044350c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43b38c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43b38c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x43b3a8
call fcn.0040a6e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b37c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004051a8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004051a8
lea eax, [ebp - 0x14]
call fcn.00405184
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004051a8
ret
Function at 0x19f10a8
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
lea esi, [ebp - 0xc]
call fcn.019f17d8
push 0x19f2120
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov eax, dword [edi + 0x3c]
lea ebx, [eax + edi + 0x78]
mov esi, dword [ebx]
lea eax, [ebp - 0x2c]
push eax
add esi, edi
push esi
push ebx
push edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x2c], 0x74726956
mov dword [ebp - 0x28], 0x416c6175
mov dword [ebp - 0x24], 0x636f6c6c
mov byte [ebp - 0x20], 0
call fcn.019f1745
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
push esi
push ebx
push edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x2c], 0x74726956
mov dword [ebp - 0x28], 0x466c6175
mov dword [ebp - 0x24], 0x656572
call fcn.019f1745
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, 0x1200
push esi
push 0
push eax
mov dword [ebp - 0x10], eax
call edi
mov ebx, eax
mov eax, dword [ebp + 8]
mov ecx, ebx
sub eax, ebx
mov dword [ebp + 8], esi
mov dl, byte [eax + ecx]
mov byte [ecx], dl
inc ecx
dec dword [ebp + 8]
jne 0x19f1149
mov edx, esi
mov ecx, ebx
call fcn.019f106d
push 0x200
push 0
push dword [ebp - 0x10]
mov dword [0x19f3028], ebx
mov dword [0x19f302c], esi
call edi
push 0x100
push eax
push dword [0x19f3034]
mov dword [0x19f3030], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [ebx + 0x3c]
add edi, ebx
push 0x40
lea eax, [edi + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [eax + 0x38]
push 0x3000
push eax
push 0
call dword [ebp - 0x14]
mov esi, eax
mov dword [ebp + 8], esi
test esi, esi
je 0x19f1280
push ebx
push 0x40
pop eax
call fcn.019f18d0
mov eax, esi
mov esi, dword [eax + 0x3c]
add esi, eax
movzx eax, word [edi + 0x14]
push edi
call fcn.019f18d0
movzx eax, word [edi + 0x14]
movzx ecx, word [edi + 6]
add eax, dword [ebp - 8]
movzx edx, word [esi + 0x14]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
lea esi, [edx + esi + 0x18]
test ecx, ecx
je 0x19f1231
mov edi, eax
sub edi, esi
mov dword [ebp - 0x10], ecx
lea eax, [edi + esi]
push eax
push 0x28
pop eax
call fcn.019f18d0
add esi, 0x28
dec dword [ebp - 0x10]
jne 0x19f11f2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
test ecx, ecx
je 0x19f1231
lea edi, [eax + 0x14]
mov dword [ebp - 0x10], ecx
mov eax, dword [edi]
mov esi, dword [edi - 8]
add esi, dword [ebp + 8]
add eax, ebx
push eax
mov eax, dword [edi - 4]
call fcn.019f18d0
add edi, 0x28
dec dword [ebp - 0x10]
jne 0x19f1216
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 8]
add eax, 0x68
cmp dword [eax], 0
je 0x19f1245
push ebx
call fcn.019f16bc
mov ecx, dword [ebp - 8]
lea esi, [ecx + 0x88]
cmp dword [esi], 0
je 0x19f1259
push ebx
call fcn.019f163f
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], ebx
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
add ecx, ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ecx
call ecx
push pe_overlay
push 0
push ebx
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x401930
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4152e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.004075b0
mov dword [esp + 0x64], 0
mov dword [esp + 0x10], 0x12
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x18], 0xf
mov dword [esp + 0x1c], 5
mov dword [esp + 0x20], 0xd
mov dword [esp + 0x24], 0x10
mov dword [esp + 0x28], 0x17
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x30], 0x1a
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0x1b
mov dword [esp + 0x3c], 2
mov dword [esp + 0x40], 0x1d
mov dword [esp + 0x44], 6
mov dword [esp + 0x48], 0x1c
mov dword [esp + 0x4c], 7
mov dword [esp + 0x50], 0x19
mov dword [esp + 0x54], 0x14
mov dword [esp + 0x58], 0x3e8
lea edi, [esp + 0x10]
mov ebx, 0x13
mov eax, dword [edi]
push 0
push 0x40
push 9
push eax
lea ecx, [esp + 0x1c]
call fcn.00407890
mov esi, eax
test esi, esi
je 0x401a25
mov ecx, esi
call fcn.00405860
push esi
call fcn.00405b1e
add esp, 4
add edi, 4
dec ebx
jne 0x4019fd
push 0
push 0xa
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x28]
call fcn.004092c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x64], 0xffffffff
call fcn.004075e0
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x5c
ret
Function at 0x402130
Capabilities:
Acquire debug privileges

Disassembly:
push 0xffffffffffffffff
push 0x415346
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x514
push ebx
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.00404bf0
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
mov dword [esp + 0x528], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x118]
stosb byte es:[edi], al
call fcn.00402af0
mov eax, dword [esp + 0x530]
mov byte [esp + 0x528], 1
cmp eax, 1
mov dword [esp + 0x10], ebx
jne 0x4021a7
push 1
call fcn.00401f40
add esp, 4
jmp 0x40239f
push ebx
call fcn.00401f40
add esp, 4
lea eax, [esp + 0x14]
push str.smpagt.exe
push 0x41f2a4
push str._s_s
push eax
call fcn.00409e89
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x11c]
call fcn.00402c70
mov esi, eax
cmp esi, ebx
je 0x4022f4
mov ecx, esi
call fcn.00405860
push esi
call fcn.00405b1e
add esp, 4
push ebp
push str.SeDebugPrivilege
call fcn.00406460
add esp, 4
lea ecx, [esp + 0x10]
push 1
push str.smpagt.exe
call fcn.00404c10
push 1
push str.CSMPRDC.exe
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.00404c10
push 1
push str.winlogon.exe
lea ecx, [esp + 0x18]
mov edi, eax
call fcn.00404c10
push 1
push str.csrss.exe
lea ecx, [esp + 0x18]
mov ebp, eax
call fcn.00404c10
test esi, esi
mov ebx, eax
je 0x402261
push 1
push esi
push str.AgtProtect.dll
call fcn.00406990
add esp, 0xc
test edi, edi
je 0x402275
push 1
push edi
push str.AgtProtect.dll
call fcn.00406990
add esp, 0xc
test ebp, ebp
je 0x402289
push 1
push ebp
push str.AgtProtect.dll
call fcn.00406990
add esp, 0xc
test ebx, ebx
pop ebp
je 0x40229e
push 1
push ebx
push str.AgtProtect.dll
call fcn.00406990
add esp, 0xc
push 0x41f4b4
call fcn.00402970
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
test esi, esi
je 0x402363
push 0
push esi
call fcn.00402800
push esi
call fcn.00402920
add esp, 0xc
test eax, eax
je 0x402355
push 0x3e8
call ebx
push 1
push esi
lea ecx, [esp + 0x14]
call fcn.00404f10
push str.KillProcess_AGENT_failed
call fcn.004058a0
add esp, 4
jmp 0x402363
lea edx, [esp + 0x10]
lea ecx, [esp + 0x118]
push edx
push 0x41a470
call fcn.004031d0
mov esi, eax
cmp esi, ebx
jne 0x4021e7
mov eax, dword [esp + 0x10]
mov ecx, dword [0x41f2a0]
cmp eax, ecx
je 0x4021f7
lea ecx, [esp + 0x118]
mov byte [esp + 0x528], 0
call fcn.00402b30
lea ecx, [esp + 0xc]
mov dword [esp + 0x528], 0xffffffff
call fcn.00404c00
mov eax, 1
jmp 0x4023c9
push esi
push str.KillProcess_AGENT__d__success.
call fcn.004058a0
add esp, 8
test edi, edi
je 0x40239f
push 0
push edi
call fcn.00402800
push edi
call fcn.00402920
add esp, 0xc
test eax, eax
je 0x402391
push 0x3e8
call ebx
push 1
push edi
lea ecx, [esp + 0x14]
call fcn.00404f10
jmp 0x40239f
push edi
push str.KillProcess_CSMPRDC__d__success.
call fcn.004058a0
add esp, 8
lea ecx, [esp + 0x118]
mov byte [esp + 0x528], 0
call fcn.00402b30
lea ecx, [esp + 0xc]
mov dword [esp + 0x528], 0xffffffff
call fcn.00404c00
xor eax, eax
mov ecx, dword [esp + 0x520]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x520
ret