joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c50a910
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5c50d0e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x110], eax
xor ebx, ebx
lea eax, [ebp - 0x108]
mov edi, ecx
push eax
push ebx
push 0x5c502578
push 0x5c50257c
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x5c50a95a
mov eax, 0x88760357
jmp 0x5c50a9ff
push esi
push ebx
push 0x8000080
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5c50a985
mov eax, 0x88760361
jmp 0x5c50a9fe
cmp dword [edi + 0x18], ebx
jne 0x5c50a9b4
push 0x10
pop edx
lea ecx, [ebp - 0x10c]
call fcn.5c507396
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x5c50aa0f
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], 0xa
mov dword [eax + 0xc], ebx
mov dword [edi + 0x18], eax
lea ecx, [ebp - 0x108]
call fcn.5c508efb
mov ebx, eax
mov dword [ebp - 0x10c], ebx
test ebx, ebx
je 0x5c50a9e5
mov ecx, dword [edi + 0x18]
lea eax, [ebp - 0x10c]
push eax
call fcn.5c5067bf
test eax, eax
jns 0x5c50aa14
mov ecx, ebx
call fcn.5c5073fb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 0x88760356
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.5c50c960
leave
ret 8
mov dword [edi + 0x18], ebx
jmp 0x5c50a9e5
push 0
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x110]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x5c50a9fe
Function at 0x5c50aa3e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5c50d0e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x18]
test eax, eax
je 0x5c50ac09
xor ebx, ebx
cmp dword [eax], ebx
je 0x5c50ac09
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x5c50ac09
cmp dword [eax], ebx
je 0x5c50ac09
mov eax, dword [esi + 8]
sub eax, ebx
je 0x5c50aaa3
sub eax, 1
jne 0x5c50aaaa
push dword [esi + 0x20]
call fcn.5c50a273
push 0x5c502580
push esi
call fcn.5c50afda
pop ecx
pop ecx
jmp 0x5c50aaaa
push 0x37
call fcn.5c50b081
push 1
push ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
mov dword [ebp - 0x94], edi
cmp edi, 0xffffffff
je 0x5c50ac1a
mov ecx, dword [esi + 0x18]
mov dword [ebp - 0x98], ebx
cmp dword [ecx], ebx
jbe 0x5c50ac09
mov eax, dword [esi + 0x1c]
mov ecx, ebx
push 0
push 0
mov eax, dword [eax + 0xc]
push dword [eax + ecx*4]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5c50ac1a
push edi
mov ecx, esi
call fcn.5c50b0d4
push 0
mov ecx, esi
call fcn.5c50b0d4
push 0
push 0
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x5c50ac1a
mov eax, dword [esi + 0x18]
mov ecx, ebx
shl ecx, 2
mov eax, dword [eax + 0xc]
add eax, ecx
xor ecx, ecx
push ecx
push 0x8000080
push 3
push ecx
push ecx
push 0x80000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x90], eax
cmp eax, 0xffffffff
je 0x5c50ac1a
and dword [ebp - 0x8c], 0
lea ecx, [ebp - 0x88]
push 0
push ecx
push 0x80
lea ecx, [ebp - 0x84]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5c50abdf
mov ebx, dword [ebp - 0x90]
mov edi, dword [ebp - 0x8c]
cmp dword [ebp - 0x88], 0
je 0x5c50abcd
lea eax, [ebp - 0x84]
mov ecx, esi
push eax
push dword [ebp - 0x88]
call fcn.5c50b059
add edi, dword [ebp - 0x88]
lea eax, [ebp - 0x88]
push 0
push eax
push 0x80
lea eax, [ebp - 0x84]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5c50ab8a
mov ebx, dword [ebp - 0x98]
mov dword [ebp - 0x8c], edi
mov edi, dword [ebp - 0x94]
push dword [ebp - 0x90]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, dword [ebp - 0x8c]
inc ebx
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x98], ebx
cmp ebx, dword [eax]
jb 0x5c50aad9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.5c50c960
leave
ret
mov eax, 0x88760361
jmp 0x5c50ac0b
Function at 0x5c50afda
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x5c50d0e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll__vscprintf]
inc eax
pop ecx
pop ecx
cmp eax, 0x400
jle 0x5c50b00e
xor eax, eax
jmp 0x5c50b046
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.msvcrt.dll_vsprintf_s]
add esp, 0x10
lea ecx, [ebp - 0x408]
push 0
push ecx
push eax
lea eax, [ebp - 0x404]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.5c50c960
leave
ret

Function at 0x5c50b081
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
movzx eax, bl
mov esi, ecx
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 8]
sar ebx, 8
push eax
push 1
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
pop eax
pop esi
pop ebx
leave
ret 4
Function at 0x5c5144ab
Capabilities:
Encode data using xor

Disassembly:
call 0x5c514424
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x5c514454
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x5c514470
xor edx, 0
jmp 0x5c51447b
xor edx, edx
jmp 0x5c514492
jmp 0x5c51449e
xor eax, eax
push 0x8427d7c0
call 0x5c5144ab
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x5c5144e7
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x5c5144c0
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x5c5144fe
add eax, 0
jno 0x5c514503
add esi, 0
ret 0x10
Function at 0x403ff0
Capabilities:
Access pe header

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x404033
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x404033
mov ecx, dword [esi + 0x3c]
movzx eax, word [ecx + esi + 6]
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*8]
add ecx, 0xf8
add ecx, esi
cmp dword [ecx], 0x11ffee00
jne 0x404033
cmp dword [ecx + 4], 0xaabbcc
jne 0x404033
xor eax, eax
cmp dword [ecx + 0x10], esi
pop esi
cmove eax, ecx
ret
xor eax, eax
pop esi
ret
Function at 0x404fd0
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x435090
push 0x40d8b0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x437040]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], edx
mov eax, ecx
mov dword [ebp - 0x28], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [esi], 0
je 0x4050fb
mov edx, dword [esi + 4]
test edx, edx
je 0x4050fb
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x40503d
inc ecx
mov dword [esi + 8], ecx
mov eax, dword [esi + 0xc]
dec eax
mov dword [esi + 0xc], eax
jmp 0x4050a5
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov ecx, eax
mov dword [ebp + 8], ecx
mov dword [ebp - 0x20], 0
test ecx, ecx
je 0x4050f4
movzx edi, word [ecx + 0x14]
add edi, 0x18
add edi, ecx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], edi
cmp bx, word [ecx + 6]
jae 0x405090
push 8
push edi
push dword [ebp - 0x24]
call fcn.0041601c
add esp, 0xc
test eax, eax
jne 0x4050d6
mov eax, dword [edi + 0xc]
add eax, dword [ebp - 0x28]
mov dword [esi + 8], eax
mov eax, dword [edi + 8]
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4050df
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4050df
mov edx, dword [esi + 4]
cmp eax, edx
jb 0x4050df
mov ebx, ecx
sub ebx, edx
add ebx, eax
nop dword [eax + eax]
cmp ecx, ebx
ja 0x4050df
mov edi, dword [esi + 4]
push edx
push ecx
push dword [esi]
call fcn.00404fa0
cmp eax, edi
je 0x405110
mov ecx, dword [esi + 8]
inc ecx
mov dword [esi + 8], ecx
mov eax, dword [esi + 0xc]
dec eax
mov dword [esi + 0xc], eax
mov edx, edi
jmp 0x4050b0
add edi, 0x28
inc ebx
mov ecx, dword [ebp + 8]
jmp 0x405063
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, 0xc0000225
jmp 0x40512a
mov eax, 0xc00000ef
jmp 0x40512a
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, 0xc000000d
jmp 0x40512a
xor eax, eax
jmp 0x40512d
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4051e0
Capabilities:
Access pe header
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4350b0
push 0x40d8b0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x437040]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], 0
test eax, eax
je 0x405230
mov dword [eax], 0
push ecx
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov esi, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
test esi, esi
jne 0x405266
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [esi + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x4052c4
mov ecx, 0x20b
cmp ax, cx
jne 0x40524b
movzx ebx, word [esi + 0x14]
add ebx, 0x18
add ebx, esi
mov dword [ebp - 0x24], ebx
mov edi, dword [esi + 0x54]
mov dword [ebp - 0x20], edi
push ecx
movzx eax, word [esi + 6]
lea edx, [eax + eax*4]
shl edx, 3
mov ecx, ebx
call fcn.004053b0
xor eax, eax
mov dword [ebp - 0x28], eax
cmp ax, word [esi + 6]
jae 0x4052bc
add edi, dword [ebx + 0x10]
mov dword [ebp - 0x20], edi
inc eax
add ebx, 0x28
mov dword [ebp - 0x24], ebx
jmp 0x4052a4
add edi, dword [esi + 0xac]
jmp 0x405308
movzx ebx, word [esi + 0x14]
add ebx, 0x18
add ebx, esi
mov dword [ebp - 0x24], ebx
mov edi, dword [esi + 0x54]
mov dword [ebp - 0x20], edi
push ecx
movzx eax, word [esi + 6]
lea edx, [eax + eax*4]
shl edx, 3
mov ecx, ebx
call fcn.004053b0
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp ax, word [esi + 6]
jae 0x405302
add edi, dword [ebx + 0x10]
mov dword [ebp - 0x20], edi
inc eax
add ebx, 0x28
mov dword [ebp - 0x24], ebx
jmp 0x4052ea
add edi, dword [esi + 0x9c]
mov dword [ebp - 0x20], edi
mov esi, dword [esi + 0x58]
push ecx
mov edx, edi
mov ebx, dword [ebp - 0x30]
mov ecx, ebx
call fcn.004053b0
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x405324
mov dword [eax], edi
test esi, esi
jne 0x405343
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov edx, edi
mov ecx, ebx
call fcn.00405150
add esp, 4
mov byte [ebp - 0x19], al
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405860
Capabilities:
Access pe header
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4350d0
push 0x40d8b0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x437040]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], edx
mov edi, ecx
mov dword [ebp - 4], 0
test edx, edx
je 0x4058a9
mov dword [edx], 0
mov dword [ebp - 4], 0xfffffffe
xor ebx, ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0xa0]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
nop word [eax + eax]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0xc
cmp esi, eax
je 0x405995
movzx eax, word [esi + 0x24]
push eax
push edi
push dword [esi + 0x28]
call fcn.00416154
add esp, 0xc
test eax, eax
jne 0x4059d4
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405915
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
movzx eax, word [esi + 0x24]
cmp ecx, eax
jne 0x4059d4
mov edi, dword [esi + 0x18]
test edi, edi
je 0x40596e
push edi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x40596e
mov ecx, dword [edi + 0x3c]
movzx eax, word [ecx + edi + 6]
lea eax, [eax + eax*4]
lea eax, [eax + 0x1f]
lea eax, [ecx + eax*8]
add eax, edi
cmp dword [eax], 0x11ffee00
jne 0x40596e
cmp dword [eax + 4], 0xaabbcc
jne 0x40596e
cmp dword [eax + 0x10], edi
je 0x405970
xor eax, eax
xor ebx, ebx
test eax, eax
setne bl
mov dword [ebp - 0x20], ebx
test eax, eax
je 0x405995
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x405995
mov dword [ebp - 4], 1
mov dword [eax], esi
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0xa0]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi]
jmp 0x4058e0
Function at 0x405ee0
Capabilities:
Access pe header
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00405a00
mov ebx, eax
test ebx, ebx
je 0x405ff2
mov ecx, dword [ebx + 0xc]
push edi
xor edi, edi
mov dword [ebp + 8], edi
mov esi, dword [ecx + 0x18]
test esi, esi
je 0x405fdf
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x405fdf
mov ecx, dword [esi + 0x3c]
movzx eax, word [ecx + esi + 6]
lea eax, [eax + eax*4]
lea eax, [eax + 0x1f]
lea eax, [ecx + eax*8]
add eax, esi
cmp dword [eax], 0x11ffee00
jne 0x405fdf
cmp dword [eax + 4], 0xaabbcc
jne 0x405fdf
cmp dword [eax + 0x10], esi
jne 0x405fdf
test eax, eax
je 0x405fdf
cmp dword [ebx + 0x10], edi
je 0x405fe8
push dword [eax + 0x24]
mov edx, dword [eax + 0x14]
lea ecx, [ebp + 8]
call fcn.00404110
mov edi, dword [ebp + 8]
add esp, 4
test edi, edi
je 0x405fdf
mov eax, dword fs:[0x18]
push 0x14
push 8
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, dword [ebp + 8]
mov esi, eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 0
mov ecx, dword [0x438ce4]
mov ecx, dword [ecx + 0x4c]
add ecx, 8
push ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x438ce4]
mov ecx, dword [eax + 0x4c]
mov eax, dword [ecx + 0x24]
add ecx, 0x20
mov dword [esi + 4], eax
mov dword [esi], ecx
mov dword [eax], esi
mov dword [ecx + 4], esi
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x4c]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov eax, dword [eax + 0x14]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
push dword [ebp + 0x1c]
mov eax, dword [0x438ce4]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov eax, dword [eax + 0x4c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x44]
push esi
call eax
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x4068e0
Capabilities:
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x437040]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword fs:[0x18]
mov eax, dword fs:[0x18]
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x10c], 0
mov eax, dword [eax + 0x30]
push esi
cmp dword [eax + 0x1d4], 0
mov eax, dword [ecx + 0x30]
mov ecx, dword [ecx + 0x20]
not ecx
jne 0x40694d
xor ecx, dword [eax + 0x18]
lea eax, [ebp - 0x108]
push ecx
push str.BaseNamedObjectsMMPP_p
push eax
call fcn.00407110
add esp, 0xc
jmp 0x406974
xor ecx, dword [eax + 0x18]
mov eax, dword fs:[0x18]
push ecx
mov eax, dword [eax + 0x30]
push dword [eax + 0x1d4]
lea eax, [ebp - 0x108]
push str.Sessions_dBaseNamedObjectsMMPP_p
push eax
call fcn.00407110
add esp, 0x10
lea ecx, [ebp - 0x108]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406980
sub ecx, edx
mov dword [ebp - 0x140], 0x18
sar ecx, 1
push 0
push 0x8000000
push 4
lea eax, [ecx + ecx]
mov dword [ebp - 0x13c], 0
mov word [ebp - 0x114], ax
add eax, 2
mov word [ebp - 0x112], ax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x140]
mov dword [ebp - 0x134], 0
push eax
push 0xf001f
lea eax, [ebp - 0x124]
mov dword [ebp - 0x130], 0
push eax
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x120], 0x1000
mov dword [ebp - 0x11c], 0
call dword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
js 0x406a77
push 4
push 0
push 2
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0
push 0x438ce4
push 0xffffffffffffffff
push dword [ebp - 0x124]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov esi, eax
test esi, esi
jns 0x406a66
push dword [ebp - 0x124]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c1c5
mov esp, ebp
pop ebp
ret
cmp eax, 0xc0000035
jne 0x406a68
lea eax, [ebp - 0x140]
push eax
push 0xf001f
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.ntdll.dll_NtOpenSection]
test eax, eax
js 0x406a68
push 2
push 0
push 2
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x128]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x124]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push dword [ebp - 0x124]
mov esi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x406a66
mov ecx, dword [ebp - 0x128]
push ecx
push 0xffffffffffffffff
mov eax, dword [ecx + 0x50]
mov dword [0x438ce4], eax
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov ecx, dword [ebp - 4]
mov eax, 0xc0000510
xor ecx, ebp
pop esi
call fcn.0040c1c5
mov esp, ebp
pop ebp
ret
Function at 0x407400
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x435178
push 0x40d8b0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x437040]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x34]
cmp word [ecx], ax
jne 0x4074a3
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x4074a3
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x4074a3
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x4074a3
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x4074ac
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040c1c5
mov esp, ebp
pop ebp
ret
Function at 0x407730
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x437040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x4077f8
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x407776
sub edi, 0x8000000
jmp 0x4077f0
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4077f8
cmp dword [ebp - 0x10], 0x10000
jne 0x4077db
cmp dword [ebp - 0x14], 0x10000
jb 0x4077db
push 0x40
push 0x3000
push 0x10000
push edi
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x4078b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x4077f8
sub edi, 0x10000
jmp 0x4077f0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x407761
movzx eax, si
test eax, eax
je 0x407807
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 8]
cmp esi, edi
jae 0x4078b1
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
nop dword [eax + eax]
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x407835
add esi, 0x8000000
jmp 0x4078a9
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call ebx
test eax, eax
je 0x4078b1
cmp dword [ebp - 0x10], 0x10000
mov ecx, dword [ebp - 0x14]
jne 0x407894
cmp ecx, 0x10000
jb 0x407894
push 0x40
push 0x3000
push 0x10000
push esi
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x4078b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x677
je 0x4078b1
add esi, 0x10000
jmp 0x4078a9
mov esi, dword [ebp - 0x20]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x4078a9
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x407820
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c1c5
mov esp, ebp
pop ebp
ret
Function at 0x4078d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x437040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x438d14], 0
jne 0x407959
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x438d14
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x407959
push esi
mov esi, dword [0x438d20]
mov dword [0x438d28], eax
mov dword [0x438d24], eax
mov dword [0x438d1c], eax
push edi
test esi, esi
je 0x40793a
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x407951
mov esi, dword [esi + 4]
test esi, esi
jne 0x407921
xor eax, eax
pop edi
mov dword [0x438d10], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c1c5
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40793c
mov ecx, dword [ebp - 4]
mov eax, 0x10dd
xor ecx, ebp
call fcn.0040c1c5
mov esp, ebp
pop ebp
ret
Function at 0x407dd0
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x438d10]
test eax, eax
jne 0x407e41
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp eax, 0xfffffffe
jne 0x407de7
xor eax, eax
ret
push edi
push 8
call fcn.0040c1d8
add esp, 4
mov edi, eax
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x407e2a
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 8
push edi
call fcn.0040c208
add esp, 8
mov dword [0x438d10], esi
mov eax, esi
mov dword [0x438d1c], 0
pop esi
pop edi
ret
mov eax, dword [0x438d24]
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], 0xfffffffe
mov dword [0x438d24], edi
pop edi
ret