joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fe000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x6fe131
push esi
call fcn.00701145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.006f0080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x6fe131
push 0
push ebp
call fcn.006f03a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.006f0260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x6fe08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006f02f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x6fe121
push 0x716918
push edi
call fcn.006ff3f0
push eax
push ebx
push esi
call fcn.006fdf60
push 0x7168f8
push edi
call fcn.006ff3f0
push eax
push ebx
push esi
call fcn.006fdf60
push 0x7168d8
push edi
call fcn.006ff3f0
push eax
push ebx
push esi
call fcn.006fdf60
push 0x7168c0
push edi
call fcn.006ff3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.006fdf60
push 0x7168a0
push edi
call fcn.006ff3f0
push eax
push ebx
push esi
call fcn.006fdf60
push 0x716888
push edi
call fcn.006ff3f0
push eax
push ebx
push esi
call fcn.006fdf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6ff1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006ff140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006ff140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006ff140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006ff140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6ffbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6ffc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x71187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6ffc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6ffc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x406dc0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20c
mov eax, dword [0x543fcc]
push esi
mov dword [esp + 0x20c], eax
call fcn.0040d020
call fcn.0040d020
call fcn.0040c440
movsx eax, al
push eax
call fcn.0040c330
movsx ecx, al
push ecx
push 0x53618c
push str._s_02d_02d
lea edx, [esp + 0x14]
push 0x103
push edx
call fcn.004edc35
add esp, 0x18
lea eax, [esp + 4]
push eax
push 1
push 0
mov byte [esp + 0x113], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406e56
push str.GameServer_already_operating_now._please_shutdown_and_restart
push 0x50
push str.D:ProjectBranch1700ServerRylServerProjectRylGameServerRylGameServerMain.cpp
push str.WinMain
push 5
push 0x5637d0
call fcn.0040e630
add esp, 0x18
jmp 0x406efe
push edi
jmp 0x505eda
call fcn.004ee596
push 0x406c90
call fcn.004edd55
add esp, 8
push 7
call fcn.00414b60
mov ecx, eax
call fcn.00414a00
call fcn.00414b60
mov dword [eax + 0x40], 0x406d50
call fcn.00414b60
mov dword [eax + 0x10648], 2
call fcn.00405030
mov edi, eax
call fcn.0040d020
call fcn.0040d020
call fcn.0040c440
movsx ecx, al
push ecx
call fcn.0040c330
movsx edx, al
push edx
lea eax, [esp + 0x114]
push str.RylGameServer_Zone__d_Channel__d
push eax
call fcn.004ee183
mov ecx, dword [esp + 0x230]
mov eax, dword [esp + 0x228]
add esp, 0x10
push 0x65
push 0x6f
push ecx
lea edx, [esp + 0x118]
push edx
push eax
mov ecx, edi
call fcn.0040a200
test al, al
je 0x406efd
mov ecx, edi
call fcn.0040a320
pop edi
test esi, esi
je 0x406f09
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x20c]
xor eax, eax
pop esi
call fcn.004eee51
add esp, 0x20c
ret 0x10
push 0x406bd0
pushal
push 0x505ef2
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
popal
jmp 0x406e5c

Function at 0x407110
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors
Get process heap flags

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x504e58
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
push 0x64
push edi
mov ecx, esi
call fcn.00409c30
mov dword [esp + 0xc], 0
mov dword [esi], 0x536344
mov dword [esi + 0x14], edi
call fcn.00425c10
mov dword [esi + 0x18], eax
call fcn.0044d1f0
mov dword [esi + 0x1c], eax
mov eax, dword [0x6b5818]
mov dword [esi + 0x20], eax
call fcn.00464e50
mov dword [esi + 0x24], eax
call fcn.0045e6e0
mov dword [esi + 0x28], eax
call fcn.004720f0
mov dword [esi + 0x2c], eax
call fcn.0046f250
mov dword [esi + 0x30], eax
call fcn.0045dad0
mov dword [esi + 0x34], eax
call fcn.00469540
mov dword [esi + 0x38], eax
call fcn.0046b940
push fcn.004082b0
push 0x406f30
push 0xe
push 0x18
lea ecx, [esi + 0x40]
push ecx
mov dword [esi + 0x3c], eax
call fcn.004ee664
mov dword [esi + 0x190], fcn.0046fe20
mov dword [esi + 0x194], fcn.0046f570
mov dword [esi + 0x198], fcn.0046f3b0
lea ecx, [esi + 0x50]
xor eax, eax
nop
mov edx, dword [eax + 0x54514c]
mov dword [ecx], edx
add eax, 8
add ecx, 0x18
cmp eax, 0x70
jb 0x4071d0
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4
Function at 0x4ee34b
Capabilities:
Terminate process

Disassembly:
push 8
push 0x530a80
call fcn.004f4080
push 8
call fcn.004f3548
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x6b51d4], esi
jne 0x4ee37f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x6b51d0], esi
mov al, byte [ebp + 0x10]
mov byte [0x6b51cc], al
cmp dword [ebp + 0xc], edi
jne 0x4ee3c9
cmp dword [0x6b6e10], edi
je 0x4ee3b9
mov eax, dword [0x6b6e0c]
sub eax, 4
mov dword [0x6b6e0c], eax
cmp eax, dword [0x6b6e10]
jb 0x4ee3b9
mov eax, dword [eax]
cmp eax, edi
je 0x4ee39a
call eax
jmp 0x4ee39a
push 0x5400e8
mov eax, 0x5400e0
call fcn.004ee2c9
pop ecx
push 0x5400f4
mov eax, 0x5400ec
call fcn.004ee2c9
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4ee3fa
cmp dword [ebp + 0x10], edi
jne 0x4ee408
mov dword [0x6b51d4], esi
push dword [ebp + 8]
call fcn.004ee287
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4ee407
push 8
call fcn.004f3493
pop ecx
ret
call fcn.004f40bb
ret
Function at 0x4ee748
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x530cb8
call fcn.004f4080
mov edi, 0x94
mov eax, edi
call fcn.004eeec0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x6b5194], ecx
mov eax, dword [esi + 4]
mov dword [0x6b51a0], eax
mov edx, dword [esi + 8]
mov dword [0x6b51a4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x6b5198], esi
cmp ecx, 2
je 0x4ee7a8
or esi, 0x8000
mov dword [0x6b5198], esi
shl eax, 8
add eax, edx
mov dword [0x6b519c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4ee7e3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ee7e3
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4ee7fb
cmp eax, 0x20b
je 0x4ee7e8
mov dword [ebp - 0x1c], esi
jmp 0x4ee80f
cmp dword [ecx + 0x84], 0xe
jbe 0x4ee7e3
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4ee809
cmp dword [ecx + 0x74], 0xe
jbe 0x4ee7e3
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004f60d8
pop ecx
test eax, eax
jne 0x4ee823
push 0x1c
call fcn.004ee724
pop ecx
call fcn.004f4e3f
test eax, eax
jne 0x4ee834
push 0x10
call fcn.004ee724
pop ecx
call fcn.004f550b
mov dword [ebp - 4], esi
call fcn.004f5ec0
test eax, eax
jge 0x4ee84d
push 0x1b
call fcn.004ee6ff
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x6b6e04], eax
call fcn.004f5d9e
mov dword [0x6b51dc], eax
call fcn.004f5cfc
test eax, eax
jge 0x4ee873
push 8
call fcn.004ee6ff
pop ecx
call fcn.004f5ac9
test eax, eax
jge 0x4ee884
push 9
call fcn.004ee6ff
pop ecx
push 1
call fcn.004ee2e1
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4ee89a
push eax
call fcn.004ee6ff
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004f5a6c
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4ee8bb
movzx eax, word [ebp - 0x40]
jmp 0x4ee8be
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00406dc0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4ee8dc
push edi
call fcn.004ee40e
call fcn.004ee430
jmp 0x4ee90e
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004f40bb
ret
Function at 0x4effd7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x4efff4
call fcn.004f1786
mov dword [eax], 0x16
xor eax, eax
jmp 0x4f005e
push esi
push 0x8c
push 1
call fcn.004f1b85
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4f0049
push esi
call fcn.004f4c45
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x4f0027
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x4eff42
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4f005d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.004f011d
test ebx, ebx
pop ecx
je 0x4f005b
push ebx
call fcn.004f1798
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4f05a4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004eeec0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4f063f
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x6b5194]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4f063f
cmp eax, 1
je 0x4f0660
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4f063f
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4f060c
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4f063b
xor eax, eax
inc eax
jmp 0x4f067f
cmp edi, eax
jae 0x4f0643
xor eax, eax
jmp 0x4f067f
cmp eax, esi
jae 0x4f064a
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x6b5194]
jmp 0x4f0663
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4f5593
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x6b537c], ebx
push esi
push edi
jne 0x4f5613
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4f564e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5317ec
push edi
call esi
test eax, eax
mov dword [0x6b537c], eax
je 0x4f564e
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x6b5380], eax
call esi
cmp dword [0x6b5194], 2
mov dword [0x6b5384], eax
jne 0x4f5613
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x6b538c], eax
je 0x4f5613
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x6b5388], eax
mov eax, dword [0x6b5388]
test eax, eax
je 0x4f5658
call eax
test eax, eax
je 0x4f563f
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x6b538c]
test eax, eax
je 0x4f563f
test byte [ebp - 8], 1
jne 0x4f5658
cmp dword [0x6b51a0], 4
jb 0x4f5652
or byte [ebp + 0x12], 0x20
jmp 0x4f5677
xor eax, eax
jmp 0x4f5687
or byte [ebp + 0x12], 4
jmp 0x4f5677
mov eax, dword [0x6b5380]
test eax, eax
je 0x4f5677
call eax
mov ebx, eax
test ebx, ebx
je 0x4f5677
mov eax, dword [0x6b5384]
test eax, eax
je 0x4f5677
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x6b537c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x444a6a
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x10]
call fcn.00445c67
call 0x46e5b6
aaa
lea ebp, [ebx - 0x71e88889]
push ebp
mov ebp, dword [eax - 0x75bf4493]
das
and ch, 0x1f
mov ebx, 0x802f8a40
in eax, 0x1f
in al, 9
mov esi, 0xe5503124
inc esi
wait
enter 0xfffffffffffff5d9, 5
xor dh, byte [ebp + 0x445557ed]
adc byte [edi], bh
mov word [ecx + edi*2 + 0x26], ds
dec byte [eax + 0x21]
add byte [ebp - 0x59214f10], 0x66
les ebp, [ecx]
imul ecx, eax, 0xffffffef
je 0x444a83
ficom dword [ecx]
salc
insb byte es:[edi], dx
retf 0x64d8

Function at 0x4455e4
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov byte [esp], bh
mov edi, dword [edi + ecx*4]
push dword [esp + 4]
bt si, cx
test dh, ah
stc
test edi, edi
jmp 0x4735e8
cmp eax, dword [ebp - 0x10]
call fcn.0044520b
add byte [eax], al
inc ebp
js 0x46ba0f
je 0x46b9f8
jb 0x46ba19
arpl word [ebp + 0x73], sp
jae fcn.0046b9af
invalid
fist word [eax - 0x1d3e6334]
sbb dh, byte [edi + 0x7b]
mov eax, 0xc48f32a0
out 0xbf, eax
in al, dx
jge 0x46ba28
jmp [ebp + 0x51d291da]
rcl byte [ecx - 0x6c], cl
xchg edx, ecx
xchg ebp, eax
retf
jmp 0x46ba49
push ds
push es
dec esi
push cs
push ebx
push esi
stosd dword es:[edi], eax
xchg edx, eax
fucomi st(6)
mov cs, word [ebp - 0x3c]
add ecx, esi
rol byte [esi], cl
pop ecx
mov eax, dword [0xf6e4d8d2]
jb 0x46ba74
xchg esp, eax
into
lahf
add eax, 0x509bc5a
aad 0x26
in al, dx
jns 0x46b9f0
add eax, 0x79ec26d5
mov eax, dword [0x4f713860]
pushal
cmp byte [ecx + 0x4f], dh
xchg bl, bl
or dword [ebp + 0x58], esp
mov esi, 0xee88c3fb
aad 0x7e
pop esi
and al, dh
push ecx
cmp byte [edi - 0x7561ce21], ah
adc cl, byte [edx + 0x52746fc9]
test ebp, edi
or al, 0xba
cmpsd dword [esi], dword es:[edi]
cmp ebp, dword [eax + 0x72]
cld
sbb dword [edx + 0x29], ebp
add ebp, 0x6a
int3
jmp 0x43cc6e
lea esp, [esp + 0x34]
je fcn.0043b781
pushfd
pushal
cmc
add eax, edi
test cl, ah
clc
test dl, dl
cmp eax, edx
push ebp
mov byte [esp + 4], 0x82
lea esp, [esp + 0x28]
jns 0x46d128
jb 0x43b78c
cmp bl, 0x13
jmp 0x46b999
Function at 0x4014f0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40155a
lea eax, [ebp - 0xc]
push eax
push 0x40115c
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x401551
mov eax, dword [ebp - 0xc]
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push 0
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret

Function at 0x40155c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x401120]
xor eax, dword [ebp + 4]
and dword [ebp - 0x12c], 0
push edi
push 0x49
pop ecx
mov dword [ebp - 4], eax
xor eax, eax
push eax
lea edi, [ebp - 0x128]
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x401598
xor eax, eax
jmp 0x40160f
push esi
lea eax, [ebp - 0x12c]
push eax
push edi
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4015de
xor esi, esi
jmp 0x4015fc
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4015be
sub eax, edx
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call fcn.00401eb0
add esp, 0xc
test eax, eax
je 0x401608
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4015b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x12
je 0x4015fd
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x40160e
mov eax, dword [ebp - 0x124]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
call fcn.00401f1a
leave
ret

Function at 0x4017a1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [ebp + 8]
push 0x2ff
push edi
call fcn.00401667
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
mov dword [ebp - 4], ebx
je 0x401813
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push ebx
push edi
call esi
mov edx, 0xff
xor ecx, ecx
call fcn.00401763
mov ecx, ebx
mov bl, al
mov bh, bl
mov edx, ecx
shr ecx, 2
mov eax, ebx
shl eax, 0x10
mov ax, bx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
mov eax, 0xc3c3c3c3
lea edi, [edx + ecx]
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push edx
push ecx
call esi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x401817
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
push 0x2ff
push edi
call fcn.00401667
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x401872
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call esi
mov ecx, ebx
mov edx, ecx
shr ecx, 2
mov eax, 0x90909090
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
mov eax, 0xc3c3c3c3
lea edi, [ebx + ecx]
stosb byte es:[edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
push ecx
call esi
pop esi
pop edi
pop ebx
leave
ret

Function at 0x401876
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [ebp + 0x3c]
push edi
lea eax, [esp + 0x14]
push eax
add esi, ebp
mov ebx, dword [esi + 0x54]
push 0x40
add ebx, 0x40
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
push 0x8000
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ebx, dword [esi + 0x80]
lea eax, [esp + 0x14]
push eax
push 0x40
push dword [esi + 0x84]
add ebx, ebp
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esi + 0x84]
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
push 0x8000
rep stosb byte es:[edi], al
push dword [esi + 0x84]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x401904
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea eax, [ebp - 4]
push eax
push 0x40
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
leave
ret
Function at 0x401ab5
Capabilities:
Copy file
Get file size
Read file via mapping
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x401120]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
mov esi, 0x104
push esi
mov dword [ebp - 4], eax
call fcn.00401d90
pop ecx
push esi
push eax
xor esi, esi
push esi
mov dword [0x4029c4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1c]
push eax
call fcn.00401f55
push esi
call fcn.00401f55
imul eax, dword [ebp - 0x1c]
push eax
call fcn.00401f28
call fcn.00401f32
cdq
mov ecx, 0x1869f
idiv ecx
mov edi, 0x4028c0
push edx
push 0x4011a8
push edi
call fcn.00401d7c
add esp, 0x18
push esi
push edi
push dword [0x4029c4]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
push 0x80
push 3
push esi
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push esi
push esi
push 2
push esi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push esi
push esi
push 4
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push esi
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push edi
lea eax, [ebp - 0x424]
push 0x4011a4
push eax
mov dword [ebp - 0x10], ebx
call fcn.00401d7c
add esp, 0xc
cmp ebx, 0x3a98
jbe 0x401baf
push 2
push esi
lea edi, [ebx - 0x1388]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push dword [ebp - 8]
call ebx
push esi
push esi
push edi
jmp 0x401bb8
push esi
push esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp - 8]
call ebx
push 0x64
pop edx
push 0xa
pop ecx
call fcn.00401763
push eax
mov dword [ebp - 0xc], eax
call fcn.00401d90
pop ecx
mov ecx, dword [ebp - 0xc]
mov edx, ecx
mov edi, eax
shr ecx, 2
mov dword [ebp - 0x20], edi
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
push esi
rep stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push eax
mov edi, edx
push edi
push dword [ebp - 0x20]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x10]
push 2
push esi
add edi, eax
push edi
push dword [ebp - 8]
call ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 8]
call esi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.00401f1a
leave
ret