joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b5a0
Capabilities:
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0x1c]
or eax, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x34], 0
jne 0x42b5be
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp + 0x34], ecx
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp + 0x34]
test eax, eax
jne 0x42b5f1
xor eax, eax
jmp 0x42b665
mov dword [ebp - 0x20], 0
cmp dword [ebp + 0x30], 0
je 0x42b611
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x30]
mov dword [ebp + eax*4 - 0xc], ecx
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.0042a720
test eax, eax
jne 0x42b636
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
jmp 0x42b665
cmp dword [ebp + 0x2c], 0
je 0x42b64e
push 0x10
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x2c]
push edx
call fcn.0041f250
add esp, 0xc
mov eax, dword [ebp + 0x1c]
and eax, 4
jne 0x42b660
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0x30
Function at 0x43d7b0
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x475080]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x218], ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x465f38
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43d7f4
xor eax, eax
jmp 0x43d8b0
cmp dword [ebp + 0xc], 0
je 0x43d893
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.0041eb30
add esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x43d839
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x43d84a
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 0x214]
push ecx
lea edx, [ebp - 0x210]
push edx
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x43d891
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x43d8b0
jmp 0x43d8a1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041d97a
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43d9f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x475080]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0xc], 7
mov dword [ebp - 4], 0xf003f
cmp dword [ebp + 0x14], 0
je 0x43da2a
mov eax, dword [ebp - 4]
or eax, 0x100
mov dword [ebp - 4], eax
jmp 0x43da3f
call sym.Install_vip.exe_int___cdecl_isWow64_void_
test eax, eax
je 0x43da3f
mov ecx, dword [ebp - 4]
or ecx, 0x200
mov dword [ebp - 4], ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43dac7
mov dword [ebp - 0x10], 0x104
push 0x20a
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.0041eb30
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43dabd
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x43dac9
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041d97a
mov esp, ebp
pop ebp
ret 0x14
Function at 0x43dd30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
push 0x26c
call fcn.0041e086
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [edx + 0x25c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [ecx + 0x260], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x264], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x268], eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], 0
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push sym.Install_vip.exe_public:_static_unsigned_long_int___stdcall_CNsReg::MonitorThread_void__
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43ddcd
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x43f0f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45bdb1
mov eax, dword fs:[0]
push eax
sub esp, 0x8c4
mov eax, dword [0x475080]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call sym.Install_vip.exe_private:_bool___thiscall_CNsLog::isLog_void_
movzx eax, al
test eax, eax
jne 0x43f131
jmp 0x43f283
lea esi, [ebp - 0x14]
call fcn.00405900
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call sym.Install_vip.exe_private:_void___thiscall_CNsLog::GetLogFileName_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____
push 0x466094
lea eax, [ebp - 0x14]
call fcn.00405aa0
push eax
call fcn.0043408e
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43f274
lea edx, [ebp + 0x10]
mov dword [ebp - 0x18], edx
xor eax, eax
mov word [ebp - 0x82c], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x82a]
push ecx
call fcn.0041eb30
add esp, 0xc
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x400
lea ecx, [ebp - 0x82c]
push ecx
call fcn.004359e2
add esp, 0x10
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea esi, [ebp - 0x8b8]
call fcn.00405900
mov byte [ebp - 4], 1
lea eax, [ebp - 0x82c]
push eax
movzx ecx, word [ebp - 0x20]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x26]
push ecx
movzx edx, word [ebp - 0x2a]
push edx
movzx eax, word [ebp - 0x2c]
push eax
push 0x4660c0
lea edi, [ebp - 0x8b8]
call fcn.00406090
add esp, 0x20
lea eax, [ebp - 0x8b8]
call fcn.00405aa0
push eax
lea ecx, [ebp - 0x8b4]
call fcn.00415290
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x8b4]
call fcn.00415250
push eax
call fcn.0041f1c0
add esp, 4
push eax
push 1
lea ecx, [ebp - 0x8b4]
call fcn.00415250
push eax
call fcn.00433f4b
add esp, 0x10
mov edx, dword [ebp - 0x10]
push edx
call fcn.0042802a
add esp, 4
lea ecx, [ebp - 0x8b4]
call fcn.00415060
mov byte [ebp - 4], 0
lea eax, [ebp - 0x8b8]
call fcn.00405b50
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x14]
call fcn.00405b50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041d97a
mov esp, ebp
pop ebp
ret
Function at 0x43f2a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45bdec
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x475080]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd4], ecx
mov ecx, dword [ebp - 0xd4]
call sym.Install_vip.exe_private:_bool___thiscall_CNsLog::isLog_void_
movzx eax, al
test eax, eax
jne 0x43f2ea
jmp 0x43f3f4
lea esi, [ebp - 0x14]
call fcn.00405900
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0xd4]
call sym.Install_vip.exe_private:_void___thiscall_CNsLog::GetLogFileName_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____
push 0x46602c
lea eax, [ebp - 0x14]
call fcn.00405aa0
push eax
call fcn.0043408e
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43f3e5
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea esi, [ebp - 0xb8]
call fcn.00405900
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
movzx ecx, word [ebp - 0x1c]
push ecx
movzx edx, word [ebp - 0x1e]
push edx
movzx eax, word [ebp - 0x20]
push eax
movzx ecx, word [ebp - 0x22]
push ecx
movzx edx, word [ebp - 0x26]
push edx
movzx eax, word [ebp - 0x28]
push eax
push 0x466050
lea edi, [ebp - 0xb8]
call fcn.00406090
add esp, 0x20
lea eax, [ebp - 0xb8]
call fcn.00405aa0
push eax
lea ecx, [ebp - 0xb4]
call fcn.00415290
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xb4]
call fcn.00415250
push eax
call fcn.0041f1c0
add esp, 4
push eax
push 1
lea ecx, [ebp - 0xb4]
call fcn.00415250
push eax
call fcn.00433f4b
add esp, 0x10
mov edx, dword [ebp - 0x10]
push edx
call fcn.0042802a
add esp, 4
lea ecx, [ebp - 0xb4]
call fcn.00415060
mov byte [ebp - 4], 0
lea eax, [ebp - 0xb8]
call fcn.00405b50
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x14]
call fcn.00405b50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0041d97a
mov esp, ebp
pop ebp
ret 4

Function at 0x43f440
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x24]
cmp ecx, 9
je 0x43f465
movzx edx, word [ebp - 0x24]
cmp edx, 6
jne 0x43f46e
mov eax, 1
jmp 0x43f470
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x43f480
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x475080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x250], ecx
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x3c
push 0
lea ecx, [ebp - 0x24c]
push ecx
call fcn.0041eb30
add esp, 0xc
mov dword [ebp - 0x24c], 0x3c
mov dword [ebp - 0x248], 0x440
mov edx, dword [ebp + 8]
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x240], str.runas
mov dword [ebp - 0x234], 0
lea ecx, [ebp - 0x24c]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d97a
mov esp, ebp
pop ebp
ret 8

Function at 0x43f520
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x475080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
ja 0x43f56b
cmp dword [ebp - 0x124], 6
jne 0x43f56f
cmp dword [ebp - 0x120], 2
jb 0x43f56f
mov al, 1
jmp 0x43f571
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d97a
mov esp, ebp
pop ebp
ret

Function at 0x43f720
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x475080]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0x14]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 2
push 0
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041d97a
mov esp, ebp
pop ebp
ret

Function at 0x43f790
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x5c], ecx
push 0x44
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.0041eb30
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.0041eb30
add esp, 0xc
mov dword [ebp - 0x58], 0x44
push 0
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x58]
push ecx
push 0
push 0
push 0x4000004
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0042b5a0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret 8
Function at 0x43f800
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call sym.Install_vip.exe_public:_void___thiscall_CNsHook::AdjustTokenPrivilegesForNT_void_
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43f832
xor al, al
jmp 0x43f922
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x1c]
call sym.Install_vip.exe_public:_int___thiscall_CNsHook::IsWow64ProcessEx_void__
test eax, eax
je 0x43f853
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x43f922
push 0x466034
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x10], eax
push 0x466164
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
push 4
push 0x3000
push 0x200
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xc], eax
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.0041f1c0
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x43f8d9
xor al, al
jmp 0x43f922
push 0x1f4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
je 0x43f90c
push 0x4000
push 0x200
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x43f9c0
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call sym.Install_vip.exe_public:_void___thiscall_CNsHook::AdjustTokenPrivilegesForNT_void_
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43f9f2
xor al, al
jmp 0x43fb03
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x1c]
call sym.Install_vip.exe_public:_int___thiscall_CNsHook::IsWow64ProcessEx_void__
test eax, eax
je 0x43fa13
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x43fb03
push 4
push 0x3000
push 0x200
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x14], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041f1c0
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x18], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push 0x4000
push 0x200
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x18], eax
push 0x1f4
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x43fb10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x475080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x244], ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x43fb44
jmp 0x43fbb9
push 0x22c
push 0
lea eax, [ebp - 0x238]
push eax
call fcn.0041eb30
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x43fbb9
mov eax, dword [ebp - 0x230]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x244]
call sym.Install_vip.exe_public:_bool___thiscall_CNsHook::UnInjectProc_char_const___int_
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x240], eax
jmp 0x43fb7e
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d97a
mov esp, ebp
pop ebp
ret 4

Function at 0x43fbd0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b347
mov eax, dword fs:[0]
push eax
sub esp, 0x458
mov eax, dword [0x475080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x464], ecx
mov eax, dword [ebp + 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x43fc1d
xor al, al
jmp 0x43fd0f
push 0x428
push 0
lea ecx, [ebp - 0x43c]
push ecx
call fcn.0041eb30
add esp, 0xc
mov dword [ebp - 0x43c], 0x428
lea edx, [ebp - 0x43c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x43fc63
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x43fd0f
lea edx, [ebp - 0x440]
push edx
mov ecx, dword [ebp + 8]
call fcn.00405940
mov dword [ebp - 4], 0
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x440]
call fcn.0041c820
test eax, eax
je 0x43fca5
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x440]
call fcn.0041c820
test eax, eax
jne 0x43fcd1
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x428]
mov dword [edx], eax
mov byte [ebp - 0x441], 1
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x440]
call fcn.00405b50
mov al, byte [ebp - 0x441]
jmp 0x43fd0f
lea ecx, [ebp - 0x43c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x43fc79
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x442], 0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x440]
call fcn.00405b50
mov al, byte [ebp - 0x442]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041d97a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43fd30
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45b37a
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x475080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x248], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x43fd8b
xor eax, eax
jmp 0x43fe63
push 0x22c
push 0
lea eax, [ebp - 0x244]
push eax
call fcn.0041eb30
add esp, 0xc
mov dword [ebp - 0x244], 0x22c
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
je 0x43fe5d
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x220]
call fcn.00405940
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x254]
call fcn.0041c820
test eax, eax
jne 0x43fe2c
mov edx, dword [ebp - 0x23c]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x248], eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x254]
call fcn.00405b50
jmp 0x43fe5d
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x250], eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x254]
call fcn.00405b50
jmp 0x43fdc5
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d97a
mov esp, ebp
pop ebp
ret 4