joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x475f3e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
lea ebp, [esi + 0x1174]
mov ecx, ebp
mov dword [esp + 0xc], esi
mov dword [esi], 0x50d8c4
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], 6
mov dword [esi + 0x24], 0x16
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
call fcn.0043f1e0
mov dword [ebp + 4], eax
mov byte [eax + 0xe], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], edi
lea ebp, [esi + 0x1198]
mov ecx, ebp
mov dword [esp + 0x18], edi
call fcn.0043f1e0
mov dword [ebp + 4], eax
mov ecx, dword [esp + 0x10]
mov byte [eax + 0xe], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], edi
mov dword [esi + 0x11c8], edi
mov dword [esi + 0x11cc], edi
mov dword [esi + 0x11d0], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x444720
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x476139
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
push 0x3cd8a38
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esp + 0x34]
mov edx, dword [esi + 0x44]
mov eax, dword [esp + 0x38]
mov edi, dword [esi + 0x48]
inc edx
push eax
lea ecx, [esp + 0xc]
mov dword [esi + 0x44], edx
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea ecx, [esp + 8]
push ecx
mov ecx, 0x3cd8b80
mov dword [esp + 0x30], 0
call fcn.004443e0
lea ecx, [esp + 8]
mov dword [eax], esi
mov dword [esp + 0x2c], 0xffffffff
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push 0x3cd8a38
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x446090
Capabilities:
Hash data using sha256

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
ret
Function at 0x44c610
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.MSVCR71.dll_fseek]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 2
push 0
push esi
mov edi, ecx
call ebx
push esi
call dword [sym.imp.MSVCR71.dll_ftell]
push 0
push 0
push esi
mov ebp, eax
call ebx
mov ebx, dword [sym.imp.MSVCR71.dll_fread]
xor eax, eax
push esi
push 1
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x34]
push 4
push eax
call ebx
push esi
push 1
lea ecx, [esp + 0x4c]
push 4
push ecx
call ebx
mov edx, dword [esp + 0x58]
push esi
push 1
push 4
push edx
call ebx
mov eax, dword [esp + 0x5c]
add esp, 0x4c
cmp eax, 0x200
jg 0x44c73e
mov eax, dword [esp + 0x18]
lea ecx, [eax + 0xc]
cmp ebp, ecx
jne 0x44c73e
push eax
mov dword [edi + 4], eax
call sub.MFC71.DLL_operator_new_1
mov edx, dword [esp + 0x1c]
push esi
push edx
push 1
push eax
mov dword [edi], eax
call ebx
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp eax, 0x200
jne 0x44c701
mov ecx, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
jle 0x44c734
jmp 0x44c6c0
mov ecx, dword [edi]
mov dl, byte [ecx + eax]
add ecx, eax
inc dl
mov byte [ecx], dl
mov edx, dword [edi]
lea ecx, [edx + eax]
mov edx, eax
and edx, 0x800000ff
jns 0x44c6e2
dec edx
or edx, 0xffffff00
inc edx
mov bl, byte [ecx]
mov dl, byte [edx + 0x56b2a0]
xor bl, dl
mov byte [ecx], bl
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
jl 0x44c6c0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
cmp eax, 0x100
jne 0x44c73e
mov ecx, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
jle 0x44c734
mov ecx, dword [edi]
mov dl, byte [ecx + eax]
add ecx, eax
add dl, 3
mov byte [ecx], dl
mov edx, dword [edi]
mov bl, byte [edx + eax]
lea ecx, [edx + eax]
xor bl, 0x43
mov byte [ecx], bl
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
jl 0x44c712
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
Function at 0x44d240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x48
cmp eax, 1
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 0
jne 0x44d3c2
mov edi, dword [esp + 0x5c]
test edi, edi
jne 0x44d27a
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
add esp, 0x48
ret 0xc
mov eax, dword [ebx]
test eax, eax
je 0x44d28f
push eax
call sub.MFC71.DLL_operator_delete_1
add esp, 4
mov dword [ebx], 0
mov esi, dword [sym.imp.WINMM.dll_mmioOpenA]
push 0
push 0
push edi
call esi
test eax, eax
mov dword [ebx + 4], eax
je 0x44d3db
push 0
push eax
call dword [sym.imp.WINMM.dll_mmioClose]
push 0x10000
push 0
push edi
call esi
test eax, eax
mov dword [ebx + 4], eax
jne 0x44d382
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
push str.WAVE
push edi
push eax
call ebp
mov esi, eax
test esi, esi
jne 0x44d2ed
push 0x50f8dc
push edi
push eax
call ebp
mov esi, eax
test esi, esi
je 0x44d3db
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x44d3db
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test ebp, ebp
je 0x44d3db
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x44d3db
push ebp
call sub.MFC71.DLL_operator_new_1
mov dword [ebx + 0x90], eax
mov edi, eax
mov ecx, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
mov ecx, 0x48
mov edi, edi
mov byte [eax], 0
inc eax
dec ecx
jne 0x44d350
mov ecx, dword [ebx + 0x90]
push 0x10000
lea edx, [esp + 0x14]
push edx
push 0
mov dword [esp + 0x20], 0x204d454d
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ecx
call dword [sym.imp.WINMM.dll_mmioOpenA]
mov dword [ebx + 4], eax
mov ecx, ebx
call fcn.0044ca20
mov esi, eax
test esi, esi
jge 0x44d3a7
mov eax, dword [ebx + 4]
push 0
push eax
call dword [sym.imp.WINMM.dll_mmioClose]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0xc
mov ecx, ebx
call fcn.0044cba0
test eax, eax
jl 0x44d41b
mov ecx, dword [ebx + 0xc]
pop edi
pop esi
pop ebp
mov dword [ebx + 0x30], ecx
pop ebx
add esp, 0x48
ret 0xc
mov edx, dword [esp + 0x5c]
push 0x11002
push 0
push edx
call dword [sym.imp.WINMM.dll_mmioOpenA]
test eax, eax
mov dword [ebx + 4], eax
jne 0x44d3ea
pop edi
pop esi
pop ebp
mov eax, 0x80004005
pop ebx
add esp, 0x48
ret 0xc
mov eax, dword [esp + 0x60]
push eax
mov ecx, ebx
call fcn.0044ced0
mov esi, eax
test esi, esi
jge 0x44d414
mov ecx, dword [ebx + 4]
push 0
push ecx
call dword [sym.imp.WINMM.dll_mmioClose]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0xc
mov ecx, ebx
call fcn.0044cba0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 0xc
Function at 0x46a886
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x529ae8
call fcn.0046af80
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x46a8c6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46a8c6
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x46a8de
cmp eax, 0x20b
je 0x46a8cb
mov dword [ebp - 0x1c], ebx
jmp 0x46a8f2
cmp dword [ecx + 0x84], 0xe
jbe 0x46a8c6
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x46a8ec
cmp dword [ecx + 0x74], 0xe
jbe 0x46a8c6
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x9e2b1c4], 0xffffffff
or dword [0x9e2b1c8], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x9deadb0]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x9deadac]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x9e2b1c0], eax
call fcn.0046b00c
call fcn.0046b0ac
cmp dword [0x57cdc0], ebx
jne 0x46a952
push fcn.0046b0ac
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0046b09a
push 0x547784
push 0x547780
call sub.MSVCR71.dll__initterm
push 0x46b050
call fcn.0046a7c6
mov eax, dword [0x9deada8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x9deada4]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x46a9a6
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x54777c
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x46aa24
cmp al, bl
je 0x46a9d0
cmp dword [ebp - 0x20], ebx
jne 0x46aa24
mov al, byte [esi]
cmp al, bl
je 0x46a9e0
cmp al, 0x20
ja 0x46a9e0
inc esi
mov dword [ebp - 0x24], esi
jmp 0x46a9d0
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x46a9fc
movzx eax, word [ebp - 0x54]
jmp 0x46a9ff
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00401850
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x46aa1c
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x46aa79
cmp al, 0x22
jne 0x46aa33
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x46aa46
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x46a9be
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0046afbb
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x9eb920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9eb96c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9eb932
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9eb9d0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9eba22
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9eba28
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0xa03f15
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a03bd5

Function at 0xa08d0f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a08b8e

Function at 0xa0e2c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa0e2ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa0e2ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0xf5db6c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0xf5db72
ret

Function at 0xf6d264
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x437015
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00f3b440
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x43702c
call fcn.00f3b09c
mov eax, ebx
call fcn.00f5b9d0
mov edi, eax
dec edi
test edi, edi
jl 0xf6d31c
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00f5b9a4
mov edx, dword [0x466454]
call fcn.00f3a16c
test al, al
je 0xf6d318
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00f5b9a4
lea edx, [ebp - 0x14]
call fcn.00fa877c
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00f3b440
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00f3b110
inc esi
dec edi
jne 0xf6d2ca
mov al, byte [0x437030]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43703c
mov eax, dword [ebp - 0xc]
call fcn.00f447b0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00f3ae28
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00fa877c
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43702c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00fa877c
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43702c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43702c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x437048
call fcn.00f40820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43701c
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00f3adb4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00f3adb4
lea eax, [ebp - 0x14]
call fcn.00f3ad90
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00f3adb4
ret
Function at 0xfdaa64
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0xfdaa92
mov eax, ebx
call fcn.00fdb518
cmp dword [ebx + 0x40], 0
je 0xfdaa8b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0xfdab03
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0xfdaaf5
cmp dword [ebx + 8], 0
je 0xfdaab4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0xfdaac6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0xfdaaf5
cmp dword [ebx + 8], 0
je 0xfdaaa7
cmp eax, 3
je 0xfdaad9
dec eax
jne 0xfdaaa7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0xfdaaa7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0xfdaaa7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0xfdab21
cmp dword [ebx + 0x14], 0xcc
je 0xfdab21
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00fdab2c
pop ebx
ret
Function at 0x403fa0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e85b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x44e100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x410
mov dword [ebp - 0x23c], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x404170
lea eax, [ebp - 0x234]
push eax
push 4
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x404170
mov eax, dword [ebp - 0x234]
mov ecx, 4
shr eax, 2
mul ecx
mov esi, eax
mov eax, 0xffffffff
cmovb esi, eax
push esi
call fcn.0042ce14
mov edi, eax
add esp, 4
test edi, edi
je 0x404051
push esi
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x404053
xor edi, edi
mov dword [ebp - 0x240], edi
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 0
push eax
push dword [ebp - 0x234]
push edi
push ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x404163
xor esi, esi
test dword [ebp - 0x234], 0xfffffffc
jbe 0x404163
nop
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x208
push eax
push dword [edi + esi*4]
push ebx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00402000
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x21c], 7
push 0
mov byte [ebp - 4], 1
lea ecx, [eax + eax]
lea eax, [ebp - 0x230]
cmova eax, dword [ebp - 0x230]
push ecx
mov ecx, dword [ebp - 0x238]
push eax
call fcn.00404bb0
mov ecx, dword [ebp - 0x238]
push 0
push 2
push 0x442640
call fcn.00404bb0
mov ecx, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp ecx, 7
jbe 0x404151
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404147
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40418c
push ecx
push edx
call fcn.0042ce06
add esp, 8
mov eax, dword [ebp - 0x234]
inc esi
shr eax, 2
cmp esi, eax
jb 0x404090
test edi, edi
je 0x404170
push edi
call fcn.0042ce1d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042ccae
mov esp, ebp
pop ebp
ret
call fcn.0042dfe0
int3